# Is it legal to put customer data into ChatGPT, Claude or Copilot? What UK GDPR asks of a small firm first > Yes, on a business plan with five things in place first: a lawful basis, a vendor contract, a transfer route, a privacy notice line and a DPIA where needed. - Page to cite: https://aeolookup.com/ai-for-small-firms/is-it-legal-to-put-customer-data-into-chatgpt-claude-copilot-uk-gdpr/ - Publisher: AEO Lookup (https://aeolookup.com/) - Section: AI for small firms, Data, privacy and the rules - Published 1 October 2026 - Key fact: The ICO's guidance, read on 1 October 2026, says that every time a controller uses a processor there must be a written contract. OpenAI lists a data processing addendum for ChatGPT Business, Enterprise and the API, and Anthropic builds one into its commercial terms; neither page lists one for a personal plan, so customer data typed into a member of staff's own account sits outside any contract the firm holds. - Sources: ICO, "A guide to lawful basis" (updated 2 April 2026), "When is a contract needed and why is it important?", "What needs to be included in the contract?", "A brief guide to international transfers" (15 January 2026), "What privacy information should we provide?", "When do we need to do a DPIA?", "Data minimisation" and "Guidance on AI and data protection" (updated 15 March 2023); OpenAI, "Enterprise privacy" (8 January 2026) and "How your data is used to improve model performance" (13 March 2026); Anthropic privacy centre articles on model training (19 August 2026 and 16 March 2026), the data processing addendum (16 March 2026) and server locations (15 June 2026); Microsoft Learn, "Data, Privacy, and Security for Microsoft Copilot" (18 August 2026); Google Workspace generative AI privacy hub (14 August 2026) and Gemini Apps privacy hub (24 September 2026); all read in a browser on 2026-10-01. Not legal advice. Yes. No UK law bans a firm from putting customer data into an AI assistant, and the ICO's guidance, read on 1 October 2026, treats it like any other use of personal data. Five things have to be in place first, and the one most often missing is the contract: the ICO says "every time a controller uses a processor to process personal data, there must be a written contract", and a personal ChatGPT or Claude account does not give the firm one. ## The five things UK GDPR asks | What | What the ICO's page says | What a small firm does | |---|---|---| | 1. A lawful basis | There are seven lawful bases, and a firm "must apply at least one of these" whenever it handles personal information (guide updated 2 April 2026) | Write down which basis covers the job. A reply to a customer normally rests on the basis the firm already has for dealing with them | | 2. A contract with the vendor | A written contract every time a processor is used, with eight minimum terms, among them acting only on the firm's documented instructions, confidentiality and security | Use a business plan that comes with a data processing agreement | | 3. A lawful route abroad | Sending personal information to a separate organisation outside the UK is a restricted transfer. It must be covered by UK adequacy regulations, appropriate safeguards or an exception (brief guide, 15 January 2026) | Ask the vendor where the data is held and which UK transfer mechanism its agreement uses | | 4. A privacy notice that says so | People must be told who receives their data, which "includes anyone that processes the personal data on your behalf", and about transfers abroad | Add the AI supplier, or the category it falls in, to the notice | | 5. A DPIA where the risk is high | Innovative technology, "including AI", needs a data protection impact assessment (DPIA) when it is combined with another risk criterion | Screen each new use. Keep the note even when the answer is no | The ICO's AI guidance adds one more for health records and other special category data: a firm needs "both a lawful basis and an additional condition for processing". The [guide to AI and patient data](https://aeolookup.com/clinics/ai-patient-data-dental-practice-gdpr-dpia/) shows what that means in a clinic. ## When a DPIA is needed The ICO's two pages pull in slightly different directions. Its AI guidance says the use of AI will "in the vast majority of cases" involve high-risk processing and so call for a DPIA, judged case by case. Its DPIA guidance is narrower: a DPIA is required where AI is combined with one of nine criteria from the European guidelines, among them scoring, sensitive data, data about vulnerable people and large-scale processing. For a small firm that sorts into three cases: - **No personal data in the prompt.** No data protection question arises. - **Routine customer details on a business plan.** Screen it. Where a firm decides a use of AI is not high risk, the ICO says it still has to document how it reached that view. - **Health data, children's data, or a tool that scores or ranks people.** Do the DPIA before the first record goes in. ## What four vendors' own pages say Read in a browser on 1 October 2026. Dates in brackets are each page's own. | Vendor | Business plans: training | Data processing agreement | Where data is held | |---|---|---|---| | OpenAI (ChatGPT) | Business data is not used for training by default (8 January 2026) | A data processing addendum can be signed, through a form, for ChatGPT Business, Enterprise and the API | The page does not say | | Anthropic (Claude) | Inputs and outputs from commercial products are not used by default (19 August 2026) | Built into the commercial terms: accepting the terms accepts it (16 March 2026) | "Data is stored in the US", and traffic may be routed through the US, Europe, Asia and Australia (15 June 2026) | | Microsoft (365 Copilot) | Prompts, responses and data reached through Microsoft Graph are not used to train foundation models (18 August 2026) | Covered by Microsoft's Product Terms and Data Protection Addendum | Customers outside the EU "may have their queries processed in the US, EU, or other regions" | | Google (Gemini in Workspace) | Content is not used for model training outside the firm's domain without permission (14 August 2026) | Prompts are customer data under the Cloud Data Processing Addendum | The page does not say | None of the four pages says in terms that a UK firm's data stays in the UK. Microsoft's points to data residency commitments in its Product Terms, which we did not read. So row 3 is a question to put to the vendor. One exception to the training column: OpenAI and Anthropic both say content a user sends as feedback may be used for training. On Anthropic's page that means the thumbs-up and thumbs-down buttons. Personal plans are a different contract. OpenAI's policy page (13 March 2026) says content on its services for individuals may be used to train its models unless the user opts out. Anthropic's (16 March 2026) says chats on Free, Pro and Max are used if the user chooses to allow it. Google's notice for the consumer Gemini apps (24 September 2026) says human reviewers read a subset of chats and tells users not to enter confidential information. Neither OpenAI's nor Anthropic's page lists a data processing agreement for a personal plan, so customer data typed into a member of staff's own account fails the second of the five. ## Putting it in place this week 1. Pick one tool and buy its business plan. The [four business plans side by side](https://aeolookup.com/ai-for-small-firms/chatgpt-vs-claude-vs-copilot-vs-gemini-small-uk-firm-business-plans-compared/) gives each price. 2. Accept or sign the data processing agreement. File a copy with the date. 3. Ask the vendor in writing where the data is held and which transfer mechanism applies. The ICO gives the International Data Transfer Agreement and the Addendum as examples. 4. Add a line to the privacy notice. There is wording in [do you have to tell customers you used AI](https://aeolookup.com/ai-for-small-firms/do-you-have-to-tell-customers-you-used-ai-uk-rules/). 5. Screen for a DPIA and keep the note. 6. Paste only what the job needs. The data minimisation principle limits personal data to "what is necessary" for the purpose. 7. Write the house rules down in a [one-page AI policy](https://aeolookup.com/ai-for-small-firms/ai-policy-template-small-uk-firm-one-page/). ## Sector rules sit on top A regulated firm has a second set of rules. Tax advisers have guidance of 19 January 2026 asking for client consent, set out in our [guide for accountants](https://aeolookup.com/accountants/can-accountants-use-chatgpt-copilot-claude-client-data/). Solicitors have the [SRA's warning notice](https://aeolookup.com/solicitors/sra-ai-warning-notice-small-law-firm-ai-policy/) of 17 August 2026. ## What is not settled The ICO marks its AI guidance (last updated on 15 March 2023), its DPIA guidance and its contracts guidance as under review after the Data (Use and Access) Act 2025. It has also said it will develop a statutory code of practice on AI and automated decision-making. The pages quoted here are the regulator's current word, and they may change. Overlyft ![](https://aeolookup.com/img/d/ours-badge.png) is an AI agency that sets up AI office assistants for ten trades: they are set up in the firm's own office for a fixed price agreed after an audit, the firm pays Anthropic directly for its own Claude plan, and a person approves anything that goes to a customer. This page is general information, not legal advice. ## Short answers from this page **Is it legal to put customer data into ChatGPT in the UK?** Yes, if the firm has a lawful basis, a written contract with the vendor, a lawful transfer route, a privacy notice line and a DPIA where risk is high. The ICO, read 1 October 2026, says every use of a processor needs a written contract; OpenAI lists a data processing addendum only for ChatGPT Business, Enterprise and the API. --- ![](https://aeolookup.com/img/d/owner-line.png) General information for UK small firms, not legal, tax or financial advice.