Guide
Is it safe to put client data into ChatGPT? UK GDPR in plain English for small businesses
IN SHORTIt can be, but not on a personal account with default settings. Under UK GDPR you stay responsible for client data you paste into any AI tool. Use a business plan with a data processing agreement, check model training is off, share only what the task needs, keep special category data out, and write down what you decided.
Putting client data into ChatGPT can be safe for a small UK business, but only on the right plan, with the right settings, and with less data than you probably think. UK GDPR does not ban AI tools. It makes you responsible for what happens to personal data you put into them. This guide explains what that means in practice, without the legal jargon. It is general guidance, not legal advice, and because AI plans change often, the details are dated below.
What does UK GDPR actually ask of a small business using AI?
UK GDPR asks you to treat an AI tool like any other supplier that handles your clients' personal data. If you decide why and how the data is used, you are the controller, and the responsibility stays with you, not with the AI company.
In practice that comes down to four questions. Do you have a lawful reason to use the data this way? Does your privacy notice cover it? Is the supplier bound by a contract that protects the data? Are you sharing only what the job needs? The Information Commissioner's Office (ICO), the UK regulator, publishes guidance on AI and data protection if you want the detail.
What counts as client data?
Client data, in UK GDPR terms, is any information that identifies a living person. Names, email addresses, phone numbers, home addresses and anything that could be pieced together to identify someone all count.
Company details on their own, such as a limited company's registered name and Companies House number, are generally not personal data. A sole trader's or a director's details usually are. If in doubt, treat it as personal data.
Why do the plan and settings matter so much?
The plan matters because personal and business versions of the same AI tool come with different data terms. The difference is mainly whether your conversations can be used to train future models, and whether a business contract covers the data.
| Personal plan, such as Free or Plus | Business plan, such as Business or Enterprise | |
|---|---|---|
| Who it is for | Individuals | Organisations, with admin controls |
| Conversations used to train models | On by default; you can switch it off | Off by default |
| Data processing agreement | Not offered | Available to sign |
| Admin control over users | None | Add and remove staff, manage settings centrally |
| Suitable for client personal data | Not on its own | Yes, once you have checked the terms and signed the agreement |
On a personal ChatGPT account, the training setting is called "Improve the model for everyone", under Settings, then Data controls. ChatGPT's plan for small teams used to be called Team and is now called Business, so older articles may use the old name.
The same pattern applies to the other main tools. On Claude's personal plans, the "Help improve Claude" setting is on by default; Claude's Team and Enterprise plans are not used for training. Gemini inside Google Workspace business accounts does not use your content to train its models. Microsoft 365 Copilot Chat, used while signed in with a work account, comes with Microsoft's enterprise data protection, and your prompts are not used to train its models.
A note on dates: AI plans, plan names, prices and data terms change often. Everything in this guide was accurate when I checked it on 15th October 2026. If you are reading this later, some of it may have changed, so check the vendor's own pages before you decide.
Is a free or personal ChatGPT account ever fine for work?
A free or personal account is fine for work that contains no personal data. Drafting a generic price list, rewriting your website copy or planning a newsletter carries little data risk.
The problem starts the moment a client's name, email or circumstances go in. On a personal account there is no data processing agreement, and staff may be using their own logins that you cannot see or close. That is the bit that tends to go wrong quietly in small teams.
What should never go into an AI tool?
Special category data should stay out of general AI tools unless you have taken proper advice. Under UK GDPR that includes health information, racial or ethnic origin, religious beliefs, sexual orientation, trade union membership, and genetic or biometric data. Criminal offence data has its own separate rules.
Other things to keep out, whatever the plan:
- Passwords, bank details and card numbers typed into an ordinary chat. If an AI assistant needs access to one of your tools, connect it the way it was designed for: through the tool's official connection or a secure password store built for the purpose, ideally with its own login so you can switch it off
- Anything a client has told you in confidence, unless they have agreed
- Information covered by a professional duty of confidentiality, if your sector has one
- Whole client files, when a summary or an anonymised extract would do the job
How do you use AI with client data safely?
Use the least data that still gets the job done, on a business plan, with training switched off. Most tasks need far less identifying detail than people expect.
If you want help writing a reply to a difficult client email, replace the name with "the client" and remove anything else that identifies them. The AI writes just as good a reply. You put the name back before you send it.
I hold myself to the same rules in my own work. When someone books a Simplish AI Assessment, the session is recorded only if they tick to agree, AI tools transcribe it and draft the report, and I review every report before it reaches them. Every supplier that touches that data has a data processing agreement with us, and everything is deleted after 24 months, or sooner if the person asks.
What is a sensible five step checklist?
A small team can cover the essentials in an afternoon. This is the checklist I would work through first.
- Pick one business account. Move the team off personal logins and onto one business plan you control.
- Check the training setting. Confirm conversations are not used to train models, and screenshot the setting with the date.
- Get the paperwork. Sign or download the supplier's data processing agreement and keep it with your other supplier contracts.
- Update your privacy notice. Say that you use AI tools to help with your work and name the types of supplier. The ICO explains what a privacy notice must cover in its guidance on the right to be informed.
- Write a one page rule for the team. What can go in, what never goes in, and who to ask. Review it every six months.
If you already keep a record of processing for other systems, add the AI tool to it. For higher risk uses, such as decisions about people or anything involving special category data, the ICO expects a data protection impact assessment before you start.
Does UK GDPR stop small businesses using AI?
No. UK GDPR asks you to be deliberate and to be able to show your thinking, not to avoid useful tools. A business that has chosen its plan, checked its settings, written its team rule and kept the paperwork is in a far stronger position than one that has banned AI on paper while staff use personal accounts anyway.
The Data (Use and Access) Act 2025 has updated parts of UK data protection law, with most of the changes in force since early 2026. It does not change the basics in this guide: you remain responsible for the client data you choose to share. The ICO's advice for small organisations has templates and plain English help if you want to go further.
Who is this for, and who is it not for?
This guide is for owners of businesses with three to twelve people who already use, or want to use, ChatGPT, Claude, Gemini or Copilot with client information. It assumes no technical or legal background.
It is not for regulated firms with specific sector rules, such as solicitors, financial advisers or healthcare providers, who should follow their regulator's guidance and take professional advice. It is not legal advice for anyone.
Where can I talk this through in person?
Using AI safely with your data is the topic of AI for Business Bournemouth on 29th October, hosted by Simplish AI. The room voted for it at our launch meetup on 24th September 2026, and Edward Apeh of Bournemouth University is giving a guest talk. Bring your questions.
If you have one repetitive task you want to hand to AI and are unsure what data it would touch, the free Mini Assessment is a ten minute call with Danni, our AI business analyst, then a fifteen minute call where I hand you the fix.
Related guides
Data terms are one reason business plans cost more than personal ones, so read what AI really costs a small UK business alongside this. See what a good AI assessment should include, or browse the rest of our guides.
Not sure what data your tasks touch?
Start with the free Mini Assessment: ten minutes with Danni, our AI business analyst, one task and one fix you keep either way.