Is It Safe to Put Customer Data Into ChatGPT? A Practical Guide for Small Businesses

By AI Compass Editorial team · Updated November 1, 2026

The short answer

It depends on four things: what the data is, which ChatGPT plan you use, how that account is configured, and what you have promised customers and are required to do by law. Generic questions and properly anonymised text are generally fine on most plans once you have checked the settings. Identifiable personal data, such as names, emails and order histories, needs a business-grade plan with a data processing agreement, plus data minimisation. Sensitive data (health details, bank or card details, ID numbers, passwords) usually should not go in at all unless your contract and compliance setup explicitly cover it.

A simple default rule: if you wouldn't email it to an outside contractor without an NDA and a contract, don't paste it into a chatbot.

This is general information, not legal advice. For anything in the amber or red categories below, check with your data protection officer, a lawyer or your regulator's guidance.

The rest of this guide walks through a four-step framework that works for any AI assistant, not just ChatGPT:

1. Classify the data (green, amber or red).
2. Check the plan and its terms using the vendor's own pages.
3. Minimise and anonymise before you paste.
4. Know the hard 'no' cases where AI shouldn't be used at all.

What counts as customer data, and why the type matters

Most of the risk decision follows from one question: what exactly are you about to paste?

Personal data is anything that identifies a living person, either directly or indirectly.

• Direct identifiers: name, email address, phone number, home address, account username.
• Indirect identifiers: details that identify someone when combined or in context. An order number plus a postcode. A unique job title at a named company ('the head of finance at a 12-person bakery in Bath'). A rare event ('the customer whose wedding cake collapsed last Saturday').

Special category data is the GDPR term for the most sensitive types: health, racial or ethnic origin, religious or philosophical beliefs, political opinions, trade union membership, genetic and biometric data, sex life and sexual orientation. It has extra legal protection under Article 9 of the GDPR.

Other high-risk data isn't special category under GDPR but can cause real harm if exposed: payment card numbers, bank details, government ID numbers (passport, National Insurance, Social Security), login credentials and API keys, and data about children.

Confidential business data matters too, even when no individual is named. Client contracts, pricing agreements, unreleased product plans and anything covered by an NDA can all be restricted by contract.

Traffic-light classification

If you are unsure which colour applies, treat it as the next one up.

What can happen to what you type into ChatGPT

The risks are real but specific. It helps to know the actual mechanisms rather than a vague sense that 'AI keeps everything'.

• Model training. On some plans, conversations may be used to improve OpenAI's models unless you opt out. Whether this applies, and whether it is on or off by default, depends on the plan and your settings. Check OpenAI's privacy policy and your own data controls rather than assuming.
• Retention. Chats, uploaded files and even deleted conversations may be kept for a period for safety, abuse monitoring or legal reasons. Retention can also be extended by legal obligations, such as court orders. The current periods are set out in OpenAI's privacy policy and Help Center, and they can change.
• Human review. Providers may have people review some content, for example to investigate abuse. The terms for your plan describe when this can happen.
• Account-level exposure. Data can travel beyond the original chat. A shared link can typically be opened by anyone who has the URL. Memory can carry details into future conversations. Custom GPTs, connectors to email or cloud drives, and shared team workspaces can all widen who or what can see the content.
• Your own security. Weak passwords, shared logins, no two-factor authentication and ex-staff who still have access are often a bigger practical risk than anything the vendor does.

Consumer plans vs business plans: what is different in principle

This is the most important structural difference, and it is easy to get wrong.

Consumer plans (at the time of writing: Free, Plus and Pro) are personal accounts governed by OpenAI's consumer terms. Business offerings (at the time of writing: Team/Business, Enterprise, Edu and the API platform) are typically governed by business terms. Plan names and lineups change, so check OpenAI's current pricing page before relying on these labels.

At the time of writing (last checked November 2026), OpenAI states on its business data privacy page that it does not train its models on business customers' data by default. Treat that as OpenAI's published commitment for the products that page lists, not as a guarantee for every plan, and check the current page yourself.

What business plans typically add, subject to checking each plan:

• A data processing addendum (DPA), the contract you usually need under GDPR when a provider processes personal data for you.
• Admin controls: managing users, removing leavers, restricting features.
• Single sign-on (SSO) on some tiers.
• The ability to manage or delete user data centrally.
• Security documentation, such as SOC 2 reports, through the OpenAI Trust Portal.

Paying is not the same as a business plan. Plus and Pro are paid personal plans. Upgrading from Free to Plus gives you more features, but it does not by itself put you under business data terms or give you a DPA.

If you are still picking a tool, make data terms one of your selection criteria. Our guide to choosing an AI writing assistant for your business covers the other criteria.

What to check in the data terms before you paste anything

Use this checklist for ChatGPT or any other AI tool. Answer each question from the vendor's own pages, not from blog posts or forum threads (including this one).

1. Training: Is my content used to train models on this plan? Is that on or off by default? Where is the setting?
2. Retention: How long are chats, uploaded files and deleted chats kept? Are there exceptions, such as legal holds or safety reviews?
3. DPA: Is a data processing agreement available, and does it cover my specific plan?
4. Sub-processors: Which other companies process the data on the vendor's behalf? Is the list published?
5. Location: Where is data stored and processed? Are data residency options available, and on which plans?
6. Certifications: What security reports or certifications are published, and where (for example, a trust portal)?
7. Admin controls: Can I manage users, see audit logs, and disable features such as connectors, memory or shared links?
8. Deletion: How do I delete data or a whole account? What happens to backups?
9. Regulated sectors: Is a HIPAA business associate agreement (BAA), or your sector's equivalent, offered, and on which products only?

Record what you found. Note the date you checked, and save a copy or screenshot of the relevant pages. Terms change, and a dated record shows you did your due diligence.

Your responsibilities as the business holding the data

It's natural to ask 'is OpenAI safe?'. The more useful question is 'am I allowed to do this?', because the legal responsibility usually sits with you.

• Controller and processor. Under GDPR and UK GDPR, your business is usually the controller: you decide why and how customer data is used. An AI provider you use on your behalf is usually a processor. Article 28 of the GDPR requires a written contract with processors, which is what a DPA provides. You also need a lawful basis for the processing and must be transparent with customers.
• Your privacy notice. Does it say you share personal data with cloud or AI service providers? If not, update it before using real customer data.
• Client contracts and NDAs. Some clients explicitly forbid sending their data to third-party AI tools. Check before you paste, especially for B2B work.
• Other regimes. Depending on where you and your customers are: US state privacy laws such as the CCPA/CPRA in California, HIPAA for US healthcare data, and PCI DSS for payment card data. Check which apply to you.
• International transfers. Data may be processed outside your country. The DPA should state the transfer mechanism used, such as standard contractual clauses or the UK equivalent.

For authoritative detail, the UK ICO publishes guidance on AI and data protection, and the full GDPR text is on EUR-Lex. For anything amber or red, talk to your data protection officer or a lawyer.

How to anonymise customer data before using ChatGPT

You can do this today with nothing more than a text editor. For a short email it takes a few minutes.

Step 1: Ask whether the AI needs the personal detail at all

Usually it doesn't. To rewrite a reply, summarise a complaint or suggest a fix, the AI needs the situation, not the identity. Start by removing anything the task doesn't depend on.

Step 2: Replace identifiers with placeholders

Use clear, consistent placeholders:

• [CUSTOMER_NAME]
• [ORDER_ID]
• [CITY]
• [EMAIL], [PHONE], [PRODUCT]

Keep the mapping (which placeholder means which real value) only on your own system. When the AI returns a draft, swap the real values back in yourself.

Step 3: Generalise rather than delete when context matters

• Exact age (47) becomes an age range (45 to 54).
• Full address becomes a region ('North of England').
• Exact amount (£1,284.50) becomes a range ('just over £1,000').
• Exact date becomes a period ('last week').

Step 4: Remove indirect identifiers

Rare job titles, unusual events, long customer histories and combinations of details can identify someone even without a name. 'A six-year customer in a small village who runs the only vet practice' is not anonymous.

Step 5: For spreadsheets, cut columns before upload

Delete or mask identifier columns (name, email, phone, address, customer ID) before uploading. Then upload only the columns the task needs. If you need to analyse refund patterns, you probably need product, date range and refund reason, not who asked.

If you need to tell rows apart, you can replace a customer ID with a random code or a hashed value. That still counts as pseudonymisation (see below), not anonymisation.

Pseudonymised is not the same as anonymised

This distinction matters legally:

• Pseudonymised data has identifiers replaced, but can be re-identified using extra information you hold (like your placeholder mapping). Under GDPR it is still personal data.
• Anonymised data cannot reasonably be linked back to a person by anyone. It falls outside GDPR.

Placeholders lower the risk a lot, but if you keep the mapping, treat the result as pseudonymised. That means the plan and terms checks above still apply to amber data.

Worked example: a customer complaint email

Before (do not paste this):

Hi, this is Sarah Thompson (sarah.t@example.com). Order #48213 for the cooling travel case arrived at my flat in Leeds four days late. I'm type 1 diabetic and needed it to keep my insulin cold on a trip, so I had to buy another one at the airport for £39. I've been a customer for six years and this isn't good enough. Sarah, 07700 900123

This contains a name, email, phone number, order number, city, a purchase amount, a customer history and a health detail (special category data).

After (minimised and placeholdered):

Hi, this is [CUSTOMER_NAME]. Order [ORDER_ID] for [PRODUCT] arrived at my home in [CITY] four days late. I needed it for a time-sensitive personal reason during a trip, so I had to buy a replacement elsewhere for about £40. I'm a long-standing customer and this isn't good enough.

What changed:

• The email and phone number are gone because the reply doesn't need them.
• The name, order number, product and city are placeholders you fill back in later.
• The diabetes and insulin detail is generalised to 'time-sensitive personal reason'. The AI can still write an empathetic reply without knowing the medical condition.
• The exact amount becomes 'about £40' and the six-year history becomes 'long-standing'.

Sample prompt:

You are helping a small online shop reply to a customer complaint. Draft a short, warm, professional reply to the email below. Apologise for the late delivery, acknowledge that it caused real inconvenience, and offer to refund the replacement cost on receipt. Keep the placeholders in square brackets exactly as written. Do not invent details.

[paste the cleaned email]

You then add the real name and order number before sending, and if the reply should acknowledge the medical reason, you write that line yourself. For more on structuring prompts like this, see our guide to writing AI prompts for business emails.

Know the limits

Find-and-replace misses things: a name in a signature, a nickname, an email address inside a forwarded thread. Re-read the whole text before pasting. Free-text fields such as 'notes' or 'comments' in spreadsheets and CRMs are where personal data most often hides.

Settings to review on any plan

Menu labels and locations change, so treat this as a list of things to find, not a set of exact clicks. OpenAI's Help Center has the current instructions.

• Data controls and model training. Find the setting that governs whether your content may be used to improve models, and confirm its current state yourself.
• Temporary or incognito-style chats. These typically keep a chat out of your history. They may still be retained for a period, for example for safety review, so check the Help Center for what they do and don't change.
• Memory and custom instructions. Review what is stored about you and, more importantly, about your customers. Delete anything that shouldn't be there.
• Shared links. Audit old shared conversations and delete any that contain client work.
• Connectors and integrations. If email, drive or calendar connectors are enabled, only keep what you actually need.
• Account security. Turn on two-factor authentication. Don't share logins. Remove access the day someone leaves.

When not to use ChatGPT at all

Some cases are a clear no, whatever the plan.

Never paste

• Passwords, API keys or other login credentials
• Payment card numbers (PCI DSS rules apply to card data)
• Bank login details or full bank account details
• Full government ID numbers: passport, driving licence, National Insurance, Social Security

Don't use AI for this, unless explicitly covered

• Health, legal-case, children's or other special category data, unless you have a business agreement, a legal basis and sector compliance that explicitly cover it.
• Data a client contract or NDA forbids you to share with third parties.
• Data collected under a privacy notice that doesn't allow this use.
• High-stakes decisions about individuals, such as credit, hiring or eligibility. Accuracy, fairness and legal duties around automated decision-making (including Article 22 of the GDPR) apply.
• Tasks where anonymising would remove the very information the task needs. That's a sign the work should stay in-house or move to a properly contracted system.
• Any situation where you can't verify the plan's terms, such as staff using personal accounts. This is often called 'shadow AI', and it is a common blind spot because the business has no control over those accounts' settings or terms.

A one-page AI data policy for your team

Copy this, replace the bracketed parts, and keep it to one page. If you want a fuller version with an approved-tools register and a rollout plan, use our AI acceptable use policy template for small businesses.

[Business name] AI Data Policy Owner: [name]. Last reviewed: [date]. Next review: [date].

1. Approved tools

• Approved for customer data: [tool and plan, e.g. 'ChatGPT, our business workspace only'].
• Personal AI accounts (free or paid) must never be used for customer or client data.

2. What you can paste

• 🟢 Green (generic questions, fully anonymised text): any approved tool.
• 🟠 Amber (names, emails, order histories, support tickets): approved business plan only, after removing or replacing identifiers with placeholders such as [CUSTOMER_NAME] and [ORDER_ID].
• 🔴 Red (health, card or bank details, ID numbers, passwords, children's data, data under NDA): never, unless [owner] has approved it in writing after professional advice.

3. Required settings and security

• Two-factor authentication on.
• Training and data settings checked by [owner] on [date].
• No shared links for client work.
• Connectors only enabled with approval.

4. Before you paste, ask

• Does the AI need this detail to do the task?
• Would I email this to an outside contractor without a contract?

5. Questions and mistakes

• Ask [name/channel] if you're unsure.
• If you paste something you shouldn't have, tell [name] the same day. Reporting quickly is what matters. You won't be blamed for reporting.

6. Review

• [Owner] re-checks vendor terms every quarter and whenever we change plan or tool.

If someone already pasted sensitive customer data

It happens. A calm, quick response matters more than the mistake itself.

1. Don't panic, and don't hide it. Write down what was shared, when, on which account and which plan.
2. Delete the conversation and any shared links, and check memory for stored details. Deletion may not be immediate on the vendor's side, so check the retention terms for that plan.
3. Check which terms applied. Was it a business account with a DPA, or a personal consumer account? This affects how serious it is.
4. Assess whether it's a personal data breach. Under GDPR and UK GDPR (Article 33), a personal data breach must be reported to the regulator without undue delay and, where feasible, within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to people's rights and freedoms. If the risk is high, you may also need to tell the affected people (Article 34). Get advice from your DPO or a lawyer quickly so you don't miss the window.
5. Contact the vendor if needed. Use the privacy contact route listed in OpenAI's privacy policy.
6. Fix the cause. Update the policy, brief the team and move everyone to an approved plan.

The same questions apply to other AI tools

Nothing in this framework is specific to ChatGPT. Claude, Gemini, Microsoft Copilot and other assistants each have their own consumer and business terms, and the same split usually applies: personal plans on one set of terms, business plans on another. Run the same checklist on each.

Don't forget AI features built into tools you already use. Email clients, CRMs, helpdesks and document editors increasingly include AI assistants that may process customer data too. Check their terms and settings just as you would a standalone chatbot.

If you're comparing tools, add the data-terms checklist above to your evaluation. Our guide on how to choose an AI writing assistant for a small business includes a 5-day trial plan. Make 'check the data terms and settings' part of day one, before any real customer data goes in.