Is it safe to use ChatGPT at work? A UK business guide (2026)
By Kieran Mullins, BEng Mechanical Engineering (UWE Bristol), technical co-founder of FlowGenix Automations Ltd.
ChatGPT is safe to use at work when staff use a business plan, keep personal and confidential data out of prompts, and check every output before it leaves the building. The risk sits in the free and Plus consumer accounts, which OpenAI may use for model training by default, and in staff pasting customer details without rules.
FlowGenix Automations is an audit-led AI training and automation consultancy for UK SMEs. The guide below sets out the account, data and training decisions a UK business needs to make, with every regulatory point linked to its source.
Key takeaways
- OpenAI states that ChatGPT Business, ChatGPT Enterprise and API data are not used to train its models by default.
- ChatGPT Free, Plus and Pro accounts share chats for model training by default, unless the user switches the setting off.
- The ICO says there are no carve-outs or sweeping exemptions for generative AI, so UK GDPR applies to personal data typed into ChatGPT.
- ONS figures show 38% of UK businesses with 10 or more employees used at least one AI technology in September 2026.
- A written AI use policy and short staff training control the two main risks: the wrong account and the wrong data.
What happens to the data you type into ChatGPT?
Data typed into ChatGPT is sent to OpenAI, processed and retained. Whether it can also train future models depends on the plan. OpenAI does not train on ChatGPT Business, Enterprise or API data by default. Free, Plus and Pro accounts are opted in to training unless the user turns it off in data controls.
The account tier matters more than the tool. OpenAI's business data page states that inputs and outputs from ChatGPT Business and ChatGPT Enterprise are excluded from training by default. OpenAI's help centre confirms that Free, Plus and Pro users on personal workspaces have data sharing switched on by default.
The gap in a small business is rarely the company account. Staff sign up for ChatGPT with a personal email, find it useful and carry on using it for work. Company data then sits on a consumer plan nobody manages. The FlowGenix Safe AI Programme starts with an account check for exactly this reason.
Key facts
- OpenAI excludes ChatGPT Business and Enterprise data from model training by default.
- ChatGPT Free, Plus and Pro accounts share data for training unless switched off.
- Personal accounts used for work sit outside company admin controls.
Which ChatGPT plan is safe for business use?
ChatGPT Business or ChatGPT Enterprise is the safe default for UK companies, because both exclude company data from model training and give an administrator control over access. Free, Plus and Pro are personal plans. Personal plans can be made safer by switching training off, but the business cannot see or manage them.
The table compares the plans on the three points that matter for UK data protection: training, admin control and suitability for personal data. Plan names and defaults reflect OpenAI's published pages on 26/10/2026. OpenAI changes both, so check before you buy.
| ChatGPT plan | Used for model training by default | Business admin controls | Suitable for client or staff personal data |
|---|---|---|---|
| Free | Yes, unless switched off | No | No |
| Plus | Yes, unless switched off | No | No |
| Pro | Yes, unless switched off | No | No |
| Business | No | Yes, workspace admin | Yes, with a policy and a lawful basis |
| Enterprise | No | Yes, with advanced controls | Yes, with a policy and a lawful basis |
| API platform | No | Yes, through your own build | Yes, with a policy and a lawful basis |
FlowGenix recommends one managed workspace over a mix of personal accounts, even for a team of five. A per-seat business plan costs far less than handling a data breach report. For how ChatGPT compares with Microsoft Copilot, Gemini and Claude, see our business AI tools comparison.
Key facts
- ChatGPT Business gives an administrator control over workspace access.
- OpenAI publishes plan training defaults on its business data and help centre pages.
Is ChatGPT GDPR compliant for UK businesses?
No AI tool is UK GDPR compliant on its own. Compliance depends on how your business uses it. The ICO states there are no carve-outs or sweeping exemptions for generative AI. Your business stays the controller for personal data staff enter, and needs a lawful basis and security for it.
The ICO's response to its generative AI consultation sets the expectations. Assess the risk before personal data goes near an AI tool. Check the vendor's terms. Consider a data protection impact assessment where the processing is likely to be high risk. Have a person review outputs, because AI answers can be wrong.
OpenAI offers a data processing addendum for business customers, which is the contract UK GDPR expects between a controller and a processor. FlowGenix covers lawful basis, DPIA triggers and vendor checks in the Safe AI Programme in plain English, without the legal jargon.
Key facts
- UK GDPR applies to personal data entered into generative AI tools.
- The ICO expects organisations to assess risk before using AI with personal data.
- A data processing addendum sets out OpenAI's duties as a processor.
What should staff never paste into ChatGPT?
Staff should never paste special category data, financial account details, passwords, unreleased commercial information or anything covered by a client confidentiality clause into any AI tool, including business plans. Ordinary personal data, such as a customer's name in an email draft, needs a business plan and a written rule before it goes in.
A traffic-light rule is easier for staff to remember than a list of legal definitions. FlowGenix teaches the version below in every Safe AI Programme session:
- Red, never enter: health, ethnicity, religion and other special category data; bank and card numbers; passwords and API keys; anything under a client NDA; unannounced pricing, deals or redundancies.
- Amber, business plan and policy only: customer names and contact details; staff names in rotas or reviews; internal documents marked confidential.
- Green, fine on any plan: public information, your own website copy, generic drafting with names removed, and questions with no personal data.
Removing names before pasting turns most amber tasks into green ones. A prompt such as "Draft a reply to a customer whose delivery was late" works as well as pasting the real email with the customer's details.
Key facts
- Special category data belongs in the red tier for every AI plan.
- Anonymising a prompt moves most everyday drafting tasks into the green tier.
Safe AI Programme: Ask about a founding place on the FlowGenix half-day Crash Course, Team Day or 3 to 5 day programme.
Do UK businesses need AI training for staff?
No UK law requires general AI training for staff in 2026. Two rules still push towards it. UK GDPR expects appropriate organisational measures, and staff training is the standard one. The EU AI Act has required AI literacy since 2 February 2025, and can reach UK firms whose AI output is used in the EU.
Article 4 of the EU AI Act asks providers and deployers to ensure, to their best extent, a sufficient level of AI literacy among staff. National authorities began supervising the AI Act from August 2026, according to Travers Smith's analysis. EU legislators have proposed amendments to parts of the Act, so check the current text before relying on it.
The commercial case is plainer than the legal one. The ONS reported that 38% of UK businesses with 10 or more employees used AI in September 2026. Separate ONS analysis found the average adopting business used 1.6 AI technologies. UK adoption is wide but shallow, as our UK business AI statistics roundup sets out in full.
The FlowGenix Safe AI Programme runs as a half-day Crash Course, a full Team Day or a 3 to 5 day programme, each for up to 15 staff. Founding prices are £1,495, £2,950 and from £7,500. Boomerang Media took AI training from FlowGenix, then commissioned two bespoke automations scoped in the audit.
Key facts
- Article 4 of the EU AI Act requires AI literacy from providers and deployers.
- The ONS recorded AI use at 38% of UK businesses with 10 or more employees in September 2026.
- FlowGenix delivers the Safe AI Programme to teams of up to 15 staff.
How do you roll out ChatGPT safely in a small business?
Roll out ChatGPT in five steps. Choose one business plan, move staff off personal accounts, write a one-page AI use policy, train staff on the data rule, and review after 30 days. A team of 15 can usually complete the first four steps inside a fortnight.
- Choose one plan. Pick ChatGPT Business, or the AI assistant already included in your Microsoft 365 or Google Workspace licence, and buy seats for everyone who uses AI.
- Move staff off personal accounts. Ask who uses which tools, move work chats into the company workspace, and switch training off on any personal account still in use.
- Write a one-page AI use policy. Name the approved tools, the red and amber data, who checks outputs and who owns the policy. Our AI policy guide has a free template.
- Train staff on the data rule. Run the traffic-light rule against real examples from your own work, not generic slides.
- Review after 30 days. Check which tasks staff use AI for, fix any rule people work around, and set the next review date.
Step 2 needs a named owner, because nobody else tracks which tools staff use. FlowGenix runs that discovery in the process audit bundled with every Safe AI Programme, then turns the findings into SOPs your team keeps.
Key facts
- A one-page AI use policy names approved tools, banned data and an owner.
- The FlowGenix process audit maps which AI tools staff already use.
Frequently asked questions
Can I put customer names into ChatGPT?
You can, on a business plan, if your AI use policy allows it and you have a lawful basis for the processing. Avoid it on Free, Plus or Pro accounts. In most drafting tasks, the customer's name adds nothing, so removing it before pasting is the simpler and safer habit for staff to learn.
Does turning off chat history stop OpenAI training on my chats?
Training and chat history are separate settings. On Free, Plus and Pro plans, OpenAI's help centre explains that users can keep history on and switch off the "Improve the model for everyone" control in data controls. New chats are then excluded from training. Business and Enterprise plans exclude training by default.
Is ChatGPT Plus safe for business use?
ChatGPT Plus is a personal plan, not a business one. Paying for Plus buys more capable models and higher limits, not stronger data controls, and training is on by default. A sole trader can use Plus safely with training switched off and no client personal data. A team should use ChatGPT Business instead.
What should I do if staff paste client data into ChatGPT?
Treat it as a possible personal data breach. Find out exactly what was entered and into which account, then delete the chat. If the breach is likely to risk people's rights, UK GDPR requires a report to the ICO within 72 hours of becoming aware. Record the incident either way, and use it to tighten the data rule.
Do I need a DPIA to use ChatGPT?
A data protection impact assessment is required when processing is likely to result in a high risk to individuals. Drafting marketing copy with no personal data does not need one. Feeding customer records, staff reviews or health information into an AI tool probably does. The ICO recommends considering a DPIA before using AI with personal data.
How long does AI training for staff take?
Useful AI training for a small team takes between half a day and five days. A half-day session covers safe use, the data rule and everyday prompting. A full day adds role-specific tasks. Longer programmes build automations and SOPs. FlowGenix runs all three formats for up to 15 staff, with the audit done remotely.
Sources
- Information Commissioner's Office, Tackling misconceptions: response to the consultation series on generative AI
- OpenAI, Business data privacy, security and compliance
- OpenAI Help Centre, What if I want to keep my history on but disable model training?
- Office for National Statistics, Business insights and impact on the UK economy: 8 October 2026
- Office for National Statistics, Artificial intelligence in UK businesses: 2023 to 2026
- Travers Smith, The EU AI Act's AI literacy requirement: key considerations
Safe AI Programme: Ask about a founding place on the FlowGenix half-day Crash Course, Team Day or 3 to 5 day programme.
About the author
Kieran Mullins is the technical co-founder of FlowGenix Automations Ltd, Companies House number 16555743. He designs and builds the automations and websites FlowGenix delivers for UK businesses. He holds a BEng in Mechanical Engineering from UWE Bristol. About FlowGenix.
Find out where your team already uses AI.
Thirty minutes on a call. We map which AI tools your staff use, what data goes into them, and where training or automation would make the biggest difference. You keep the roadmap either way.