Home › Answers › Data, privacy and GDPR
Can I put customer data into ChatGPT?
Short answer
Avoid it on a personal ChatGPT account. Under UK GDPR you're responsible for customers' personal data, and pasting names, addresses, phone numbers or health details into a consumer AI tool shares them with a third party without a contract covering it. Use placeholders instead, or a business plan with a data processing agreement.
Why it matters
Customer details are personal data. UK GDPR says you must have a lawful reason to use them, use no more than you need, keep them secure, and tell people how they're used (your privacy notice). The ICO's AI guidance stresses data minimisation: only use the personal data you actually need.
On ChatGPT Free, Go, Plus and Pro, you accept OpenAI's consumer terms and OpenAI may use conversations for training unless you switch it off. That isn't the same as having OpenAI act as your processor under a contract.
The easy fix: placeholders
You almost never need the real details to get a good draft.
Instead of:
Write a reminder to Sarah Jones at 14 High Street, Penrith, who owes £480 for the boiler service.
Write:
Write a polite payment reminder to [customer] for [£ amount] for a boiler service completed on [date]. British English, firm but friendly.
Then fill in the details yourself in your email or invoicing app.
When you genuinely need to process customer data
If staff need AI to work on customer records (summarising enquiries, sorting emails), use a business plan whose provider signs a data processing agreement. OpenAI's Data Processing Addendum covers its business services and names the ICO as the competent authority for UK data. Then:
- Add the AI provider to your privacy notice and records.
- Check where data is stored and how long it's kept.
- Never paste special category data (health, ethnicity, religion) or bank details.
- Do a quick risk check; the ICO has an AI and data protection risk toolkit.
Related questions
Is a job address personal data?
If it can be linked to a person (a homeowner's address, say), treat it as personal data. A street name with no house number or name is lower risk, but placeholders are simpler.
What if I've already pasted customer details in?
Delete the chat, turn off model training in Data controls, and use placeholders from now on. If it was sensitive data or a lot of people, read the ICO's guidance on personal data breaches to decide whether it needs reporting.
Sources
- ICO: guidance on AI and data protection
- ICO: how should we assess security and data minimisation in AI?
- OpenAI Data Processing Addendum
- Data controls in ChatGPT (OpenAI Help Center)
Checked 17 October 2026. Rules and prices change, so check the source before you rely on it. This is general information, not legal, tax or financial advice.
More on data, privacy and gdpr
- Are AI detection tools accurate?
- Are AI tools secure for business?
- Are ChatGPT chats private? Can OpenAI read them?
- Are Microsoft Copilot chats private?
- Can AI agents be trusted?
- Can Meta AI be turned off on Facebook and Instagram?
All data, privacy and gdpr answers · All answers · Guides · AI tools directory
Get one useful AI tool in your inbox each weekday
Free, plain English, five minutes to read. Unsubscribe any time.
See our privacy notice.