Is ChatGPT safe for your customer data?
Your staff are already pasting things into ChatGPT. Emails, customer complaints, spreadsheets. The question isn't whether it's happening, it's whether any of it should be.
Where it hurts
ChatGPT is genuinely useful, so people use it. The trouble is what goes in. Someone pastes a customer's full email, name and address included, to get help writing a reply. Someone else drops in a spreadsheet of contacts to tidy it up. On a personal account, free or paid, those chats can be used to train OpenAI's models unless someone's gone into the settings and turned 'improve the model for everyone' off. Paying for Plus doesn't change the default; it's the business versions and the API that keep your data out of training as standard.
And the training setting only settles one risk. Even with it off, you're putting customer details into someone else's system, and under UK GDPR that still needs a lawful reason, honest privacy information, proper terms with the provider and, for some uses, a formal risk assessment. Nobody's thought about any of that because it doesn't feel like sending data anywhere. It feels like using a clever website.
You don't want to ban it, that just pushes it underground. You want people to get the benefit without handing customer details to a system nobody's checked.
What I'd build
I'd start by putting you on the right version: a proper business workspace (ChatGPT Business, or Copilot inside Microsoft 365 if you're already there) where your data isn't used for training by default and there's a real agreement covering it. Any personal accounts that stay get model training switched off in the settings. Then I'd write you a short, plain set of rules for staff. What's fine to paste, what isn't, how to strip names out when they're not needed, and when to ask first. Not a legal document nobody reads, a one-pager with real examples from your business. And I'd show your team the safe way to get the same result, so the sensible option is also the easy one.
What changes
- A business workspace where your data isn't used to train the model
- Model training switched off on any personal accounts that stay
- A plain one-page rule sheet staff will actually follow
- Your team keeps the benefits without the GDPR exposure
Facts on this page last checked 12 July 2026, against help.openai.com, ico.org.uk.
Related fixes
Sound like your week? The free half-hour review is where we work out whether this is your first fix or your fifth.