Is it safe to share {X} with {Y}?
No. Passport numbers are government-issued identity documents and should not be entered into ChatGPT under normal circumstances. OpenAI may retain user inputs for up to 30 days for safety review, meaning the data does not automatically disappear after a session ends. There is no contractual guarantee that this information remains isolated or is handled under identity-document-specific compliance standards.
Why this matters
- ChatGPT is a general-purpose system with no purpose-built controls for handling government identity documents.
- Inputs submitted through the standard consumer interface may be reviewed by OpenAI staff as part of trust and safety processes.
- Passport numbers are a high-value target for identity fraud because they are difficult to change once compromised.
For enterprise
Employees who submit passport numbers into ChatGPT outside of approved internal systems create direct exposure under data protection regulations such as GDPR, which classifies government identifiers as sensitive personal data requiring specific handling controls. Most enterprise data governance and acceptable-use policies explicitly prohibit entering identity document numbers into third-party AI tools that have not been vetted and contracted for that purpose. A single instance of non-compliant handling can trigger regulatory notification obligations and internal policy violations simultaneously.
Compliances at risk
What counts as Passport Numbers?
- Passport numbers
- Passport document identifiers
- Government-issued travel document numbers
- Machine-readable passport identifiers
- International travel identity documents
Why people share Passport Numbers with ChatGPT
- To complete visa applications
- To verify traveler identity
- To summarize travel documents
- To prepare immigration paperwork
What actually happens when you paste Passport Numbers into ChatGPT
When you paste Passport Numbers into ChatGPT, that data is transmitted from your device to external servers operated by the AI provider.
Depending on system configuration and policies, the data may be logged, temporarily stored, or reviewed for safety and quality purposes. Retention can last from days to weeks, and in some cases may extend beyond the immediate session.
Statements such as “we do not train on your data” do not eliminate risks related to retention, logging, or internal access. These controls vary by product and setting, and are not always visible to end users.
From a governance perspective, any non-zero retention window introduces exposure risk when sensitive data is shared without controls, auditability, or enforcement.
Risks of sharing Passport Numbers with ChatGPT
- Identity theft: Exposed personal details can be used to impersonate individuals across services.
- Phishing attacks: Leaked contact information enables targeted phishing campaigns.
- Account takeover: Identifiers can be used to reset passwords and gain access to accounts.
Real incidents
- ChatGPT chat history leak (2023) : Users could see conversation titles and partial messages due to a system bug.
- Redis bug exposing chat and payment data : A vulnerability exposed chat histories and partial payment information across users.
- Credential theft via infostealer malware : Over 100,000 ChatGPT credentials were stolen from infected devices.
Is this allowed under policy or law?
Safer ways to handle Passport Numbers
Passport Numbers should not be shared with consumer AI tools without controls in place. If AI assistance is required, organizations should use systems that enforce data redaction, access controls, and policy enforcement before data leaves their environment.
- Automatically redact sensitive fields before sending data to AI models
- Prevent unauthorized data from being entered into external tools
- Maintain audit logs and visibility into how data is used
- Ensure compliance with frameworks like GDPR, CCPA, and SOC 2
Platforms like Wald are designed to enable safe AI usage by ensuring sensitive data never leaves your control unprotected.
How Wald.ai handles this safely
Wald adds a governance layer to AI usage, helping organizations monitor and control how sensitive data like Passport Numbers is shared.
AI DLP
Identifies Passport Numbers in context and enables teams to:
- Observe AI usage
- Detect sensitive data in prompts
- Allow, warn, or block actions
- Maintain audit logs
LLM Pack
Provides controlled access to multiple AI models (ChatGPT, Claude, Grok, and others) through a single governed environment.
- Centralized model access
- Policy enforcement
- Usage visibility
- Auditability
