Is it safe to put customer data into ChatGPT?

The short answer

It depends on two things: the account and the text. The same ChatGPT window behaves differently on a personal Plus account and in a ChatGPT Business workspace. And a draft that says "a customer wants to move her appointment" carries none of the risk of one that says "Sarah Jones, 14 Mill Lane, wants to move her root canal".

So the rule for a small team is short. Use a business account for work. Strip identifying details by default. Keep a short list of things that never go in, whatever the account. The rest of this guide explains why, plan by plan.

Plans and settings change. Everything below comes from the vendors' own help pages as of October 2026. This is general information, not legal advice.

The account matters more than the tool

Each of the big three assistants comes in a personal version and a work version, on different terms:

• ChatGPT: personal plans (Free, Go, Plus and Pro) against workspaces (Business, Enterprise, Edu and the healthcare versions).
• Gemini: a personal Google account against a Google Workspace account that your business manages.
• Copilot: the consumer app signed in with a personal Microsoft account against Copilot signed in with a work account.

The work versions come with a business agreement under which the provider handles your data for you, and by default they do not use your content to improve their products. The personal versions run under consumer terms that the individual accepted, not your business. A member of staff using their own ChatGPT account on a work laptop is on a personal account, whatever the laptop.

On a personal plan, assume anything you paste is kept, and may be used to improve the product unless someone has changed the settings.

What ChatGPT does with what you type

On personal plans:

• A setting called "Improve the model for everyone" is on by default for Free, Plus and Pro. You can turn it off under Settings, then Data controls, and new conversations are then not used to improve the models. It does not change chats you have already had.
• Rating a reply with a thumbs up or down can still send that whole conversation for use in improving the models, even with the setting off.
• Chats stay in your history until you delete them. Deleted chats are scheduled for permanent deletion within 30 days, unless the company must keep them longer for security or legal reasons.
• Temporary chats do not appear in your history, do not update memory and are not used to improve the models, but a copy may be kept for up to 30 days for safety.
• Memory can carry details from one chat into later ones. Turn it off for work, or keep customer details out.

On ChatGPT Business, Enterprise and Edu, content is not used to improve the models by default. Workspace admins control how long data is kept, and on Business they can view, export and delete members' conversations. A data processing agreement is available for Business and Enterprise. Business is sold to teams of two users or more.

Gemini and Copilot, briefly

Google says plainly that human reviewers read some conversations on personal Gemini accounts, and asks people not to enter confidential information they would not want a reviewer to see. With the setting called Keep Activity on, chats are saved, auto-deleted after 18 months by default, and used to improve Google's services, including its AI. With it off, chats are still kept for 72 hours. Chats that reviewers have looked at are kept for up to three years.

With a Google Workspace account, Google says chats in the Gemini app are not reviewed by humans and are not used to improve its AI outside your organisation without permission. They fall under your Workspace agreement and its data processing terms.

Microsoft says Copilot and Copilot Chat used with a work account come with its enterprise data protection: they are covered by its business data protection terms, with Microsoft as your processor, and prompts and responses are not used to train its foundation models. The personal Copilot app runs under Microsoft's consumer terms and settings.

ChatGPT Business or Plus for a small team

This is the choice most small businesses face, so here it is side by side:

• Who it is for. Plus is a personal subscription. Business is a shared workspace for a team, from two users.
• Use of your content. On Plus it helps improve the models unless each person turns that off. On Business it does not, by default.
• Contract. Plus runs on consumer terms. Business offers a data processing agreement, which the GDPR expects when a provider handles personal data for you.
• Control. On Plus, each person controls their own account. On Business, admins manage who is in the workspace, how long data is kept and access to conversations.
• Health information. Neither comes with a HIPAA business associate agreement. That needs Enterprise, Edu or one of the healthcare versions.

Our view: if anyone on the team will paste anything about a customer, the decision is made, and it is Business or the work plan from Google or Microsoft that you already use for email. Plus is fine for an owner working alone, on text that names nobody, with the improvement setting turned off.

What staff can paste, and what they cannot

A three-colour list is easy to remember and fits on one page:

• Green, any approved work account: your own published information such as services and prices, text with every identifying detail removed, internal how-to questions, and drafts with placeholders like [Customer] and [Date].
• Amber, business account only, and only when the task needs it: customer names and contact details, order and booking details, the text of a complaint, a supplier's quote.
• Red, never, in any account, unless you have set up a specific tool and agreement for it: health information, card or bank details, passwords and access codes, passport, national ID or Social Security numbers, information about children, HR and disciplinary records, legal case details and anything a client gave you in confidence.

If a task needs red information, it needs a tool built for that job, with the right agreement, access rules and someone checking the results, not a general chat window. Our AI assistants are built that way: agreed access, rules on data, and a person checking anything that matters before it is saved or sent.

How to strip a message before pasting it

Most drafting jobs do not need the customer's identity at all. Before you paste, take out:

• Names, replaced with roles: [Customer], [Partner], [Child].
• Email addresses, phone numbers and street addresses.
• Order, invoice, account and case numbers.
• Exact dates of birth and appointment dates, unless the date is the point.
• Rare details that identify someone on their own, such as an unusual job in a small town or a named employer.

An accountant's example. Instead of pasting the client's email, paste this: "[Client], a sole trader, missed the filing deadline because of illness and asks whether we can help with the penalty. Draft a kind reply asking for the penalty notice and saying a partner will call this week." The draft comes out just as good, and nothing in it identifies anyone.

Swapping a name for initials is not enough. Under the GDPR, information that can still be linked to a person with other details is personal data. If the rest of the message points to one customer, treat it as amber.

The GDPR line

When staff paste customer details into an AI tool for work, your business decides what happens to that data and the tool's provider handles it for you. In GDPR terms you are the controller and the provider is your processor. The GDPR expects three things:

• A contract that makes the provider your processor, under Article 28. Business plans offer one. Personal accounts do not: the provider handles that text under its own consumer terms, which is hard to square with the reasons you gave customers for collecting their details.
• A purpose that fits what you told customers. Drafting a reply to their own enquiry is close to it. Using their details to try out a new tool is not.
• No more than the task needs. That is data minimisation, and stripping details before you paste is the easy way to meet it.

Two more points. Health data and the other special categories need a specific legal basis under Article 9, so keep them out of general AI tools. And your privacy notice should mention the kinds of tools that process customer data for you, which our guide to what a privacy policy needs covers.

The HIPAA line

If HIPAA covers your practice, protected health information may go only into a product covered by a business associate agreement with its provider. As of October 2026:

• ChatGPT: no BAA on personal plans or Business. BAAs are available for sales-managed Enterprise and Edu accounts, ChatGPT for Healthcare, and ChatGPT for Clinicians, an individual version for verified US physicians, nurse practitioners, physician assistants and pharmacists.
• Gemini: covered by Google's Workspace BAA once your administrator has accepted it, apart from Gemini in Chrome.
• Copilot: covered for work accounts under Microsoft's BAA when properly configured, apart from the web searches it runs.

Even with a BAA, send only the minimum the task needs. Most drafting jobs need none: "a patient asks how to prepare for a first physiotherapy appointment" names nobody. HIPAA and AI chatbots covers the patient-facing side.

Client confidentiality in professional firms

Lawyers, accountants and financial advisers usually owe confidentiality to clients under their own professional rules, on top of data protection law. Those rules do not change because the tool is new.

For US law firms, the ABA's Formal Opinion 512 applies the duty of confidentiality to generative AI tools directly, and a firm should read it before client files go near a chat window: see law firm chatbots and ABA Opinion 512. Other professions have their own bodies and rules, so check yours before you set the green, amber and red lists.

If someone has already pasted something

It happens. Act the same day:

• Delete the conversation, and check memory and any project or custom assistant it was saved to. ChatGPT schedules deleted chats for permanent deletion within 30 days, unless the company must keep them for legal or security reasons. Other tools have their own periods.
• Write down what was pasted, when, by whom and into which account.
• If it was personal data, decide with whoever handles data protection whether it is a personal data breach. Under the GDPR, a breach must be reported to the regulator within 72 hours where feasible, unless it is unlikely to put people at risk.
• If it was protected health information in a tool without a BAA, the HIPAA rules presume a breach unless you can show a low probability that it was compromised. Get advice quickly.
• Fix the cause: the account, the habit or the missing rule.

No blame for the person who tells you. A team that hides mistakes is a bigger risk than one bad paste.

A safe setup for a team of 5 to 20

• Pick one work plan for everyone who uses AI for work: ChatGPT Business, Gemini in Google Workspace or Copilot with your Microsoft 365 work accounts.
• Ask staff to stop using personal accounts for work, and explain why.
• Check the workspace settings: retention, who can see what, and which apps and connectors are allowed.
• Keep connectors to email and files off until you have decided what the tool may read.
• Write the green, amber and red list on one page and brief everyone. An AI policy for staff has the page.
• Look at the list again whenever a vendor changes its plans.

If your team keeps pasting the same documents into chat tools, such as procedures, price lists or policies, an AI assistant for your documents answers from those files with agreed access and shows the source of each answer.