Home › Answers › Data, privacy and GDPR
Is ChatGPT GDPR compliant for UK businesses?
Short answer
No tool is "GDPR compliant" on its own; compliance depends on how you use it. For a UK business, the safer route is ChatGPT Business or Enterprise, where OpenAI offers a data processing addendum and doesn't train on your content by default. Personal plans are fine for drafting without personal data, but not for processing customer records.
Personal plans versus business plans
| Free, Go, Plus, Pro | Business, Enterprise | |
|---|---|---|
| Terms | Consumer terms | Business terms |
| Training on your chats | Possible unless you turn it off | Not by default |
| Data processing agreement | Not the normal route | OpenAI DPA available |
| Admin controls | None | Workspace admin, retention settings |
OpenAI's DPA says OpenAI acts as a data processor for customer data, covers UK transfers using the EU standard contractual clauses with the UK Addendum, and names the ICO as the competent supervisory authority for UK data.
What you still have to do
Even with a DPA, you're the controller. That means:
- Have a lawful basis for the personal data you put in.
- Use only what you need (data minimisation).
- Update your privacy notice to mention AI tools you use with customer data.
- Keep a record of the processing and do a risk assessment for anything significant.
- Have a person review any AI output that affects someone (decisions on jobs, refunds, credit).
The ICO's guidance on AI and data protection sets out these duties; its core AI guidance was under review when we checked.
For a sole trader using ChatGPT for drafts
If you only use it to draft emails, quotes and posts with placeholders instead of real names, you aren't putting personal data in, and GDPR has little to bite on. That's the simplest way to stay safe. See can I put customer data into ChatGPT?
Related questions
Are Claude, Copilot and Gemini any different?
The same split applies: consumer plans run on consumer terms, business plans come with data processing terms. Check each provider's business terms before staff use it with customer data.
Does ChatGPT store data in the UK?
OpenAI's pricing page lists data residency (including the UK) only for business-tier workspaces. Personal plans don't offer it.
Sources
- OpenAI Data Processing Addendum
- ChatGPT pricing: plan comparison (OpenAI)
- Data controls in ChatGPT (OpenAI Help Center)
- ICO: guidance on AI and data protection
Checked 17 October 2026. Rules and prices change, so check the source before you rely on it. This is general information, not legal, tax or financial advice.
More on data, privacy and gdpr
- Are AI detection tools accurate?
- Are AI tools secure for business?
- Are ChatGPT chats private? Can OpenAI read them?
- Are Microsoft Copilot chats private?
- Can AI agents be trusted?
- Can I put customer data into ChatGPT?
All data, privacy and gdpr answers · All answers · Guides · AI tools directory
Get one useful AI tool in your inbox each weekday
Free, plain English, five minutes to read. Unsubscribe any time.
See our privacy notice.