I Accidentally Uploaded a Document to AI: What to Do in the Next 30 Minutes

If you accidentally uploaded a document to AI, delete the chat, remove the file from any library or project, switch off model training, and decide whether anyone needs to be told. Most owners finish the first three in ten minutes. The fourth takes one honest look at what the file contained.

TL;DR: An accidental upload is fixable, and the fix runs in four steps. Delete the chat and every other copy of the file. Turn off training so future chats stay out of it. Run the three-question severity check below to see how serious the upload was. Write down what you decided and when. ChatGPT and Claude both remove deleted chats from their systems within 30 days. DocsAura, an AI document design tool that handles one file at a time, leaves fewer places to check afterward.

Maybe you dragged the wrong file into the window. Maybe the spreadsheet had a second tab with salaries, or the client report carried a name you promised to keep private. The sinking feeling is normal, and it fades once you have a list of things to do.

What to Do When You Accidentally Upload a Document to AI

Work through these five moves in order. The first two limit the damage, and the other three tell you how much attention the upload deserves.

1. Stop and do not send more. Close the attachment prompt and stop adding files to that conversation. Each follow-up message makes the chat longer and the cleanup slightly bigger.
2. Take a screenshot of what you uploaded. Capture the file name, the date and the first lines of the chat. You will need these for your own record in step 5, and the chat disappears once you delete it.
3. Delete the chat. In ChatGPT, open your chat history, choose the three-dot menu, then Delete. OpenAI says the chat leaves your account view at once and is scheduled for permanent deletion from its systems within 30 days, unless it was already de-identified or OpenAI must keep it longer for security or legal reasons.[^1] In Claude, open the conversation, use the drop-down next to the title and choose Delete. Anthropic says a deleted conversation leaves your history immediately and is removed from its back-end storage within 30 days.[^2]
4. Delete the other copies. Uploads can also live in a file library, a project, a custom assistant or a public share link. Our five-minute delete checklist walks through each of those places tool by tool.
5. Write down what happened. One line is enough: date, file name, tool, what you deleted, what you decided next. If a client or a regulator asks later, the note shows you acted the same day.

Turn Off Training So the Next Chat Stays Out of It

Deleting the chat handles the file you already sent. The training setting handles everything you send afterward.

ChatGPT. Open Settings, then Data controls, and switch off "Improve the model for everyone." OpenAI says that with this setting off, your new conversations will not be used to train its models.[^3] The setting applies to new conversations. It leaves existing chats in place and cannot pull back anything already used.

Claude. On Free, Pro and Max accounts, turn off the "Help improve Claude" toggle in Privacy settings. Anthropic says that with the toggle on, it may keep de-identified chats in its training pipeline for up to five years. With the toggle off, the standard 30-day retention applies. Anthropic also says a conversation you delete will not be used for future model training.[^2] That last point is the reason to delete the chat quickly.

Business and team plans usually start with training off by default, which is a good reason to check which kind of account you used. Our article on whether AI trains on your business documents explains the default for each plan type.

The Three-Question Severity Check

Not every wrong upload carries the same weight. A draft newsletter and a payroll file call for different responses. We built a three-question check that sorts an upload into low, medium or high concern in about two minutes. Score one point for each "yes."

What we found when we built a severity check for accidental uploads

We read the retention pages of ChatGPT and Claude next to the breach-notification rule in GDPR Article 33 and asked what each one turns on. Three questions separate the uploads that need action from the ones that need only a deletion:

1. Does the file name a person? Customers, employees, patients, tenants, anyone who could be identified from it.
2. Does the file carry money or credentials? Bank details, payroll, tax numbers, contract prices, passwords or access links.
3. Did you promise someone confidentiality? An NDA, a client contract or a verbal promise.

Zero points: delete and move on. One point: delete, record it, and read your contract or policy for that file type. Two or three points: delete, record it, and tell the person who owns the data or the promise, using the section below. A stray draft or template scores zero, a client report with names scores one or two.

Who You Might Need to Tell

The right audience depends on your score and on where your customers live.

• Your client or customer. If the file was theirs and your contract or NDA covers confidentiality, a short honest note beats a surprise later. Say what was uploaded, what you deleted, and that the tool is on a retention schedule. Our piece on asking clients for permission before using AI on their documents covers the wording.
• Your regulator, if personal data of EU or UK residents was involved. GDPR Article 33 requires a controller to notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach, unless the breach is unlikely to result in a risk to people's rights and freedoms. Article 33 also requires you to document every breach, including the ones you decide not to report.[^4] Whether an upload to an AI tool counts as a breach depends on the tool's terms and the facts. If a score of two or three involves personal data, ask your data protection authority or a lawyer, and keep your one-line record.
• Your own team. Tell whoever uploaded the file and whoever manages your tools. The goal is a better habit, so skip the blame.

Why Deletion Has Exceptions

OpenAI's help page lists the exceptions: de-identified data, and data it must keep for security or legal reasons.[^1] The legal exception had a real example in 2025. A U.S. federal court ordered OpenAI in May 2025 to preserve output logs that would otherwise be deleted, and the obligation to keep new logs ended on September 26, 2025. Logs preserved earlier, and data tied to accounts flagged in the case, remained in scope.[^5]

For a typical small business, the practical reading is simple. Delete quickly, because a short life on the vendor's servers is better than a long one. Treat the deletion as strong evidence of good faith. Avoid describing it to a client as a guarantee that no copy exists anywhere, and say instead that the vendor schedules removal within 30 days.

Real Companies Have Done This Too

In April 2023, Samsung engineers uploaded internal source code to ChatGPT, and the company banned staff use of generative AI tools shortly afterward, according to Bloomberg.[^6] The lesson for a small team: the mistake is common, and the strongest protection is a short rule that everyone knows. Our guide to an AI policy for a small business fits on one page.

How to Make the Next Upload Boring

Prevention costs less than cleanup, and it needs three habits.

1. Name files before you upload them. A file called "final-v3" invites mistakes. "Quote-template-no-client-data" tells you what is inside.
2. Strip the sensitive parts first. Our checklist on what to redact before uploading a document to AI takes about three minutes per file.
3. Pick a tool that handles one job. A tool with no library, no projects and no memory leaves fewer places to clean. DocsAura, an AI document design tool, takes the Word or PDF file you already wrote and returns a designed page in about two minutes, one document at a time.

Your 30-Minute Plan

1. Stop sending files and screenshot the chat.
2. Delete the chat, then the library, project and share-link copies.
3. Turn off training in ChatGPT or Claude.
4. Score the file with the three questions.
5. Tell the owner of the data if you scored two or three.
6. Write one line in a note: date, file, tool, action, decision.

When you are ready for a calm first test, drop one document you already have into DocsAura, a document you are comfortable sharing, and see what comes back in about two minutes. It is one task with no setup and nothing to maintain.

[^1]: OpenAI Help Center, "Deleting and archiving chats in ChatGPT" (https://help.openai.com/en/articles/8809935-deleting-and-archiving-chats-in-chatgpt) [^2]: Anthropic Privacy Center, "How long do you store my data?" (https://privacy.claude.com/en/articles/10023548-how-long-do-you-store-my-data), and Anthropic, "Updates to Consumer Terms and Privacy Policy" (https://www.anthropic.com/news/updates-to-our-consumer-terms) [^3]: OpenAI Help Center, "Data controls in ChatGPT" (https://help.openai.com/en/articles/7730893-data-controls-in-chatgpt) [^4]: General Data Protection Regulation, Article 33 (https://gdpr-info.eu/art-33-gdpr) [^5]: ComputerUser, "ChatGPT will no longer retain deleted user conversations" (https://computeruser.com/chatgpt-will-no-longer-retain-deleted-user-conversations) [^6]: Bloomberg via Yahoo Finance, "Samsung Bans Staff's AI Use After Spotting ChatGPT Data Leak" (https://finance.yahoo.com/news/samsung-bans-generative-ai-staff-004831399.html)