Does Using an AI Provider Create a New Recipient of Research Data?

When You Upload Research Data to ChatGPT, Have You Shared It With Someone Else?

You are analyzing interviews with university instructors about their experiences with generative AI. The transcripts are stored on your university's computer, and access is limited to the authorized research team.

To accelerate the analysis, you copy several transcripts into an external AI service and ask it to identify preliminary themes. You have not emailed the transcripts to another researcher or made them publicly available. You have simply entered them into a chat interface.

However, the information has now been submitted to a system operated by another organization. Depending on the service arrangement, it may be processed on external infrastructure, retained for a period, or made accessible to authorized personnel under specified circumstances.

Does this mean the AI provider has become another recipient of your research data? And if so, does that change the confidentiality and data-protection obligations associated with your study?

Potentially Yes, but the Provider's Legal and Technical Role Matters

Understanding AI Providers, Research Data Recipients, and Processing Arrangements

What Happens When Research Data Are Submitted to an AI Service?

When a researcher submits text, documents, recordings, or other information to an external AI service, that information may be transmitted to infrastructure operated by the provider or its authorized subprocessors.

The service processes the information to perform the requested task, such as generating a summary, classifying excerpts, or responding to a question.

Depending on the service and configuration, submitted information may also be subject to retention, logging, security monitoring, abuse prevention, or other processing activities established by the provider's terms and agreements.

The precise arrangements differ across products and institutional subscriptions.

For example, a consumer-facing chatbot may operate under different data-use conditions from an enterprise service governed by a negotiated data processing agreement.

Researchers should therefore evaluate the particular service arrangement rather than rely on assumptions about generative AI generally.

Does a Data Recipient Have to Be a Human Being?

No. In data-protection contexts, an organization may receive or process information through automated systems without an employee personally reading every submission.

The relevant issue is whether personal data are disclosed or made available to another entity under the applicable legal definition.

For example, Article 4(9) of the European Union's General Data Protection Regulation defines a recipient as a natural or legal person, public authority, agency, or another body to which personal data are disclosed, whether or not it is a third party, subject to a specified exception for certain public authorities.

Under that framework, the concept of a recipient is not limited to an individual human viewer.

However, legal terminology differs across jurisdictions. Researchers should not automatically apply the GDPR definition to every research setting.

The important practical point is that automated processing by another organization may still constitute a legally relevant data-handling arrangement.

Distinguish Data Recipients, Controllers, and Processors

Several legal terms may apply when research information is processed by an external service. Their meanings depend on the governing framework.

These categories are not necessarily mutually exclusive. Under the GDPR, for example, a processor can also be a recipient of personal data.

Researchers should not assume that describing a provider as a processor means no disclosure has occurred or that the provider is free to use the information for independent purposes.

The applicable agreement and actual allocation of processing responsibilities are central to the assessment.

Does Using a Cloud AI Service Automatically Mean the Data Become Public?

No. Disclosure to a service provider is not the same as public publication.

A properly configured enterprise AI service may process data under contractual confidentiality, access controls, and restrictions on permitted uses.

However, the absence of public access does not mean that the processing is irrelevant to research ethics or data protection.

Participant information may still leave the institution's original processing environment, and the researcher may need to verify whether that transfer is authorized.

External processing does not necessarily involve public disclosure, but it may still create confidentiality and governance obligations.

Why the AI Product and Subscription Type Matter

Researchers sometimes refer to a provider's services as though every version operates under identical conditions.

However, consumer products, application programming interfaces, institutionally managed services, and enterprise agreements may differ in data retention, permitted uses, security controls, and administrative access.

For example, a provider may offer particular contractual restrictions on the use of submitted data for model training under one service arrangement but not necessarily under every available product or setting.

Researchers should verify the conditions applicable to their actual account and intended workflow.

They should also examine whether the institution has approved the particular service for the categories of research information involved.

A general statement that a provider offers enterprise privacy protections does not establish that the researcher is using an enterprise configuration covered by those protections.

What Provider Conditions Should Researchers Verify?

Before submitting protected research information, researchers should establish how the service handles data throughout its processing lifecycle.

Researchers should rely on current provider documentation and applicable agreements rather than general assurances generated by the AI system itself.

Provider conditions may change, so consequential research workflows should be evaluated against the terms actually governing the service at the time of use.

Can De-Identification Eliminate the Concern?

Removing direct identifiers may reduce privacy risks, but it does not necessarily eliminate the possibility of identifying participants.

Qualitative research data often contain contextual information that can identify individuals indirectly.

For example, an interview transcript may describe a participant's academic position, department, years of service, and involvement in a distinctive institutional event.

Even after removing the participant's name, someone familiar with the institution may recognize the individual.

Researchers should distinguish pseudonymized information from genuinely anonymous data and consider the likelihood of reidentification.

Where information remains personal data under applicable law, the relevant data-protection obligations may continue to apply.

Even genuinely anonymous information may remain subject to contractual or institutional restrictions on research data sharing.

Does Participant Consent Cover External AI Processing?

Whether existing consent covers an AI provider depends on what participants were told, the proposed processing, and the applicable ethical and legal requirements.

For example, participants may have agreed to interviews being analyzed by a university research team. They may not have been informed that transcripts would be submitted to an external AI service.

The researcher should examine whether the new arrangement falls within the approved protocol and participant information materials.

However, consent is not the only possible legal basis for processing personal data under every data-protection framework. Research ethics consent and legal bases for data processing should not automatically be treated as identical.

Researchers should obtain the appropriate institutional and data-protection determination rather than assuming that a general consent statement authorizes all external processing.

The issue is also connected to whether AI use conflicts with participant expectations, even where a particular processing arrangement may be technically permitted.

What Does the Philippine Data Privacy Act Mean for AI Processing?

In the Philippines, Republic Act No. 10173, or the Data Privacy Act of 2012, establishes requirements concerning the processing of personal information.

The Act distinguishes personal information controllers and personal information processors, with responsibilities determined by their roles in processing.

Its implementing rules and relevant National Privacy Commission issuances provide further requirements concerning lawful processing, security, accountability, and arrangements involving personal information processors.

For example, a Philippine university considering an external AI provider for research transcripts may need to determine the applicable controller-processor relationship, legal basis, contractual safeguards, and possible cross-border processing implications.

The specific requirements depend on the facts and governing arrangements.

Researchers should not assume that every AI provider is automatically a personal information processor under Philippine law. The legal classification depends on what the provider actually does and who determines the purposes and means of processing.

Institutional data protection officers may be appropriate sources of guidance when the proposed workflow involves personal information.

Can the Provider Process Data Without Becoming an Independent Controller?

Yes. Under some arrangements, an AI provider may process personal data on behalf of the research institution rather than determine its own independent purposes for that processing.

For example, a contractual agreement may restrict the provider to performing specified services under the institution's instructions.

However, the provider's role must be assessed according to the actual arrangement. A contract label alone may not settle the legal classification if the underlying processing activities differ.

Researchers should distinguish the provider's technical involvement from its legal authority to determine processing purposes.

Even where the provider acts solely as a processor, the institution may remain responsible for ensuring that the processing arrangement is lawful and appropriately protected.

Can AI Processing Change an Approved Research Protocol?

Introducing a new external provider may change the data management arrangements described in an approved study.

For example, the original protocol may state that only authorized research team members will access interview transcripts through institutionally managed systems.

Submitting those transcripts to an external AI service may introduce a different processing environment and additional contractual or technical considerations.

Whether the change requires institutional notification or amendment depends on the approved protocol and applicable review procedures.

Researchers should evaluate AI use introduced after ethics approval before transferring participant information.

The fact that the research questions remain unchanged does not necessarily mean that the data processing arrangements remain ethically equivalent.

How Should Researchers Prompt AI to Review Provider-Related Risks?

AI can help organize a preliminary review of a proposed processing arrangement, but it should not be relied upon to establish the provider's actual contractual obligations.

This prompt can help prepare questions for the relevant institutional personnel. The researcher must verify the provider's actual conditions through authoritative documentation and applicable agreements.

When Should Researchers Avoid Submitting Data to an AI Provider?

Researchers should not submit protected research information when the processing arrangement lacks necessary authorization or when adequate safeguards cannot be established.

For example, an external service may not be approved for identifiable participant transcripts, or the researcher may be unable to determine whether the provider's retention conditions are consistent with institutional requirements.

In such circumstances, the researcher can consider an authorized institutional environment, a more limited dataset, or a non-AI analytical approach.

The relevant decision is not whether generative AI is generally useful. It is whether the specific provider arrangement is appropriate for the particular research information and purpose.

Sometimes the appropriate ethical decision is not to use the proposed AI service.

When Interview Transcripts Move From the Research Team to an AI Provider

The issue is not that the AI provider necessarily publishes or misuses the transcripts. Rather, the proposed workflow introduces an additional processing relationship that must be evaluated.

The researcher should understand who handles the data, under what authority, and with which protections before the information leaves the original research environment.

Common Misconceptions About AI Providers and Research Data

Treat External AI Processing as a Data Governance Decision

Before submitting research information to an AI provider, identify the organization responsible for processing, the applicable service arrangement, and the categories of data involved.

Then verify whether the processing is consistent with the approved protocol, participant information, institutional requirements, and applicable data-protection law.

Document the provider arrangement and the reasons for selecting it. When personal information is involved, consult appropriate institutional data protection or information security personnel where necessary.

The central issue is not whether the AI interface looks private. It is whether the actual processing arrangement protects the information under the conditions required by the study.

Before Sharing Research Data With an AI Provider

Frequently Asked Questions About AI Providers and Research Data Recipients

Entering Data Into an AI Chat Can Still Involve Another Organization

How to Cite This Guide

This guide is intended to be read, shared, and used in research, teaching, and academic work. If you draw on its ideas, explanations, or other content, please acknowledge the source by citing the guide. Doing so gives appropriate credit and helps your readers locate the original resource.