Home › Answers › Data, privacy and GDPR

Data, privacy and GDPR

Whether AI tools are safe for business data, how UK GDPR applies and which settings to change.

• Are AI detection tools accurate?
  Not reliably. AI text detectors give a probability, not proof, and can flag human writing as AI, especially from non-native English speakers. OpenAI withdrew its own AI text classifier in July 2023 because of its "low rate of accuracy". Use detectors as a prompt for a conversation, never as the only evidence for a decision.
• Are AI tools secure for business?
  The major AI tools run on secure, encrypted services, but that isn't the whole picture. The National Cyber Security Centre warns that AI can state wrong facts confidently, can be tricked by "prompt injection", and can be corrupted through its training data. For a small business, the biggest risk is usually staff pasting sensitive information into personal accounts.
• Are ChatGPT chats private? Can OpenAI read them?
  Your chats aren't public, but they aren't fully private either. OpenAI stores them on its systems and those of its service providers, and may use personal-plan chats to improve its models unless you turn that off. OpenAI says not to enter sensitive information you wouldn't want reviewed. It says it doesn't sell your data or share chats with advertisers.
• Are Microsoft Copilot chats private?
  Depends which Copilot you use. With a personal Microsoft account, Microsoft keeps your conversation history for 18 months and may use chats to train its AI models unless you opt out. Microsoft 365 Copilot signed in with a work or school account comes with enterprise data protection, and Microsoft says prompts and responses aren't used to train its foundation models.
• Can AI agents be trusted?
  Only with limits. AI agents can book, buy, reply and edit files for you, but the NCSC warns they "may interpret instructions and goals in literal or unexpected ways" and that built-in safety controls "may be bypassed". Give it minimal access, approve anything costly or customer-facing, and keep a way to stop it.
• Can I put customer data into ChatGPT?
  Avoid it on a personal ChatGPT account. Under UK GDPR you're responsible for customers' personal data, and pasting names, addresses, phone numbers or health details into a consumer AI tool shares them with a third party without a contract covering it. Use placeholders instead, or a business plan with a data processing agreement.
• Can Meta AI be turned off on Facebook and Instagram?
  No, not completely. Meta AI stays in Facebook and Instagram search and messages, and Meta doesn't offer an off switch. You can mute the Meta AI chat so it stops notifying you, avoid using it, and, in the UK, object to Meta using your public posts and AI chats to train its AI. Business pages can still use it.
• Does my small business need an AI policy?
  There's no UK law that says every small business must have an AI policy. But if anyone besides you uses AI for work, a one-page policy is the quickest way to stop customer data ending up in the wrong tool and AI mistakes reaching customers. Even a sole trader benefits from writing down three or four rules.
• Does AI save your data?
  Usually, yes. Most AI chatbots save your conversations in your history, and many consumer plans can use them to improve their models unless you switch that off. Business plans generally don't train on your data by default. Assume anything you type could be stored, and keep customer and confidential details out of personal accounts.
• Does ChatGPT Business train on my data?
  No, not by default. OpenAI says it doesn't train its models on ChatGPT Business, Enterprise or API data unless you explicitly opt in, for example by sending feedback. Your workspace admins can see, export and delete members' conversations, and OpenAI will sign a Data Processing Addendum to support UK GDPR compliance.
• Does ChatGPT use a lot of data?
  Not much. Text chats with ChatGPT use little mobile data, similar to messaging. Voice chats, uploading photos and generating images or video use more. On energy, OpenAI's chief executive said in June 2025 that an average query uses about 0.34 watt-hours, and Google estimated 0.24 watt-hours for a median Gemini text prompt.
• Does ChatGPT use my data for training, and how do I turn it off?
  On Free, Go, Plus and Pro, OpenAI may use your conversations to improve its models unless you turn it off. Go to Settings, Data controls and switch off "Improve the model for everyone". Business and Enterprise workspaces aren't used for training by default. Thumbs-up or thumbs-down feedback can still send that conversation for training.
• Does Claude use my data for training?
  Only if you allow it on a personal plan. On Claude Free, Pro and Max, a model improvement setting decides whether your chats are used to train Anthropic's models; you can turn it off at any time. Anthropic's pricing page says Team and Enterprise plans have no model training on your data by default. Incognito chats aren't used for training.
• Does Gemini use my data for training?
  Yes, if Keep activity is on. Google says it uses your Gemini activity to improve its services, including training AI models, and that human reviewers read some chats. Turn off Keep activity and future chats aren't used for training unless you send feedback, though Google still keeps them for 72 hours. Work and school accounts follow different terms.
• Does NotebookLM store or train on my data?
  NotebookLM, which Google's help pages now call Gemini Notebook, stores the files you add, your chats and outputs so it can run your notebooks. Google says that content "will not be used to directly train our foundational AI models, unless you choose to provide feedback". Feedback can be read by human reviewers and kept for up to three years.
• Can I delete my data from ChatGPT?
  Yes. You can delete single chats or your whole history, and OpenAI says cleared chats are deleted from its systems within 30 days, unless they were already de-identified or must be kept for security or legal reasons. You can also delete your account, or send a privacy request through OpenAI's Privacy Portal or to dsar@openai.com.
• How do I use AI safely at work?
  Keep personal and confidential data out of personal AI accounts, switch off model training, check every answer before you use it, and write your rules down. For anything involving customers or staff, use a business plan whose provider says it won't train on your data. Under UK GDPR, your business is responsible for what you share.
• Is Canva AI safe to use?
  Generally, yes. Canva says it won't use your content to improve its AI features unless your privacy settings allow it, and you can change those settings at any time. Content from Canva Teams, Business, Enterprise and Education accounts "is not used to improve AI-powered features, and this cannot be turned on".
• Is ChatGPT GDPR compliant for UK businesses?
  No tool is "GDPR compliant" on its own; compliance depends on how you use it. For a UK business, the safer route is ChatGPT Business or Enterprise, where OpenAI offers a data processing addendum and doesn't train on your content by default. Personal plans are fine for drafting without personal data, but not for processing customer records.
• Is ChatGPT safe to use for my business?
  ChatGPT is safe enough for everyday business writing if you follow a few rules: keep customers' personal details and confidential figures out of personal accounts, turn off model training, check every answer before it goes out, and don't let it make decisions about people. The bigger risks are wrong answers and careless data sharing, not hacking.
• Is DeepSeek safe to use for business?
  Be careful. DeepSeek's privacy policy says it collects, processes and stores your personal data in the People's Republic of China, and uses what you type to train its models. The UK government has said inputs sent to DeepSeek are subject to Chinese law. Don't put customer, staff or commercially sensitive information into the DeepSeek app or website.
• Is Grok safe to use?
  Grok is fine for general questions if you change two settings, but it isn't the place for customer or staff data. Its FAQ says your chats may be used to train its models unless you turn off "Improve the model", and authorised staff may review conversations. The ICO opened a formal investigation into Grok in February 2026.
• Is Meta AI safe for privacy?
  Meta AI is fine for everyday questions, but it isn't private. Meta says it uses your interactions with its AIs to improve AI at Meta, and uses your profile and activity to personalise replies. UK users can object to their public posts and AI chats being used to train its AI. Don't share customer or confidential data with it.
• Is Otter AI GDPR compliant and safe for business?
  Otter.ai says it has a SOC 2 Type 2 report, encrypts stored data with AES-256 and has "incorporated GDPR standards" into its practices. That's a claim about Otter's side. Under UK GDPR, you are still responsible for telling people you're recording, having a lawful reason, and not keeping recordings longer than you need.
• Is Perplexity safe and private?
  Perplexity can use your searches to improve its AI models unless you switch that off. Its help centre says to turn off "AI Data Retention" in your account settings (called "AI Data Usage" on mobile); this applies from then on, not to data already collected. Perplexity says Enterprise data is never used for training, so use that for business information.

All answers · Guides