# Can this go into ChatGPT, Claude or Copilot? Five questions on customer data for a UK firm > Five questions on what the data is, whose account it is and what paperwork is in place, leading to one of seven outcomes with the ICO rule behind each. - Page to cite: https://aeolookup.com/ai-for-small-firms/can-customer-data-go-into-ai-assistant-five-questions-uk/ - Publisher: AEO Lookup (https://aeolookup.com/) - Section: AI for small firms, Data, privacy and the rules - Published 1 October 2026 - Key fact: We wrote this questionnaire of 5 questions and 7 outcomes from the rules set out in 4 of our guides and the sources each outcome names. Three of the seven outcomes stop before any paperwork question is asked: no personal data in the prompt, a personal account, and not knowing which plan the account is on. Only a business plan reaches the questions about the vendor contract and the privacy notice. - Sources: ICO, Guidance on AI and data protection, and Data minimisation, read 1 October 2026; ICO, When is a contract needed and why is it important?; OpenAI and Anthropic data pages; read 1 October 2026; OpenAI, Enterprise privacy (8 January 2026); Anthropic privacy centre (19 August 2026); read 1 October 2026; ICO, When do we need to do a DPIA?, and Guidance on AI and data protection, read 1 October 2026; ICO, When is a contract needed and why is it important?, and What needs to be included in the contract?, read 1 October 2026; ICO, What privacy information should we provide?, read 1 October 2026; ICO, A guide to lawful basis (2 April 2026), and A brief guide to international transfers (15 January 2026), read 1 October 2026; each outcome names its source, and the linked guide shows the working. Someone in the office has a customer email, a spreadsheet or a set of notes and wants an AI assistant to deal with it. Whether that is allowed depends on three things: what is in it, whose account it goes into and what the firm has already put in place. This questionnaire asks about each in turn and gives the one outcome that fits, with the rule behind it. It follows the ICO's guidance and the four vendors' own data pages as we read them on 1 October 2026. It takes about a minute, and nothing you choose leaves the page. **Free tool on the page:** Customer data and AI assistants: which rule applies. It runs in the browser at https://aeolookup.com/ai-for-small-firms/can-customer-data-go-into-ai-assistant-five-questions-uk/#tool and asks for no sign-up. ## The questions, and why each is asked **1. Does what you want to paste in include details about a living person?** UK GDPR applies to personal data: names, addresses, account numbers, or anything else that identifies someone. A prompt with none of that in it raises no data protection question. **2. Whose account would the data go into?** The ICO's guidance says a firm needs a written contract every time it uses a processor. OpenAI and Anthropic list a data processing agreement for their business plans and not for their personal ones. This question appears only when an earlier answer makes it relevant. **3. Is any of it health data, data about children, or used to score or rank people?** The ICO asks for a data protection impact assessment where AI is combined with another risk factor, such as sensitive data, vulnerable people or scoring. Health data also needs an additional condition for processing. This question appears only when an earlier answer makes it relevant. **4. Has the firm accepted or signed the vendor's data processing agreement?** A business plan makes the agreement available; the firm still has to accept or sign it. OpenAI's is signed through a form, and Anthropic's is built into its commercial terms. This question appears only when an earlier answer makes it relevant. **5. Does your privacy notice say that an AI supplier receives customer data?** People must be told who receives their data, and that includes anyone who processes it on the firm's behalf. The notice can name the supplier or the category it falls in. This question appears only when an earlier answer makes it relevant. ## Every outcome, and the rule behind it ### No data protection question arises Reached when: "Does what you want to paste in include details about a living person?" answered "No, nothing that identifies a person". UK GDPR applies to personal data. If the prompt holds nothing that identifies a living person, the data protection rules do not come into it. The firm's own confidentiality duties still apply to anything commercially sensitive, and the plan's terms on training still decide whether the text can be used to improve the vendor's models. - Take names, addresses and account numbers out before pasting, where the job can be done without them. - Check the answer before it is used: the vendors' own terms say output can be wrong. Source: ICO, Guidance on AI and data protection, and Data minimisation, read 1 October 2026. The working is in [Is it legal to put customer data into ChatGPT, Claude or Copilot? What UK GDPR asks of a small firm first](https://aeolookup.com/ai-for-small-firms/is-it-legal-to-put-customer-data-into-chatgpt-claude-copilot-uk-gdpr/). ### Not in a personal account Reached when: "Whose account would the data go into?" answered "A member of staff's own free or paid account". Customer data typed into a member of staff's own account sits outside any contract the firm holds, so it fails the second of the five things UK GDPR asks. OpenAI's policy page says content on its plans for individuals may be used to train its models unless the user opts out, and Anthropic's says chats on Free, Pro and Max are used if the user allows it. - Do the job without the personal details, or wait for a business plan. - Pick one tool and buy its business plan; the linked guide prices four of them for five seats. Source: ICO, When is a contract needed and why is it important?; OpenAI and Anthropic data pages; read 1 October 2026. The working is in [ChatGPT vs Claude vs Microsoft 365 Copilot vs Gemini for a small UK firm](https://aeolookup.com/ai-for-small-firms/chatgpt-vs-claude-vs-copilot-vs-gemini-small-uk-firm-business-plans-compared/). ### Find out which plan it is before anything goes in Reached when: "Whose account would the data go into?" answered "Not sure which kind of plan it is". The answer turns on the plan. A business plan comes with a data processing agreement and is not used for training by default; a personal plan has neither protection as standard. If nobody in the office can say which one the account is on, treat it as personal until the billing page or the admin console shows otherwise. - Open the account's billing or plan page and note the plan name. - Write the plan and the rule for customer data into a one-page AI policy. Source: OpenAI, Enterprise privacy (8 January 2026); Anthropic privacy centre (19 August 2026); read 1 October 2026. The working is in [AI policy for a small UK firm](https://aeolookup.com/ai-for-small-firms/ai-policy-template-small-uk-firm-one-page/). ### Do a data protection impact assessment first Reached when: "Is any of it health data, data about children, or used to score or rank people?" answered "Yes". Health data, children's data and tools that score or rank people are the cases where the ICO's guidance calls for a data protection impact assessment before the first record goes in. For health records and other special category data the firm also needs an additional condition for processing on top of its lawful basis. A business plan alone does not settle either point. - Complete the assessment before any record goes in, and keep it. - Write down the lawful basis and, for special category data, the additional condition. - A regulated firm should check its own regulator's guidance as well. Source: ICO, When do we need to do a DPIA?, and Guidance on AI and data protection, read 1 October 2026. The working is in [Is it legal to put customer data into ChatGPT, Claude or Copilot? What UK GDPR asks of a small firm first](https://aeolookup.com/ai-for-small-firms/is-it-legal-to-put-customer-data-into-chatgpt-claude-copilot-uk-gdpr/). ### Accept or sign the data processing agreement first Reached when: "Has the firm accepted or signed the vendor's data processing agreement?" answered "No, or nobody knows". The ICO's guidance says there must be a written contract every time a firm uses a processor, with terms that include acting only on the firm's documented instructions, confidentiality and security. A business plan makes that agreement available, but the firm still has to accept or sign it. Until it has, the plan does not give the firm the contract the rule asks for. - Find the vendor's data processing agreement, accept or sign it, and file a copy with the date. - Ask the vendor in writing where the data is held and which UK transfer mechanism applies. Source: ICO, When is a contract needed and why is it important?, and What needs to be included in the contract?, read 1 October 2026. The working is in [Is it legal to put customer data into ChatGPT, Claude or Copilot? What UK GDPR asks of a small firm first](https://aeolookup.com/ai-for-small-firms/is-it-legal-to-put-customer-data-into-chatgpt-claude-copilot-uk-gdpr/). ### Add a line to the privacy notice, then go ahead Reached when: "Does your privacy notice say that an AI supplier receives customer data?" answered "No, or not checked". The contract is in place, so one piece is missing. People must be told who receives their data, and the ICO's guidance says that includes anyone who processes it on the firm's behalf, along with any transfer abroad. The privacy notice can name the AI supplier or describe the category it falls in. The linked guide has wording to adapt. - Add the AI supplier, or its category, to the recipients section of the privacy notice. - Say in the notice if the data may be processed outside the UK. Source: ICO, What privacy information should we provide?, read 1 October 2026. The working is in [Do you have to tell customers you used AI? What UK rules say about emails, chatbots, adverts and automated decisions](https://aeolookup.com/ai-for-small-firms/do-you-have-to-tell-customers-you-used-ai-uk-rules/). ### The main pieces are in place Reached when: any other set of answers. A business plan, an accepted data processing agreement and a privacy notice that names the supplier cover three of the five things UK GDPR asks. The other two are the lawful basis, which for a reply to a customer is normally the one the firm already has for dealing with them, and a lawful route for any transfer abroad, which is a question to put to the vendor. - Paste only what the job needs. - Keep a short note that this use was screened for a data protection impact assessment. - Have a person read the result before it goes to the customer. Source: ICO, A guide to lawful basis (2 April 2026), and A brief guide to international transfers (15 January 2026), read 1 October 2026. The working is in [Is it legal to put customer data into ChatGPT, Claude or Copilot? What UK GDPR asks of a small firm first](https://aeolookup.com/ai-for-small-firms/is-it-legal-to-put-customer-data-into-chatgpt-claude-copilot-uk-gdpr/). ## How to use the result Use it at the point of doing the job, with the real document in front of you. If the outcome is a stop, the list under it is the shortest way to a yes: most firms need to do each item once, not every time. Write the result into the firm's AI policy so the next person does not have to ask. Run it again when the firm changes plan or supplier, or starts using the assistant for a new kind of data. The outcome applies the rule to the answers given; it cannot see the facts behind them. Where an answer is a judgement, or the facts are unusual, the outcome may not fit. This page is general information, not legal advice. Overlyft ![](https://aeolookup.com/img/d/ours-badge.png) is an AI agency that sets up AI office assistants for small firms in ten trades: the work is priced after a fixed-price audit, the firm pays Anthropic directly for its own Claude plan, and a person approves anything that goes to a customer. --- ![](https://aeolookup.com/img/d/owner-line.png) General information for UK small firms, not legal, tax or financial advice.