Can I put client data into ChatGPT? A plain guide for UK small businesses
What counts as personal data, what to check in an AI tool’s terms, and a one-page rule you can give your team. Practical guidance, not legal advice.
Someone on your team has a long email from a client and wants a quick summary. Pasting it into ChatGPT, Copilot or Gemini takes seconds. The question is whether they should.
This guide gives the practical answer for a UK business of 10 to 100 people. It isn’t legal advice. For your own situation, check the ICO’s current guidance or speak to a data protection professional.
The short answer
You can use AI tools with client information, but only once you’ve checked how the tool handles it and decided what your staff may put in. Until then, keep names, contact details and anything sensitive out.
What counts as personal data
Personal data is anything that identifies a living person, directly or indirectly. In an ordinary office that covers more than people expect:
Emails, including the signatures.
CVs, interview notes and staff records.
Invoices, quotes and delivery notes with a contact’s name on them.
Complaints, call notes and meeting minutes.
Spreadsheets with customer lists, even partial ones.
Some information is special category data, such as health details or ethnicity, and needs extra care. Keep it out of general AI tools altogether unless you’ve had proper advice.
Your business is responsible
Under UK GDPR, the business that decides how the data is used is the controller. When a member of staff pastes client details into an AI tool, your business is the one that has to justify it, keep it secure and be able to explain it. The AI company may have obligations too, but they don’t replace yours.
What to check in the tool’s terms
Free consumer versions and paid business versions of the same tool often have different rules. Before anyone uses a tool with client information, find the answers to these questions in the provider’s terms or settings:
Does the provider use what you type to train its models, and can you switch that off?
How long are conversations kept, and can you delete them?
Is there a data processing agreement you can accept?
Where is the data processed and stored, and what protects it if it leaves the UK?
Who in your business controls the account, and can you see how staff are using it?
If you can’t find clear answers, treat the tool as unsuitable for client data.
A one-page AI rule for your team
Most problems come from people guessing. A short written rule removes the guesswork. It can be as simple as this:
Approved tools: name the tools and the accounts staff should use.
Fine to use: drafting, rewording and summarising text once names and contact details are removed.
Never put in: client names, contact details, financial details, staff records, health information or anything marked confidential.
Check before sending: a person reads and corrects anything the AI produces before it goes to a client.
Ask first: the person to ask when someone isn’t sure.
Review the rule when you add a tool or when a provider changes its terms.
Options for sensitive files
Some work can’t be done without the details: matching invoices to orders, checking contracts, answering staff questions from HR policy. There are a few ways to handle it, each with trade-offs.
Remove the identifying details first
Replace names and contact details before pasting. It works for one-off drafting, but it’s slow, and easy to get wrong across a long document.
Use a business version with the right terms
Business plans from the main providers usually offer a data processing agreement and settings that stop your data being used for training. Check the questions above against the specific plan you’re considering.
Run a model on your own hardware
Open-weight models can run on a computer in your office, such as a well-specified Mac. The files are processed on hardware you own, and you decide what, if anything, goes to a cloud service. You still need to secure the machine, control who uses it and keep it maintained, and it won’t match the largest cloud models on every task. How local AI works explains the set-up in plain English.
A checklist
We know which AI tools staff use, including free ones.
We’ve read the terms for each and know whether what we type is used for training.
We have a data processing agreement wherever client data is involved.
Staff have a written rule on what can and can’t go in.
A person checks AI output before it reaches a client.
We review all this when tools or terms change.
Where to check the current rules
The Information Commissioner’s Office publishes guidance on AI and data protection and updates it as the law and the technology change. Treat it as the authority over anything you read elsewhere, including this guide.
If you’d like to talk through how your team uses AI with client information, book a free 30-minute call.