The short answer
Using ChatGPT, Microsoft Copilot or similar AI tools is not against UK GDPR, but putting personal data into them carelessly can be. The main things to get right are knowing whether the tool uses your input to train its models, having a lawful basis for any personal data you process through it, being clear with staff about what they can and can't paste in, and keeping a record of what you've decided. None of this needs a lawyer for a small business; a short, clear policy and sensible settings cover most of it.
What UK GDPR actually requires here
UK GDPR doesn't mention AI tools specifically. It applies the same general principles it always has: you need a lawful basis to process personal data, you should only collect and use what you actually need, you must keep it secure, and people have rights over their own data (to see it, correct it, or ask for it to be deleted). The question isn't "is AI allowed", it's "does this particular use of AI, with this particular data, meet those existing rules."
In practice, that means three things matter most:
- What data are you putting in? A general question with no personal details is low risk. A customer's name, health information, or financial details pasted into a prompt is a different matter entirely.
- Does the tool use your input to train its models? Many AI providers offer a business or enterprise tier where your data isn't used for training and isn't retained beyond what's needed to answer, as opposed to free consumer tiers which sometimes do use input data this way. This is also true of Microsoft Copilot and Google's Gemini, see our comparison of Microsoft 365 vs Google Workspace if you're deciding which platform to build this into. This is the single most important setting to check.
- Where is the data processed and stored? Check the provider's data processing terms for where data is held and under what safeguards, particularly if any special category data (health, for instance) is involved.
A practical checklist before your team uses AI tools
- Check whether you're on a business or enterprise tier of the tool, not a free consumer account, for anything involving work data.
- Read the provider's data processing terms for whether input data is used for training, and for how long it's retained.
- Decide what data your team can and can't paste into a general AI tool. A simple rule: no customer names, contact details, health information or financial details unless the tool is specifically approved for that use.
- Update your privacy notice if AI tools are now part of how you handle any customer data, so customers know.
- Add AI tools to your record of processing activities if you keep one (useful practice for any business handling personal data, and expected under accountability requirements).
- Agree who in your business is responsible for reviewing new AI tools before the team starts using them.
- Train the team on the policy, not just write it down somewhere no one reads.
A simple AI usage policy, in plain English
You don't need a lengthy document. A one-page policy covering the following is usually enough for a small business:
- Which tools are approved (and on what plan or tier)
- What data can go into them (and what definitely can't: customer personal data, health data, financial details, anything confidential about another business)
- Who to ask if unsure
- How AI-drafted content should be checked before it goes out, particularly anything customer-facing
- What to do if something's pasted in by mistake (who to tell, so it can be assessed)
This matters more than it sounds. A team that's never been told clearly what not to paste into ChatGPT will, eventually, paste in something they shouldn't, usually without any bad intent at all.
Where this connects to your wider AI use
If you're also exploring where AI can genuinely save time day to day, our guide on practical AI for small businesses covers the uses that tend to work well alongside the data protection side covered here. And if the bigger picture is your IT setup generally, our cyber security checklist for small businesses covers the basics that make incidents like this less likely in the first place.
What to watch out for
- Free consumer tiers are the highest-risk setup. If your team is using the free version of a general AI tool for anything involving customer data, that's the first thing to fix.
- "Anonymised" data isn't always as anonymous as it looks. A name removed but a very specific combination of other details left in (a rare job, a specific location, an exact date) can still identify someone.
- Don't assume IT or marketing have already sorted this. AI tools tend to get adopted informally by individuals before any policy exists; ask around rather than assuming.
- Keep an eye on new features. Providers add features (like AI reading your email inbox or documents automatically) that can change what data a tool touches, sometimes without an obvious prompt to review your settings again.
- Don't let a policy sit unread. A short conversation with the team, not just a document, is what actually changes behaviour.
If you'd rather not do this yourself
We can review which AI tools your team is already using, check the settings and data handling against UK GDPR, and leave you with a short, practical policy everyone actually understands. Have a look at our practical AI service, or tell us what you're using AI for for a free 30-minute call.
Frequently asked questions
Is it illegal to use ChatGPT for work in the UK?
No. There's no law against using AI tools for business. The legal obligations under UK GDPR apply to how you handle personal data within that use, the same as they would with any other software.
Can I put customer names into ChatGPT or Copilot?
It depends on the tool, the plan you're on, and what you do with the output. On a business tier with appropriate data handling terms, and for a legitimate, proportionate purpose, it can be fine. On a free consumer tier, or without checking the terms, it's a risk worth avoiding until you've checked.
Does the ICO have specific guidance on AI?
The Information Commissioner's Office publishes guidance on AI and data protection that's updated periodically as the area develops. It's worth checking their current guidance directly rather than relying on anything that might be out of date, since this is an area that moves quickly.
Do I need a Data Protection Impact Assessment to use AI tools?
Not always, but it's worth considering one if you're planning to process personal data at any scale or in a way that could be considered higher risk, such as automated decisions that affect someone. For routine drafting and summarising with no significant personal data involved, it's usually not necessary.
What's the single biggest risk most small businesses are taking right now?
Staff using free, consumer-tier AI tools with real customer data, without anyone having checked the tool's data handling terms or agreed what's off-limits. It's rarely malicious, almost always just nobody having looked at it yet.
Should I tell customers if I use AI to handle their enquiries?
It's good practice to be transparent, particularly if AI is involved in anything customer-facing like a chat assistant. A line in your privacy notice and, where relevant, a simple note that a chat assistant can hand over to a person, covers most of what's needed.