Is It Safe to Put Customer Data Into ChatGPT? A Practical Guide for Small Businesses

On this page 12

1. A four-step framework that works for any AI assistant
2. What counts as customer data, and why the type matters
3. What can happen to what you type into ChatGPT
4. Consumer plans vs business plans: what is different in principle
5. What to check in the data terms before you paste anything
6. Your responsibilities as the business holding the data
7. How to anonymise customer data before using ChatGPT
8. Settings to review on any plan
9. When not to use ChatGPT at all
10. A one-page AI data policy for your team
11. If someone already pasted sensitive customer data
12. The same questions apply to other AI tools

The short answer

It depends on four things: what the data is, which ChatGPT plan you use, how that account is configured, and what you have promised customers and are required to do by law.

• Generic questions and properly anonymised text are generally fine on most plans once you have checked the settings.
• Identifiable personal data, such as names, emails and order histories, needs a business-grade plan with a data processing agreement, plus data minimisation.
• Sensitive data (health details, bank or card details, ID numbers, passwords) usually should not go in at all unless your contract and compliance setup explicitly cover it.
• Default rule: if you wouldn't email it to an outside contractor without an NDA and a contract, don't paste it into a chatbot.

A four-step framework that works for any AI assistant

The rest of this guide walks through a four-step framework that works for any AI assistant, not just ChatGPT:

1. Classify the data (green, amber or red).
2. Check the plan and its terms using the vendor's own pages.
3. Minimise and anonymise before you paste.
4. Know the hard 'no' cases where AI shouldn't be used at all.

What counts as customer data, and why the type matters

Most of the risk decision follows from one question: what exactly are you about to paste?

Personal data is anything that identifies a living person, either directly or indirectly.

• Direct identifiers: name, email address, phone number, home address, account username.
• Indirect identifiers: details that identify someone when combined or in context. An order number plus a postcode. A unique job title at a named company ('the head of finance at a 12-person bakery in Bath'). A rare event ('the customer whose wedding cake collapsed last Saturday').

Special category data is the GDPR term for the most sensitive types: health, racial or ethnic origin, religious or philosophical beliefs, political opinions, trade union membership, genetic and biometric data, sex life and sexual orientation. It has extra legal protection under Article 9 of the GDPR.

Other high-risk data isn't special category under GDPR but can cause real harm if exposed: payment card numbers, bank details, government ID numbers (passport, National Insurance, Social Security), login credentials and API keys, and data about children.

Confidential business data matters too, even when no individual is named. Client contracts, pricing agreements, unreleased product plans and anything covered by an NDA can all be restricted by contract.

Traffic-light classification

What can happen to what you type into ChatGPT

The risks are real but specific. It helps to know the actual mechanisms rather than a vague sense that 'AI keeps everything'.

• Model training. On some plans, conversations may be used to improve OpenAI's models unless you opt out. Whether this applies, and whether it is on or off by default, depends on the plan and your settings. Check OpenAI's privacy policy and your own data controls rather than assuming.
• Retention. Chats, uploaded files and even deleted conversations may be kept for a period for safety, abuse monitoring or legal reasons. Retention can also be extended by legal obligations, such as court orders. The current periods are set out in OpenAI's privacy policy and Help Center, and they can change.
• Human review. Providers may have people review some content, for example to investigate abuse. The terms for your plan describe when this can happen.
• Account-level exposure. Data can travel beyond the original chat. A shared link can typically be opened by anyone who has the URL. Memory can carry details into future conversations. Custom GPTs, connectors to email or cloud drives, and shared team workspaces can all widen who or what can see the content.
• Your own security. Weak passwords, shared logins, no two-factor authentication and ex-staff who still have access are often a bigger practical risk than anything the vendor does.

Consumer plans vs business plans: what is different in principle

This is the most important structural difference, and it is easy to get wrong.

Which plans fall under consumer or business terms

Consumer plans (at the time of writing: Free, Plus and Pro) are personal accounts governed by OpenAI's consumer terms. Business offerings (at the time of writing: Team/Business, Enterprise, Edu and the API platform) are typically governed by business terms. Plan names and lineups change, so check OpenAI's current pricing page before relying on these labels.

At the time of writing (last checked November 2026), OpenAI states on its business data privacy page that it does not train its models on business customers' data by default. Treat that as OpenAI's published commitment for the products that page lists, not as a guarantee for every plan, and check the current page yourself.

What business plans typically add

Subject to checking each plan, business plans typically add:

• A data processing addendum (DPA), the contract you usually need under GDPR when a provider processes personal data for you.
• Admin controls: managing users, removing leavers, restricting features.
• Single sign-on (SSO) on some tiers.
• The ability to manage or delete user data centrally.
• Security documentation, such as SOC 2 reports, through the OpenAI Trust Portal.

What to compare between plans, and where to check

If you are still picking a tool, make data terms one of your selection criteria. Our guide to choosing an AI writing assistant for your business covers the other criteria.

What to check in the data terms before you paste anything

Use this checklist for ChatGPT or any other AI tool. Answer each question from the vendor's own pages, not from blog posts or forum threads (including this one).

1. Training: Is my content used to train models on this plan? Is that on or off by default? Where is the setting?
2. Retention: How long are chats, uploaded files and deleted chats kept? Are there exceptions, such as legal holds or safety reviews?
3. DPA: Is a data processing agreement available, and does it cover my specific plan?
4. Sub-processors: Which other companies process the data on the vendor's behalf? Is the list published?
5. Location: Where is data stored and processed? Are data residency options available, and on which plans?
6. Certifications: What security reports or certifications are published, and where (for example, a trust portal)?
7. Admin controls: Can I manage users, see audit logs, and disable features such as connectors, memory or shared links?
8. Deletion: How do I delete data or a whole account? What happens to backups?
9. Regulated sectors: Is a HIPAA business associate agreement (BAA), or your sector's equivalent, offered, and on which products only?

Your responsibilities as the business holding the data

It's natural to ask 'is OpenAI safe?'. The more useful question is 'am I allowed to do this?', because the legal responsibility usually sits with you.

• Controller and processor. Under GDPR and UK GDPR, your business is usually the controller: you decide why and how customer data is used. An AI provider you use on your behalf is usually a processor. Article 28 of the GDPR requires a written contract with processors, which is what a DPA provides. You also need a lawful basis for the processing and must be transparent with customers.
• Your privacy notice. Does it say you share personal data with cloud or AI service providers? If not, update it before using real customer data.
• Client contracts and NDAs. Some clients explicitly forbid sending their data to third-party AI tools. Check before you paste, especially for B2B work.
• Other regimes. Depending on where you and your customers are: US state privacy laws such as the CCPA/CPRA in California, HIPAA for US healthcare data, and PCI DSS for payment card data. Check which apply to you.
• International transfers. Data may be processed outside your country. The DPA should state the transfer mechanism used, such as standard contractual clauses or the UK equivalent.

Where to find authoritative guidance

For authoritative detail, the UK ICO publishes guidance on AI and data protection, and the full GDPR text is on EUR-Lex. For anything amber or red, talk to your data protection officer or a lawyer.

How to anonymise customer data before using ChatGPT

You can do this today with nothing more than a text editor. For a short email it takes a few minutes.

Step 1: Ask whether the AI needs the personal detail at all

Usually it doesn't. To rewrite a reply, summarise a complaint or suggest a fix, the AI needs the situation, not the identity. Start by removing anything the task doesn't depend on.

Step 2: Replace identifiers with placeholders

Use clear, consistent placeholders:

• [CUSTOMER_NAME]
• [ORDER_ID]
• [CITY]
• [EMAIL], [PHONE], [PRODUCT]

Keep the mapping (which placeholder means which real value) only on your own system. When the AI returns a draft, swap the real values back in yourself.

Step 3: Generalise rather than delete when context matters

• Exact age (47) becomes an age range (45 to 54).
• Full address becomes a region ('North of England').
• Exact amount (£1,284.50) becomes a range ('just over £1,000').
• Exact date becomes a period ('last week').

Step 4: Remove indirect identifiers

Rare job titles, unusual events, long customer histories and combinations of details can identify someone even without a name. 'A six-year customer in a small village who runs the only vet practice' is not anonymous.

Step 5: For spreadsheets, cut columns before upload

Delete or mask identifier columns (name, email, phone, address, customer ID) before uploading. Then upload only the columns the task needs. If you need to analyse refund patterns, you probably need product, date range and refund reason, not who asked.

If you need to tell rows apart, you can replace a customer ID with a random code or a hashed value. That still counts as pseudonymisation (see below), not anonymisation.

Pseudonymised is not the same as anonymised

This distinction matters legally:

• Pseudonymised data has identifiers replaced, but can be re-identified using extra information you hold (like your placeholder mapping). Under GDPR it is still personal data.
• Anonymised data cannot reasonably be linked back to a person by anyone. It falls outside GDPR.

Worked example: a customer complaint email

Before (do not paste this):

Hi, this is Sarah Thompson (sarah.t@example.com). Order #48213 for the cooling travel case arrived at my flat in Leeds four days late. I'm type 1 diabetic and needed it to keep my insulin cold on a trip, so I had to buy another one at the airport for £39. I've been a customer for six years and this isn't good enough. Sarah, 07700 900123

This contains a name, email, phone number, order number, city, a purchase amount, a customer history and a health detail (special category data).

After (minimised and placeholdered):

Hi, this is [CUSTOMER_NAME]. Order [ORDER_ID] for [PRODUCT] arrived at my home in [CITY] four days late. I needed it for a time-sensitive personal reason during a trip, so I had to buy a replacement elsewhere for about £40. I'm a long-standing customer and this isn't good enough.

What changed:

• The email and phone number are gone because the reply doesn't need them.
• The name, order number, product and city are placeholders you fill back in later.
• The diabetes and insulin detail is generalised to 'time-sensitive personal reason'. The AI can still write an empathetic reply without knowing the medical condition.
• The exact amount becomes 'about £40' and the six-year history becomes 'long-standing'.

Sample prompt for the cleaned email

You are helping a small online shop reply to a customer complaint. Draft a short, warm, professional reply to the email below. Apologise for the late delivery, acknowledge that it caused real inconvenience, and offer to refund the replacement cost on receipt. Keep the placeholders in square brackets exactly as written. Do not invent details.

[paste the cleaned email]

You then add the real name and order number before sending. If the reply should acknowledge the medical reason, you write that line yourself.

For more on structuring prompts like this, see our guide to writing AI prompts for business emails.

Know the limits

Find-and-replace misses things: a name in a signature, a nickname, an email address inside a forwarded thread. Re-read the whole text before pasting.

Free-text fields such as 'notes' or 'comments' in spreadsheets and CRMs are where personal data most often hides.

Settings to review on any plan

Menu labels and locations change, so treat this as a list of things to find, not a set of exact clicks. OpenAI's Help Center has the current instructions.

• Data controls and model training. Find the setting that governs whether your content may be used to improve models, and confirm its current state yourself.
• Temporary or incognito-style chats. These typically keep a chat out of your history. They may still be retained for a period, for example for safety review, so check the Help Center for what they do and don't change.
• Memory and custom instructions. Review what is stored about you and, more importantly, about your customers. Delete anything that shouldn't be there.
• Shared links. Audit old shared conversations and delete any that contain client work.
• Connectors and integrations. If email, drive or calendar connectors are enabled, only keep what you actually need.
• Account security. Turn on two-factor authentication. Don't share logins. Remove access the day someone leaves.

When not to use ChatGPT at all

Some cases are a clear no, whatever the plan.

Never paste

• Passwords, API keys or other login credentials
• Payment card numbers (PCI DSS rules apply to card data)
• Bank login details or full bank account details
• Full government ID numbers: passport, driving licence, National Insurance, Social Security

Don't use AI for this, unless explicitly covered

• Health, legal-case, children's or other special category data, unless you have a business agreement, a legal basis and sector compliance that explicitly cover it.
• Data a client contract or NDA forbids you to share with third parties.
• Data collected under a privacy notice that doesn't allow this use.
• High-stakes decisions about individuals, such as credit, hiring or eligibility. Accuracy, fairness and legal duties around automated decision-making (including Article 22 of the GDPR) apply.
• Tasks where anonymising would remove the very information the task needs. That's a sign the work should stay in-house or move to a properly contracted system.
• Any situation where you can't verify the plan's terms, such as staff using personal accounts. This is often called 'shadow AI', and it is a common blind spot because the business has no control over those accounts' settings or terms.

A one-page AI data policy for your team

Copy this, replace the bracketed parts, and keep it to one page. If you want a fuller version with an approved-tools register and a rollout plan, use our AI acceptable use policy template for small businesses.

Policy template, part 1: approved tools and what you can paste

[Business name] AI Data Policy Owner: [name]. Last reviewed: [date]. Next review: [date].

1. Approved tools

• Approved for customer data: [tool and plan, e.g. 'ChatGPT, our business workspace only'].
• Personal AI accounts (free or paid) must never be used for customer or client data.

2. What you can paste

• 🟢 Green (generic questions, fully anonymised text): any approved tool.
• 🟠 Amber (names, emails, order histories, support tickets): approved business plan only, after removing or replacing identifiers with placeholders such as [CUSTOMER_NAME] and [ORDER_ID].
• 🔴 Red (health, card or bank details, ID numbers, passwords, children's data, data under NDA): never, unless [owner] has approved it in writing after professional advice.

Policy template, part 2: settings, questions and review

3. Required settings and security

• Two-factor authentication on.
• Training and data settings checked by [owner] on [date].
• No shared links for client work.
• Connectors only enabled with approval.

4. Before you paste, ask

• Does the AI need this detail to do the task?
• Would I email this to an outside contractor without a contract?

5. Questions and mistakes

• Ask [name/channel] if you're unsure.
• If you paste something you shouldn't have, tell [name] the same day. Reporting quickly is what matters. You won't be blamed for reporting.

6. Review

• [Owner] re-checks vendor terms every quarter and whenever we change plan or tool.

If someone already pasted sensitive customer data

It happens. A calm, quick response matters more than the mistake itself.

The same questions apply to other AI tools

Nothing in this framework is specific to ChatGPT. Claude, Gemini, Microsoft Copilot and other assistants each have their own consumer and business terms, and the same split usually applies: personal plans on one set of terms, business plans on another. Run the same checklist on each.

Don't forget AI features built into tools you already use. Email clients, CRMs, helpdesks and document editors increasingly include AI assistants that may process customer data too. Check their terms and settings just as you would a standalone chatbot.

If you're comparing tools, add the data-terms checklist above to your evaluation. Our guide on how to choose an AI writing assistant for a small business includes a 5-day trial plan. Make 'check the data terms and settings' part of day one, before any real customer data goes in.

Frequently asked questions

Does ChatGPT train on what I type?

It depends on your plan and your settings. OpenAI publishes different data commitments for its consumer plans and its business products. Check OpenAI's privacy policy, its business privacy page and the data controls in your own account, and confirm the current state yourself rather than assuming a default.

Is ChatGPT Plus safer for customer data than the free version?

Not automatically. Plus is a paid personal plan governed by consumer terms. Business-grade data terms, such as a data processing agreement and admin controls, are generally tied to OpenAI's business offerings. Check the current plan pages before relying on any plan for customer data.

Is ChatGPT GDPR compliant?

No tool is compliant on its own. Compliance depends on how you use it: a lawful basis, a DPA with the provider, a privacy notice that covers the use, data minimisation and safeguards for international transfers. Start by checking whether a DPA is available for your plan.

Can I use ChatGPT with patient or health information?

Treat health information as red data. In the US, HIPAA requires a business associate agreement before a provider handles protected health information for you, and OpenAI says it offers one only for certain products. Verify this on OpenAI's pages and get compliance advice first. Elsewhere, health data is special category data under GDPR and needs extra safeguards.

Does Temporary Chat make it safe to paste customer data?

It reduces some exposure, for example by keeping the chat out of your history, but content may still be retained for a period for safety reasons. Check OpenAI's Help Center for current details. It does not replace data minimisation or proper business terms.

Can I upload a customer spreadsheet to ChatGPT?

Only after removing or masking the identifier columns, uploading only the columns the task needs, and confirming that your plan's terms and your privacy notice allow it. Check free-text columns such as notes carefully, because they often contain personal data.

Do I need to tell customers I use AI tools on their data?

If you process customers' personal data with a third-party provider, privacy law usually requires your privacy notice to cover it. Client contracts may also require consent before you use AI tools. Get advice for your jurisdiction.

Is using the OpenAI API safer than the ChatGPT app?

The API is governed by business terms with its own data commitments, which OpenAI describes on its platform pages. It still requires a DPA, data minimisation and secure handling on your side, such as protecting API keys. Check the current API data usage policy.

What should I do if an employee pasted customer data into their personal ChatGPT account?

Record what was shared, when and on which account. Delete the chat and any shared links, and check memory. Assess whether it is a reportable personal data breach (under GDPR, reportable breaches must be notified to the regulator within 72 hours where feasible) and get advice. Then update your policy so customer data only goes into approved business accounts.