# Is It Safe to Put Customer Data into ChatGPT? A UK GDPR Guide for Small Businesses Short answer: not on a free or personal ChatGPT account without thinking it through first. Customer names, emails and order details are personal data under UK GDPR, so you need a lawful basis, the right account type and clear rules before staff paste them in. On a ChatGPT business plan with a data processing agreement, the picture is different. *Last checked: 24 October 2026. Based on ICO guidance, OpenAI's own published policies and PolicyPeek's checks of AI tools' policies. Not legal advice.* ## Does UK GDPR apply when I paste customer data into ChatGPT? Yes. The ICO says personal data is information that relates to or identifies a person, such as names, email addresses, phone numbers and payment information, and that the rules cover businesses of every size, from sole traders up. ([ICO advice for small organisations](https://ico.org.uk/for-organisations/advice-for-small-organisations/getting-started-with-gdpr/data-protection-advice-on-common-topics)) Putting that data into an AI tool is processing it. ## What lawful basis do I need? The ICO has answered this for a business using generative AI to draft replies to clients. It says legitimate interests can work if you can show the AI use is necessary and proportionate and doesn't override your clients' rights. Consent can also work where you have a direct relationship with the people concerned. If the data includes special category data, such as health information, you also need a separate Article 9 condition, for example explicit consent. ([ICO previously asked questions](https://ico.org.uk/for-organisations/advice-and-services/innovation-advice/previously-asked-questions/)) The ICO also says you must decide and document your lawful basis before you start, and include it in your privacy notice. ([ICO: lawfulness in AI](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/how-do-we-ensure-lawfulness-in-ai/)) ## Does ChatGPT train on customer data I paste in? It depends on the account: - **Free and personal ChatGPT:** OpenAI's help centre says "When you use our services for individuals (Free, Plus, Pro), we may use your content to train our models." and "To opt out, turn off Improve the model for everyone under Settings > Data controls in ChatGPT, or select Do not train on my content in our Privacy Portal." ([OpenAI help](https://help.openai.com/en/articles/5722486-how-your-data-is-used-to-improve-model-performance)) PolicyPeek's badge is **Trains by default, you can opt out**. ([ChatGPT on PolicyPeek](https://getpolicypeek.com/tools/openai.com/)) - **ChatGPT Business, Enterprise and the API:** OpenAI says it does not train on this business data by default, and it can sign a Data Processing Addendum (DPA) for these plans to support GDPR compliance. ([OpenAI enterprise privacy](https://openai.com/enterprise-privacy/)) Other tools vary a lot. Of 61 AI tools PolicyPeek rates (5 November 2026), 15 say they don't train on your data and 15 train with no opt-out found. ([Tools that don't train](https://getpolicypeek.com/guides/ai-tools-that-dont-train-on-your-data-uk/), [Tools with no opt-out](https://getpolicypeek.com/guides/ai-tools-that-train-on-your-data-no-opt-out/)) ## A safer way to use ChatGPT with customer data 1. **Use a business plan** and sign the provider's DPA where one is offered. 2. **Strip identifiers** where you can. "A customer ordered the wrong size" works as well as their name and address. 3. **Never paste special category data** (such as health information) without a documented lawful basis and Article 9 condition. 4. **Switch off training** on any personal account staff still use for work. 5. **Write it down** in a short AI policy. See [Do UK small businesses need an AI policy?](https://getpolicypeek.com/guides/do-uk-small-businesses-need-an-ai-policy/) 6. **Train staff** on the rules. See [EU AI Act Article 4 for small UK businesses](https://getpolicypeek.com/guides/eu-ai-act-article-4-ai-literacy-small-uk-business/). ## What if someone already pasted customer data in? Don't panic, and don't ignore it. Record what went in, which tool and account was used, and delete the conversation. Then decide whether it counts as a personal data breach. The ICO says you must report a breach to it within 72 hours of becoming aware of it, unless it's unlikely to result in a risk to people's rights and freedoms. ([ICO: personal data breaches](https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/)) ## Changes - 4 November 2026: PolicyPeek tool counts updated to 61 rated tools. The 10 tools the 28 October audit had flagged stay on the site with their existing verdicts while PolicyPeek re-checks them. ## FAQ ### Is it illegal to put customer data into ChatGPT in the UK? Not automatically. UK GDPR applies, so you need a lawful basis, a suitable account and appropriate safeguards. Pasting customer data into a personal account that trains on it, with no basis or policy, is the risky version. ### Does ChatGPT Business train on my data? OpenAI says it does not train on data from ChatGPT Business, Enterprise or the API by default, unless you explicitly opt in to share it. ### Does OpenAI offer a DPA? Yes. OpenAI says it can execute a Data Processing Addendum for ChatGPT Business, ChatGPT Enterprise and the API. ### Do I need a DPIA to use ChatGPT? The ICO says you need a DPIA when processing is likely to result in high risk to people, for example with sensitive data such as health information. For low-risk drafting with no personal data, you usually won't.