Is ChatGPT Safe for Business? Data, GDPR and the Settings That Matter

Your team is almost certainly using ChatGPT already. Surveys of UK businesses keep finding the same thing: plenty of staff use AI tools at work, often on personal accounts their employer doesn't know about. So the question isn't really "should we use ChatGPT?" but "is the way we're using it safe?"

What Happens to What You Type

On free and personal plans, OpenAI can use your conversations to improve its models unless you switch off the model-improvement option in ChatGPT's Data Controls settings. Conversations are kept in your history until you delete them. Temporary Chat doesn't save to history and isn't used for training, though OpenAI may keep it for a short period for safety checks.

On business plans (ChatGPT Business and Enterprise), OpenAI states it doesn't train on your business data by default. You also get an admin console, the ability to manage who has access, and, on higher plans, controls such as single sign-on and data retention settings.

What UK GDPR Means for Using ChatGPT

• Personal data needs a lawful basis. Putting customers' or employees' personal data into an AI tool is processing, so it needs to be justified and covered by your privacy notice.
• Know your processor. A business plan comes with a data processing agreement. A staff member's personal account doesn't.
• Minimise. Most tasks don't need names at all. Remove or replace identifying details before using AI.
• High-risk uses need more thought. Using AI to make decisions about people, such as recruitment, may need a data protection impact assessment. The ICO publishes guidance on AI and data protection.

Professional rules may apply too. Solicitors, accountants and financial advisers have confidentiality duties that go beyond GDPR.

Other Risks to Know About

• Wrong answers. ChatGPT can state things confidently that aren't true, including made-up facts and references. Anything going to a client needs checking by a person.
• Sensitive uploads. Files you upload are part of the conversation, so the same rules apply.
• Connected apps. Connecting ChatGPT to email, drives or other tools gives it access to that data. Only connect what's needed, using business accounts.
• Prompt injection. Documents and web pages can contain hidden instructions that try to steer AI tools. Be careful about letting AI act on content from outside your business.
• Account security. A ChatGPT account full of business conversations is worth protecting. Turn on multi-factor authentication, or single sign-on on business plans.

Six Rules to Make ChatGPT Safe at Work

1. Provide an approved business account so staff don't need personal ones.
2. Write down what must never be entered: client confidential information, personal data, passwords and financial details, unless the tool is approved for it.
3. Turn off model training on any personal accounts that are still used for work, and switch on multi-factor authentication.
4. Check before you send. A person reviews AI output before it goes to a client or is relied on.
5. Be open with clients where AI is used on their work, if your contracts or professional rules require it.
6. Review regularly, as features and settings change often.

Our free AI acceptable use policy template puts these rules into a document you can give to staff today.

What About Copilot and Gemini?

The same principles apply. Microsoft 365 Copilot and Gemini in Google Workspace work inside your existing business account and security controls, which helps, but they bring their own risk: they can surface files that were shared too widely. Read our ChatGPT vs Copilot comparison and Copilot readiness checklist.

Want Us to Check?

Our AI Readiness Check finds out which AI tools your team is already using, where your data is going and what to put in place, in plain English. We also run AI training for staff that covers safe use as standard.