Is ChatGPT GDPR Compliant? A Guide for UK Businesses

Short answer: ChatGPT can be used in line with UK GDPR, but only on a business plan and only if your business does its own part. No tool is compliant on its own. UK GDPR applies to your use of it: what personal data goes in, why, under what contract, and where it ends up.

For a UK business of 5 to 250 staff, that comes down to six steps. They apply in much the same way to Microsoft Copilot, Google Gemini and any other AI assistant.

Why the free and Plus plans are the problem

Most of the risk sits with staff using personal ChatGPT accounts for work. Those are consumer products. Your business has no data processing agreement with OpenAI for them, no admin control, and no record of what was entered. On consumer plans OpenAI may also use conversations to improve its models unless the user turns that setting off.

If someone pastes a client email, a CV or a spreadsheet of customer names into a personal account, your business has shared personal data with a third party without a contract covering it. It is a common position, and usually nobody has noticed.

ChatGPT Business, Enterprise and Edu are different. OpenAI says it does not train on data from those plans by default, and they come with admin controls and business terms. That is the starting point for using it lawfully.

Six steps to use ChatGPT in line with UK GDPR

1. Move work use onto a business plan. ChatGPT Business or Enterprise, with accounts managed by the company. Then stop work use of personal accounts, in writing.
2. Put the data processing terms in place. Check which OpenAI entity your contract is with, accept the data processing addendum, and keep a copy. Note where data is processed and which transfer safeguard covers it if it leaves the UK.
3. Add it to your records of processing. List ChatGPT as a processor, the kinds of personal data staff may put into it, and the purpose.
4. Decide whether you need a DPIA. If staff will use it on customer, patient or employee data regularly, or to help make decisions about people, run a data protection impact assessment first. The ICO treats new technology used on personal data as a common trigger.
5. Write a short staff policy. Say what can go into a prompt, what never can, and who to ask. Our free UK AI policy template is a starting point.
6. Update your privacy notice. If customer data goes into an AI tool, tell customers in plain words, in the same notice that covers your other processors.

What should never go into ChatGPT

Even on a business plan, some data should stay out unless you have a specific reason and a DPIA that covers it:

• Health, criminal record and other special category data.
• Bank details, card numbers and passwords.
• Anything a client contract says must stay in your systems.
• Whole exports of customer or staff records, when a summary or anonymised extract would do.

The safest habit is data minimisation, which UK GDPR already requires: give the tool the least personal data it needs for the task. A letter can usually be drafted with "the client" in place of a name, and the name added afterwards.

Where ChatGPT stores your data

OpenAI offers European data residency for ChatGPT Enterprise, Edu and the API, which keeps customer content at rest in Europe. We have not found UK-only storage for ChatGPT in OpenAI's published material. If your contracts or your sector need data held in the UK, check this with OpenAI directly, or consider a private AI platform hosted in a UK region.

Automated decisions about people

UK GDPR has specific rules on decisions made about people by automated means, and the Data (Use and Access) Act 2025 changes some of them. If ChatGPT or any AI tool helps decide who gets a job interview, a loan, a price or a refund, keep a person making the decision and record why. The ICO is updating its guidance on AI and data protection to reflect the Act, so check the current version before you rely on it.

Copilot and Gemini follow the same rules

Microsoft says Microsoft 365 Copilot does not use your prompts or files to train its foundation models, and it is covered by Microsoft's data protection addendum. That helps, but the six steps above still apply. Copilot also brings a risk of its own: it can surface any file a user has permission to open, so loose SharePoint sharing becomes a data protection problem. Our Copilot vs ChatGPT guide covers that in more detail.

Questions UK businesses ask

Is ChatGPT GDPR compliant?

ChatGPT can be used in line with UK GDPR on a business plan, with a data processing agreement, an entry in your records of processing, a staff policy and, where needed, a DPIA. Using personal accounts for work data is where most firms fall short.

Can employees put customer data into ChatGPT?

Only on a company-managed business plan, only the data the task needs, and only for a purpose your privacy notice covers. Special category data should stay out unless a DPIA says otherwise.

Does OpenAI train on our business data?

OpenAI says it does not train on data from ChatGPT Business, Enterprise or Edu by default. On the free and Plus plans, conversations may be used for training unless the user turns it off.

Do we need a DPIA to use ChatGPT?

Not for every use. You should run one if staff will use it on personal data regularly, on special category data, or to help make decisions about people. If in doubt, a short DPIA is quicker than explaining later why you didn't do one.

Is it safer to build our own AI system?

Sometimes. A private deployment in a UK cloud region keeps data under your control and logs every request, which suits regulated firms and sensitive data. For most everyday writing tasks, a business plan with a clear policy is enough. Our AI governance work starts by finding out which of your uses fall into which group.