Professional secrecy
Can I use ChatGPT with client documents? What professional secrecy says
By Hugo Ribeiro · Updated · 6 min read
Firms already use AI to summarise contracts, review trial balances, prepare replies to the tax authority and draft opinions. At the same time, almost every professional who works with client documents is bound by a duty of secrecy set by their professional body. The two aren't incompatible, but they need a method.
What the rules say
In Portugal, the statute of the Order of Certified Accountants (article 72(1)(d)) requires accountants to keep secret the facts and documents they learn about in their work; the code of ethics (article 10) adds that the duty has no time limit and only ends with the client's consent, a court decision or the Order's authorisation. Lawyers are bound by article 92 of the Bar statute, and statutory auditors by their own statute. Similar duties exist across the EU, and the GDPR applies on top: sending client documents to an AI service is a processing of personal data that needs a legal basis, a contract with the provider and, outside the EU, transfer safeguards.
The Portuguese Order of Accountants has flagged it directly: in October 2025 its president said secrecy is what worries the profession most about AI, and announced a procedures manual on the subject (OCC news, in Portuguese).
Where the risk is
- The text leaves the firm. Paste a document into ChatGPT, Claude, Gemini or Copilot and it's processed on the provider's servers.
- It may be kept. Free and personal plans may store conversations and use them for training unless you opt out.
- There's no undo. Once shared, information can't be recalled.
Three ways to use AI without breaching secrecy
- Ask the client for consent. Formally correct, impractical day to day.
- Only ask generic questions. Fine for doubts about rules, useless for real work on the file.
- Remove identifying data before sending. Tax IDs, social security numbers, ID cards, IBANs, names, companies, addresses and contacts become codes like
[NIF_1]or[PESSOA_1]. The AI works on the document without knowing whose it is; you restore the real data at the end, on your computer.
Only the third works for daily work. Done by hand it's slow and error-prone. That's what Velado is for: it finds the data in Word, Excel, PDF and SAF-T, checks the control digits, swaps it for consistent codes and keeps the key in an encrypted vault that never leaves your computer.
This article is for information only and is not legal advice. Pseudonymisation greatly reduces risk, but pseudonymised data is still personal data under the GDPR (see pseudonymisation or anonymisation?).
FAQ
Can an accountant use ChatGPT?
Yes, as a work tool. What professional rules forbid is disclosing facts and documents learned in the course of the work. Sending an AI service a trial balance or tax return with client data discloses it to a third party.
Do ChatGPT Business or Claude Team solve the problem?
They reduce risk (no training on your data by default, a data processing agreement), but identifiable data still leaves the firm for a third party. Whether that fits your secrecy duty is for you and your professional body to judge; removing the data before sending avoids the question.
Is deleting the client's name enough?
No. A tax ID, an IBAN, an address or a case number identifies the client as much as the name. Every identifier has to go, consistently, across every file in the case.
Try it with your own document
Velado runs in your browser, on your computer: nothing is sent to any server.