Is it safe to put client data into ChatGPT?
Quick answer: It can be — but not on a free or personal account. Use a business plan (such as ChatGPT Business or Enterprise, Claude Team or Enterprise, or Gemini in Google Workspace) where your data isn't used to train models by default, sign the provider's data processing agreement, tell clients in your privacy notice, and give staff clear rules on what they may paste in. For the most sensitive data, use private AI that runs on your own computer.
The short version
The risk usually isn't the AI itself. It's which account people use and what they paste. A member of staff pasting a client contract into their personal free account is very different from your team using a properly configured business plan.
Personal accounts vs business plans
| Free / personal accounts | Business & enterprise plans | |
|---|---|---|
| Used to train AI models? | Often allowed by default or by user choice — settings vary and change | Off by default |
| Data processing agreement (DPA) | Not available | Available |
| Admin controls, SSO, user removal | No | Yes |
| Retention controls & audit logs | Limited | Yes (more on enterprise tiers) |
| Who owns the account | The employee | Your business |
Providers update their terms often. Always check the current data and privacy terms of the exact plan you buy.
What GDPR expects (UK & EU)
- A lawful basis for using personal data this way, and only the data you need (data minimisation).
- Transparency: your privacy notice should say you use AI tools and which kinds of providers process data for you.
- A data processing agreement with the AI provider (Article 28).
- International transfers: if data leaves the UK/EU, the provider must offer proper safeguards (adequacy or standard contractual clauses).
- A DPIA (data protection impact assessment) when the use is likely to be high-risk — for example health data, large volumes, or decisions about people.
- Being able to honour people's rights — access, correction and deletion.
What US rules expect
- CCPA/CPRA (California) and similar state laws: tell people what you collect and why, have proper service-provider contracts, and honour deletion and opt-out requests.
- HIPAA: patient health information can only go to a provider that signs a business associate agreement (BAA). Most standard AI plans don't — check before using any AI with PHI.
- Client contracts and NDAs may restrict sharing data with third parties at all — read them.
Never paste these (even on business plans, unless approved)
- Passwords, API keys and access tokens
- Full card numbers, bank details or government ID numbers
- Health, biometric or other special-category data — unless you've specifically assessed and approved it
- Anything a client contract says must stay confidential
A 7-step checklist for your business
- Find the “shadow AI”: ask staff which AI tools they already use.
- Pick approved tools and move everyone onto business accounts you control.
- Check the settings: training off, sensible retention, SSO and admin controls on.
- Sign the DPA (and a BAA if health data is involved).
- Write a two-page AI policy: approved tools, banned data, checking AI output, who's accountable.
- Update your privacy notice and, where needed, complete a DPIA.
- Train your team — a one-hour session prevents most mistakes.
The safest option: private AI
For legal, medical, financial or highly confidential work, you can run capable AI models entirely on your own computer or server. Nothing is sent to any provider, which removes most of the data-sharing questions above. See how to run AI privately on your own computer.
This guide is practical information, not legal advice. For formal advice, speak to your solicitor, attorney or data protection officer.
Frequently asked questions
Does ChatGPT train on my data?
On business plans such as ChatGPT Business and Enterprise, your data isn't used for training by default. On personal accounts it may be, depending on your settings — check Settings › Data Controls and the current terms.
Is Claude or Gemini safer than ChatGPT for client data?
The plan matters more than the brand. Business and enterprise plans from OpenAI, Anthropic and Google all offer no-training defaults and data processing agreements. Choose based on features, compliance terms and where data is stored.
Can I use AI with patient or health data?
Only with a provider that signs the right agreement (a BAA under HIPAA in the US) and after a risk assessment (a DPIA under GDPR). Private, local AI is often the simplest compliant route.
What is shadow AI?
AI tools staff use without the business knowing — usually personal accounts. It's the most common source of AI data leaks, and the first thing to fix.
Want it done for you? Book a free call and an expert sets it up with you for one fixed price.
Call now