Is ChatGPT safe for company data? Privacy and GDPR basics

The short answer

ChatGPT is safe for most everyday company data if you use a business plan and follow a few simple rules. On a free or personal account, be careful: what you type can be used to train the AI unless you switch that off, and you have no data processing agreement with the company.

This guide is practical advice from someone who sets these tools up, not legal advice. If you handle health data, children's data or other sensitive information, talk to a lawyer or your data protection officer.

What happens to what you type

When you type into ChatGPT or Claude, the text is sent to the AI company's servers to be answered. Three things decide how safe that is:

1. Is it used for training? On ChatGPT Business, Claude Team and the Enterprise plans, no, not by default. On free and personal plans, it can be, unless you turn it off in the settings.
2. How long is it stored? Chats are kept so you can see them later. Business plans give admins more control over this.
3. Is there an agreement? Under GDPR, when another company handles personal data for you, you need a data processing agreement (DPA). OpenAI and Anthropic offer one for their business plans. Personal accounts don't come with one.

What GDPR means here, in plain words

If you put personal data into an AI tool, like a customer's name, email, phone number or anything that can identify a person, then GDPR applies, just as it does to your email or accounting system. That means:

• You need a good reason to use the data (usually that you're handling the customer's own request).
• You need the data processing agreement mentioned above.
• Your privacy policy should say which services you use to handle data.
• Data sent outside Europe needs a legal basis. The big AI companies use the EU's standard contract clauses and the EU-US data framework for this.

Using the tool for text without personal data, like a product description or a job ad, raises far fewer questions.

Simple rules for your team

These work for most small businesses:

• Use business accounts for work, never personal free accounts.
• Remove what you don't need. "Draft a reply to a customer who wants to move their delivery" works just as well without the customer's name and address.
• No sensitive data without checking first: health, finances of private people, ID numbers, passwords.
• A person checks everything that goes to a customer.
• Switch off training on any personal account that's used for work.

Write these down in a one-page AI policy so everyone knows them.

What about the EU AI Act?

The EU AI Act mostly puts duties on companies that build AI and on high-risk uses, like AI that decides who gets a job or a loan. A small business using ChatGPT to draft emails is in the lowest category. One duty does apply widely: staff who use AI at work should know enough to use it sensibly. A short policy and a bit of training covers that.

Checklist

If you can answer all five, you're in better shape than most.

Questions people ask

Is ChatGPT GDPR compliant?

ChatGPT Business and Enterprise can be used in line with GDPR: they don't train on your data by default and come with a data processing agreement. Free and personal accounts don't have that agreement, so avoid them for personal data.

Does ChatGPT use my data for training?

Not on ChatGPT Business or Enterprise, by default. On free and personal plans it can, unless you switch it off in the settings. Claude works the same way.

Can I put customer names into ChatGPT?

On a business plan with a data processing agreement, when the task needs it, yes. When it doesn't, leave names and contact details out. The answer is usually just as good.

Getting it right from the start

Data protection is one of the first things I go through in the AI workflow audit: which plan, which settings, and what to write in your privacy policy. You leave with the answers, not a list of worries.