- Home
- AI consultancy
- ChatGPT and GDPR
Is ChatGPT GDPR compliant?
A plain-English guide for UK businesses: how the different versions of ChatGPT handle your data, what UK GDPR asks of you, and when private AI is the better choice.
The short answer
ChatGPT isn’t compliant or non-compliant on its own. UK GDPR applies to how your business uses it. A business plan with the right settings can be part of a compliant setup. Staff pasting client details into free personal accounts usually can’t.
The version matters most. On the free and Plus plans, conversations can be used to train OpenAI’s models unless you switch that off. On Business, Enterprise and the API, OpenAI says it doesn’t train on your data by default and offers a data processing agreement.
This guide explains how the tools work so you can make an informed choice. It isn’t legal advice.
How the versions differ
Based on OpenAI’s published terms. They change, so check the current versions: OpenAI business data and privacy and ChatGPT data controls.
| Version | What to know |
|---|---|
| Free, Plus and Pro | Personal plans. Conversations can be used to train OpenAI’s models unless the user turns off “Improve the model for everyone” in Settings, Data Controls. There’s no data processing agreement, and your business doesn’t control the account. |
| Business | OpenAI says it doesn’t train on Business data by default, and a data processing agreement is available. The workspace is managed by your business. It isn’t included in OpenAI’s data residency option. |
| Enterprise and Edu | The same no-training default, with more admin and security controls. Data can be stored at rest in the UK, but processing can still happen outside the UK. |
| API | OpenAI says API data isn’t used for training unless you opt in. UK data storage is available, with processing outside the UK. Used when building your own tools. |
What UK GDPR asks of you
The ICO’s guidance on AI and data protection sets out how the usual rules apply to AI. For a typical small business using ChatGPT with personal data, that means:
- A lawful basisKnow why you’re allowed to use personal data this way, as you would for any other system.
- TransparencyYour privacy notice should say you use AI tools and what for.
- A DPIA where the risk is highThe ICO explains when you need a data protection impact assessment.
- Less data, not moreOnly put in what the task needs. Names and account numbers often aren’t.
- International transfersIf data is processed outside the UK, the transfer rules apply.
- People stay in charge of decisionsDecisions with legal or similar effects on people need meaningful human involvement. The ICO is updating its guidance on automated decision-making after the Data (Use and Access) Act 2025.
Is ChatGPT safe for confidential information?
On personal plans, treat anything you type as something a third party will hold. On a business plan with sensible settings, the risk is much lower, and for most everyday work it’s a reasonable choice.
Some information needs more care: legally privileged material, health records, client money, unreleased designs. For that kind of work, many firms decide the data shouldn’t leave their control at all.
Practical steps for a small business
Most of these take an afternoon, and they cut the biggest risks straight away.
- Move staff onto business accountsStop work happening in personal Free and Plus accounts you can’t see or control.
- Write a short AI policyWhat tools people can use, and what must never go into them.
- Update your privacy noticeSay that you use AI tools and what for.
- Check whether you need a DPIAEspecially for customer data, staff data or anything sensitive.
- Train your teamA short session on safe use stops most problems before they start.
When private AI makes sense
If your work involves information that shouldn’t leave your business, a private AI assistant gives your team the same kind of tool without sending data to an outside provider. It runs on your own hardware, in your own cloud or on infrastructure we run for you.
ChatGPT and GDPR questions
Is ChatGPT Business GDPR compliant?
It can be used in a way that meets UK GDPR. OpenAI says it doesn’t train on Business data by default and offers a data processing agreement. You still need a lawful basis, a privacy notice that covers it, and a data protection impact assessment where the risk is high. ChatGPT Business isn’t covered by OpenAI’s UK data residency option.
Is ChatGPT Enterprise GDPR compliant?
Enterprise has the strongest controls of OpenAI’s ChatGPT plans, including admin tools and the option to store data at rest in the UK. Processing can still happen outside the UK, so treat it as an international transfer and check OpenAI’s current terms. As with any plan, compliance depends on how you use it.
Is the ChatGPT API GDPR compliant?
OpenAI says API data isn’t used for training unless you opt in, and the API offers UK data storage. It’s a common choice for building your own tools, with the same responsibilities on you as any other supplier that handles personal data.
Is ChatGPT safe for confidential information?
On the free and Plus plans, not for anything you’d mind a third party holding: conversations can be used for training unless you switch it off. On a business plan with the right settings it’s much safer, but for privileged, regulated or highly sensitive information many firms prefer private AI, where the data never leaves their control.
Not sure where your business stands?
Tell us which AI tools your team uses and what kind of data they handle. We’ll tell you plainly what we’d change. We reply within one working day.