ChatGPT and UK GDPR
Is ChatGPT safe for client data? A guide for UK firms
ChatGPT Business and Enterprise can be used for client work, with the right safeguards in place. The Free, Go, Plus and Pro plans shouldn't be, because there's no contract with your firm.
By Paulo De Sousa, Co-founder of SimpleKPILast checked
ChatGPT plans at a glance
The same AI tool can be safe or risky, depending on the plan someone is signed in to.
| Plan | Contract with your firm | Trains on what's typed | For client data? |
|---|---|---|---|
| Free, Go, Plus or Pro | No contract or data processing agreement with your firm. | May be used to train OpenAI's models unless the user turns off "Improve the model for everyone". | No personal data |
| Business (formerly Team) | Business terms, with a data processing agreement available. | Not used for training by default. | Yes, with safeguards |
| Enterprise | Business terms, with a data processing agreement available. | Not used for training by default. | Yes, with safeguards |
From OpenAI: how your data is used, checked 21 October 2026. Check your own plan with the AI plan checker.
ChatGPT Business vs Plus: what changes for your data
It's the same ChatGPT on screen, so it's easy to miss the difference. Free, Go, Plus and Pro are personal plans. Each person controls their own settings, and there's no contract or data processing agreement between OpenAI and your firm.
On those personal plans, OpenAI may use conversations to train its models unless the user turns off "Improve the model for everyone". So whether a client's details end up training the model depends on one person's settings, which you can't see.
ChatGPT Business (previously called ChatGPT Team) and ChatGPT Enterprise come with business terms, and a data processing agreement is available. What's typed isn't used for training by default. These are the plans to choose for client work.
A paid plan isn't the same as a business plan. Plus and Pro cost money, but they're still personal plans, with personal terms.
What UK GDPR expects if you use ChatGPT
- Use a business plan that comes with a data processing agreement (the contract that covers your clients' data).
- List ChatGPT in your records of processing and your privacy notice.
- Do a risk assessment (a DPIA) before you rely on it for client work.
- Check the safeguards if data goes outside the UK.
- Tell your team the rules: which plan to use, and what must never go in.
Before you write your records of processing, check where OpenAI stores your data and whether a UK or EU region is offered on your plan, because it decides which transfer safeguards you need.
What the ICO expects when your team uses AI
Settings to change today
Improve the model for everyone
On a personal plan (Free, Go, Plus or Pro), this setting decides whether OpenAI may use conversations to train its models. If anyone in your team uses a personal account for work, ask them to turn it off. It only changes training, not the lack of a contract, so personal accounts still aren't the place for client details.
Sign in to your firm's Business workspace
On ChatGPT Business, the firm's terms apply, not each person's own settings. Make sure everyone doing client work is signed in to the firm's workspace rather than a personal login in the same browser.
How Saiela helps
- Approve the business plan your firm pays for.
- Warn people on personal accounts, or block them.
- Swap client details out of prompts before anything is sent.
- See which tools and accounts your team uses, as counts, never content.
Questions
What firms ask about ChatGPT and client data.
Does ChatGPT train on my data?
It depends on the plan. On Free, Go, Plus and Pro, OpenAI may use conversations to train its models unless you turn off "Improve the model for everyone". ChatGPT Business and Enterprise aren't used for training by default.
Is ChatGPT Business safe for client data?
It's the right plan for client work: it comes with business terms, a data processing agreement is available, and it isn't used for training by default. You still need the other safeguards UK GDPR expects, such as a risk assessment (a DPIA), an AI policy and keeping unnecessary personal data out of prompts.
Can I use my personal ChatGPT account for work?
For general questions with no personal data in them, yes. For anything with client details, no: a personal account has no contract with your firm, and it may use what's typed for training unless you've changed the setting.
Do I need a DPIA to use ChatGPT?
Usually. The Information Commission (ICO) says that in the vast majority of cases, using AI involves processing likely to result in a high risk, which calls for a risk assessment (a DPIA). Do it before you rely on ChatGPT for client work.
Is ChatGPT Plus a business plan?
No. Plus is a paid personal plan. It has the same personal terms as Free, with no data processing agreement with your firm. ChatGPT Business is the plan built for firms.
Sources
Last checked 21 October 2026. Providers change their plans often. General information, not legal advice.
Paulo De Sousa
Co-founder of SimpleKPI
Paulo has worked in software development and SaaS for over 20 years and leads the engineering behind SimpleKPI and Saiela. He writes about how AI tools handle your data and how Saiela keeps it out of them.
Use ChatGPT without the client data risk.
Approve the right plan, block personal accounts and keep client details out of every prompt. Try it free for 7 days.