No. You should not paste customer data into free ChatGPT. Your prompts may be used to train future models, and your business remains liable under UK GDPR as the data controller. You need a lawful basis, proper safeguards, and ideally a business tier with contractual data protection before any customer data goes near an AI tool.
This question comes up in almost every small firm now. Staff use ChatGPT to draft emails, summarise complaints, and analyse spreadsheets. Most of that is harmless. The risk starts the moment a name, email address, or account detail enters the prompt box. Here is what UK GDPR says and what to do instead.
The short answer
Do not put identifiable customer data into free or Plus ChatGPT. OpenAI may use your prompts to train its models unless you opt out, and once data trains a model you cannot pull it back out. For business use you need proper terms: a business tier such as Team, Business, or Enterprise with a data processing agreement, or a different tool with equivalent contractual protections.
The rest of this guide explains why the free version is the problem, what the law requires, and the practical steps that keep you compliant.
Why free ChatGPT is the problem
Your prompts can train the model
On free and Plus plans, OpenAI says it may use your conversations to train future models. You can switch this off in the data controls, but most staff never do. A customer name pasted into a prompt today could resurface in someone else’s answer tomorrow. Training use is the core risk for anything identifiable.
Humans and courts can see your data too
Providers review some conversations for safety and quality checks. Legal orders can also force retention. In 2025 a US court order required OpenAI to keep ChatGPT logs, including chats users had tried to delete, while a copyright case proceeds. OpenAI is challenging that order. The lesson for your business is simple: once you paste data in, you lose control of where it lives and how long it stays there.
The data leaves the UK
UK GDPR treats sending personal data to the United States as an international transfer. That needs proper safeguards, such as standard contractual clauses in a signed agreement. Business tiers come with that paperwork. The free consumer product does not.
What UK GDPR actually requires
You are the data controller
When you decide to put customer data into an AI tool, you decide the purpose and the means of processing. That makes your business the data controller. The ICO holds the controller responsible for what happens next, not the tool provider.
You need a lawful basis
Every use of personal data needs a lawful basis, and convenience is not one of them. For most customer-data tasks, legitimate interests can work, but you must balance them against the customer’s rights and write that assessment down.
You need a contract with the provider
A data processing agreement sets out exactly what the provider may and may not do with your data. Business and enterprise AI tiers include one. Free tiers do not. Without that contract, you cannot show the ICO that the processing was properly controlled.
You must show your working
The ICO expects you to document what you decided and why: which tools are approved, what data may go in, and who is responsible. A written AI usage policy is the simplest way to demonstrate this. We have published an AI usage policy template for UK small businesses that you can adapt. For higher-risk processing, such as large volumes of customer data, you should also complete a data protection impact assessment before you start.
Safer alternatives that still get the work done
Anonymise before you paste. Strip names, email addresses, account numbers, and anything else that identifies a person. Truly anonymised data is not personal data, so UK GDPR does not apply to it. Check the output as well as the input, because context can re-identify someone even when names are gone. If you are unsure, treat the text as personal data.
Move to a business tier. Team, Business, and Enterprise plans do not train on your inputs and they include a data processing agreement. This is the cleanest fix if your team uses AI tools every day.
Keep sensitive work in approved tools. Anything under a non-disclosure agreement, anything financial, and anything with special category data belongs in a tool with contractual confidentiality, such as Microsoft 365 Copilot with commercial data protection, not in a free chatbot.
Always review AI output. Never send AI-generated text to a customer without a human check. Models invent facts, including references to laws that do not exist. Fact-checking is a compliance step, not just a quality step.
What your staff policy must say
Your policy does not need to be long, but it must be specific. It should say: never paste customer or staff personal data into free AI tools; use only the approved business tier; anonymise data where possible; report mistakes to a named person immediately; and ask before using any new AI tool for work.
Do not simply ban AI tools and hope for the best. Staff will use them anyway, and then you have zero visibility of what data is being shared. Give the team an approved route instead. Our cybersecurity tips for remote workers cover the wider habits, such as secure home WiFi and device updates, that belong in the same training session. The staff training that teaches how to spot a phishing email also stops data leaks: teach both together.
What to do if customer data was already pasted in
Stay calm and work through these steps in order.
- Contain it. Do not paste anything more. Write down what went in, when, which account was used, and who can access it.
- Use the provider’s controls. Switch off training use in the data controls. OpenAI also provides a privacy request process for the removal of personal data, so submit a request for the entries you are worried about.
- Assess the risk. Was the data identifiable? Was it sensitive or covered by a confidentiality agreement? Record your assessment in writing.
- Apply the breach rules. If the incident is likely to create a risk to people’s rights and freedoms, report it to the ICO within 72 hours of becoming aware of it. If the risk to individuals is high, tell the affected customers without undue delay.
- Fix the cause. Roll out the written policy and move the team to an approved tier, so the same mistake cannot happen again.
FAQs
Is the paid ChatGPT Plus version safe for customer data?
Plus lets you opt out of training use, which lowers the risk, but it still lacks a data processing agreement for business use. For customer data, use a business tier such as Team, Business, or Enterprise with contractual protections.
Does anonymising the data fix the problem?
Properly anonymised data is not personal data, so UK GDPR does not apply to it. The catch is doing it properly. Removing names is not enough if the remaining detail still identifies someone. When in doubt, treat the text as personal data.
Can the ICO fine a small firm over AI use?
Yes. The ICO can take action against organisations of any size. Serious UK GDPR breaches carry fines of up to 17.5 million pounds or 4 percent of annual global turnover, whichever is higher. In practice the ICO looks at the harm caused and at whether you took the rules seriously, which is why a documented policy matters.
Do I need a data protection impact assessment?
You need one when the processing is likely to be high risk, for example large volumes of customer data or sensitive details. Completing a DPIA before you start is also strong evidence of accountability if the ICO ever asks questions.
What should I do if an employee already pasted data into ChatGPT?
Treat it as a potential data breach. Contain the incident, assess the risk, document everything, and report to the ICO within 72 hours if there is a risk to people’s rights. Then close the gap with an approved business tier and a written staff policy.
The bottom line
Free ChatGPT and customer data do not mix under UK GDPR. Move regular AI work to a business tier with a data processing agreement, anonymise anything that goes into a consumer tool, write the policy down, and train your staff. Those four steps turn a common compliance gap into a routine business process. Start with our AI usage policy template for UK small businesses and adapt it to your firm this week.
