Is it safe to use ChatGPT with client data? A UK SME checklist

Why this matters

Staff often start using AI tools because they are genuinely useful. The risk is that client names, financial details or confidential documents end up pasted into a personal account the business has never approved. This guide is general information, not legal advice. If you handle high-risk data, take specific advice.

The checklist

1. Use a business account, not personal ones

Business plans such as ChatGPT Business, Microsoft 365 Copilot, Google Workspace with Gemini and Claude Team are designed for organisations. The suppliers state they do not train their models on your business data by default, and they give you central admin controls, including the ability to remove access when someone leaves.

2. Check the supplier's data terms

Before using a tool with personal data, find out:

• Where data is stored and processed.
• How long it is retained.
• Whether it is used to train models.
• What their data processing terms say.

If the supplier processes personal data for you, UK GDPR requires a written data processing agreement with them, so make sure one is in place. Record the supplier as a processor in your records.

3. Decide what can and cannot be entered

Be specific. For example:

• Allowed: drafting generic letters, summarising your own internal notes, analysing anonymised figures.
• Only in approved tools: client correspondence, documents containing personal data.
• Never: special category data (such as health information), passwords, bank details, or anything a client has asked you to keep strictly confidential, unless specifically approved.

4. Minimise the data

Remove names and identifying details where the task does not need them. The ICO points out that personal data processed incidentally still counts as personal data, so "we were only summarising" is not an exemption.

5. Keep a person responsible for the output

AI can be wrong, confidently. Anything that goes to a client, informs advice or affects a decision should be checked by someone qualified to spot mistakes. In accountancy and legal work, professional review must never be bypassed.

6. Carry out a data protection impact assessment

The ICO says that in the vast majority of cases, using AI with personal data is likely to be high risk, which means a data protection impact assessment is required. If you decide one is not needed, record why. Do it before you start, not after.

7. Update your privacy information

If AI tools process client personal data, your privacy notice may need to say so.

8. Write it down and tell the team

A one-page policy that people actually read beats a long document nobody opens. Review it every six months, because tools and terms change.

For accountants and law firms

Professional obligations of confidentiality sit on top of data protection law. Start with uses outside the core professional judgement, such as information collection, reminders and drafting routine correspondence, and keep supervision explicit. Our pages on AI for accountancy practices and AI for small legal firms explain where the safer early gains usually are.

Need a second pair of eyes?

The FiveW Business Review includes data safety and supplier dependency in every recommendation, so you can adopt AI where it helps without creating a problem you discover later.