Services
Explore
Free AI assessmentAnswer 15 questions about one process and see where AI could help.
Start an assessmentIs it safe to put client data into ChatGPT?
For service businesses: what decides whether client material can go into ChatGPT, how consumer and business plans differ, and ways to share less.
The short answer
It depends on the data, the purpose, the service and your obligations
It depends on the data, the purpose, the service and settings, and your obligations to the client. Use only an approved setup for that use case. Turning off training or removing a name does not by itself make an upload appropriate.
Start with four questions. What is the data, and does it include personal or confidential information? What will ChatGPT do with it? Which ChatGPT service are you using, and under which terms and settings? What have you agreed with the client, and what do your professional or regulatory duties require? If you cannot answer all four, keep client material out of ChatGPT until you can.
Consumer, business and API
How ChatGPT's consumer plans, business plans and API differ
The service you use decides which terms apply. Consumer plans and business offerings have different terms on training, data processing agreements, retention and admin controls, and the API has its own. ChatGPT Plus is a consumer plan, so paying for it does not move you onto business terms.
| Plan | Training | DPA | Verdict | Safe |
|---|---|---|---|---|
| Free tier | opt-out | Keep client personal data and confidential material out unless your organisation has approved this setup for that use | ||
| ChatGPT Plus | opt-out | Consumer terms, as for the free plan. Check the same points before any client use | ||
| ChatGPT Team | no | Check the terms, admin settings and retention against your client obligations before use | ||
| ChatGPT Enterprise | no | Check the agreement, controls and retention against your regulatory and client obligations | ||
| OpenAI API | no | Check the API terms, retention and the security of the system you build around it |
Ways to share less
Four ways to reduce what you share, and their limits
None of these options settles the question on its own. Each reduces one kind of exposure. Use them inside a setup your organisation has approved for the work.
- Open Settings in ChatGPT
- Select Data Controls
- Turn off the setting that lets OpenAI use your chats to improve its models
- This applies to future conversations. It does not delete your existing history
Turning off training does not make a consumer plan suitable for client material. OpenAI still keeps conversations for a period for purposes such as safety monitoring. Check its current documentation for how long.
- Compare ChatGPT's business plans on OpenAI's website
- Check what each plan includes on data processing terms, retention and admin controls
- Check whether a data processing agreement is offered for the plan, and review it
- Set up admin controls for who can access the workspace
- Agree internally which kinds of client material the workspace may hold
A business plan gives you different terms and controls. Whether client data can go into it still depends on the data, the purpose and what you have agreed with the client.
- Replace client names, company names and project names with placeholders before pasting
- Use labels such as [CLIENT], [COMPANY] or [PROJECT X]
- Remove email addresses, phone numbers and account references
- Keep the substance you need help with
Removing a name does not necessarily anonymise the data. A job title, location, date or unusual event can still identify a person or a client. Confidential business information stays confidential without names, and your client agreement may restrict its use.
- According to OpenAI's API documentation, data sent to the API is not used for training by default unless the customer opts in
- Check the API terms, data processing terms and retention for the features you use
- API access needs technical setup, so it suits a tool built for staff to use
- Suited to internal tools or automations that process documents in volume
The API changes the terms that apply. Your obligations to the client stay the same. The tool you build also needs access controls, logging and checks agreed before it handles client data.
Sector notes
What to check in your sector
Sector rules and client contracts can add obligations beyond any plan's terms. These notes list questions to raise. They are not legal advice. A regulated firm should take advice from its compliance lead, professional body or legal adviser before using client data with AI.
Riskhigh
Specifics- Client matters may be covered by legal professional privilege. Ask your adviser whether sharing privileged material with an AI provider could affect it
- Check how your SRA confidentiality obligations apply to AI tools
- Check client engagement terms for any restriction on third-party tools
- Read your professional body's current guidance on AI use, such as the Law Society's
Minimumagree an approved setup with your compliance lead, and check whether your professional indemnity insurer needs to know
Riskhigh
Specifics- Financial records and tax information about individual clients are personal data
- FCA-regulated firms should check their obligations on outsourcing and third-party providers
- Check what your engagement letters say about third-party tools
- Anti-money laundering records need particular care. Check how your procedures treat them
Minimumread your professional body's guidance on AI, such as ICAEW or ACCA guidance, and agree an approved setup
Riskhigh
Specifics- Health data is special category personal data under UK GDPR, with additional conditions for processing
- Identify the lawful basis and the special category condition with your data protection lead before any processing
- Keep patient or client session notes out of consumer AI tools
- Read the ICO's guidance on AI and data protection
Minimumconsult your data protection officer, and check whether the work needs a tool approved for healthcare use
Riskmedium
Specifics- CVs contain personal data, such as names, addresses and employment history
- Using AI to screen or score candidates can bring the UK GDPR rules on automated decision-making into play
- Employee performance and HR records need the same care as client data
- Check that any AI-assisted shortlisting does not introduce unlawful discrimination
Minimumagree an approved setup for candidate data, and review automated decision-making separately
Riskmedium
Specifics- Client briefs and brand strategy documents are often covered by NDAs
- Putting NDA-covered content into a third-party AI tool can raise a contractual issue as well as a data protection one
- Check your client contracts for clauses about AI tools
- Market research data with personal details needs the same checks as client personal data
Minimumreview client contracts for AI clauses, and agree which material may go into which tool
Riskmedium
Specifics- Client diagnostics, strategy documents and internal research are often covered by NDAs
- Client organisational data can include personal data, such as information about named staff
- Check whether your professional indemnity insurer asks about AI use
- Removing identifying details reduces what you share, and your confidentiality obligations still apply
Minimumagree an approved setup and a standard step for removing identifying details
Faqs
Can I put client data into ChatGPT at all?
Sometimes, in a setup approved for that use. The answer depends on the data, the purpose, the service and its settings, and your obligations to the client. Consumer plans may use conversations to improve OpenAI's models unless you turn that off. Business offerings and the API have different terms, including on training and data processing agreements. Before uploading client material, check the current terms for the service you use, what you have agreed with the client and any professional duties that apply.
Does ChatGPT share my conversations with anyone?
OpenAI's terms allow it to access conversations for purposes such as safety review and, on consumer plans unless you opt out, model improvement. People working for OpenAI may review some conversations. Business offerings set different limits on use. Like other online providers, OpenAI may disclose data where the law requires it. Check OpenAI's current privacy documentation for the plan you use.
What happens if I accidentally put client data into ChatGPT?
Record what was shared, when and in which account. Delete the conversation and turn off model training if it is on, but do not assume this removes the data, because OpenAI keeps some data for a period after deletion. Tell whoever handles data protection in your business. If the data included personal information, they need to assess whether it is a personal data breach, whether it must be reported to the ICO and what to tell the client. The ICO publishes guidance on breach reporting.
What is a Data Processing Agreement and why does it matter?
A data processing agreement is a contract that sets out how a provider processes personal data on your behalf: which data, for what purpose, for how long and with which safeguards. UK GDPR sets out what a contract with a processor must cover. Check whether the ChatGPT service you use offers such terms, and take advice if you are unsure whether you need one for the use you have in mind.
Can I use ChatGPT for legal, financial, or medical client work?
Possibly. Treat it as a decision for your compliance lead or adviser, who will need to look at more than the plan. Legal work raises questions about privilege and confidentiality. FCA-regulated firms have obligations around third-party providers. Health data is special category data with extra conditions. In each case, agree an approved setup and get internal sign-off on your AI use policy before real client data is used.
Can I use ChatGPT for client work without paying for Enterprise?
Other business plans and the API have their own terms. OpenAI's API documentation says API data is not used for training by default unless the customer opts in, and the API needs technical setup. Removing identifying details reduces what you share, but it does not necessarily anonymise the data and your confidentiality obligations still apply. Whichever route you choose, use it only for the client work your organisation has approved it for.
Talk to us
We help service businesses decide which AI tools and settings fit each use
We can help you choose a plan and settings for each type of work, and draft an internal AI use policy for your team and advisers to review. Questions about your legal obligations need a qualified adviser.