AI tools have transformed the way UK businesses work. ChatGPT for content drafts. Claude for analysis. Copilot for code. Notion AI for note-taking. Productivity has rocketed. So have data risks.
Most UK SMEs we audit have given zero thought to what happens to the information they paste into these tools. Free tier prompts can train future models. Client information uploaded for analysis becomes part of someone else's training data. Confidential financials, draft contracts, customer emails. All potentially exposed.
The Information Commissioner's Office (ICO) updated its AI guidance in late 2025 specifically because UK businesses were leaking sensitive data through everyday AI use. This guide covers the practical rules to follow.
The Problem in Plain English
When you paste content into a free or consumer AI tool, three things can happen:
- Your input is logged by the provider for service improvement.
- Your input may train future models. This is the key risk for sensitive data.
- Your input may be reviewed by humans. Quality reviews, abuse detection, compliance checks.
For most personal queries, this is fine. For client confidential information, financial data, draft contracts, internal strategy or anything covered by a Non-Disclosure Agreement, it's a serious problem.
The UK GDPR treats this as data processing. If you share personal data of customers or employees with an AI provider without proper safeguards, you've potentially breached your obligations. ICO fines for serious breaches can reach £17.5 million or 4% of global turnover.
What Data Are You Actually Sharing?
Audit your current AI use. Common scenarios that create risk:
- Pasting a client email into ChatGPT to draft a reply.
- Uploading a financial spreadsheet to Claude for analysis.
- Sharing meeting notes (with named attendees) for summarisation.
- Asking AI to review a draft contract.
- Using AI to write a job description that includes salary bands and internal hierarchy.
- Generating customer-facing content that references real client names without permission.
Each of these involves processing personal or confidential data through a third party. Each requires consideration under UK GDPR.
Free Tier vs Enterprise: The Critical Difference
The single most important distinction is consumer vs business plans:
Free tiers (ChatGPT Free, Claude Free, Gemini Free): - Inputs typically used for training. - No data processing agreement (DPA) with you. - No control over data location. - Not GDPR-safe for anything sensitive.
Plus/Pro consumer tiers: - Some data protection improvements. - Often still no DPA available. - Better than free, not enterprise-grade.
Enterprise tiers (ChatGPT Enterprise, Claude for Work, Microsoft Copilot Enterprise): - DPA available and signed. - Inputs not used for training. - Data residency options (EU servers). - Audit logs available. - SOC 2 / ISO 27001 certified. - GDPR-safe with proper setup.
If you're using AI for anything beyond personal queries, the upgrade to enterprise is non-negotiable. ChatGPT Enterprise costs around £25-£30 per user per month. Claude for Work is similar. Microsoft Copilot Enterprise is bundled with Microsoft 365 Business Premium plus a small add-on.
The 8 Practical Rules
1. Use Enterprise or Team Tiers for Anything Sensitive
If your business handles client data, financial information or contracts, free tiers are off-limits. Pay for the enterprise version of whichever tools you use.
2. Sign a Data Processing Agreement (DPA)
Under UK GDPR, you need a DPA with any third-party that processes personal data on your behalf. Enterprise AI providers offer this. Free tiers do not.
3. Anonymise Before Pasting
Even with enterprise tools, build the habit. Replace names with [Client Name], strip account numbers, redact addresses. Reduces risk if anything goes wrong.
4. Disable Training Where Possible
Most enterprise AI tools let you opt out of having your data used for model training. Check settings and confirm it's disabled.
5. Set Internal AI Policy
Document what staff can and can't paste into AI tools. Common rules: no client confidential data into free tiers, no salary or HR data anywhere, no draft legal documents without legal review.
6. Use UK or EU Data Residency
Where the AI provider offers it (Microsoft Copilot does, OpenAI Enterprise does for some customers), choose UK or EU data residency. Reduces complications around international data transfers.
7. Audit AI Tool Use Quarterly
Most companies don't know which AI tools their staff are using. Run a quarterly survey. Identify shadow IT (AI tools nobody approved). Replace with sanctioned alternatives.
8. Train Your Team
Most AI data leaks happen because someone didn't know better. A 30-minute training session covering what's safe to paste, what's not, and how to anonymise prevents most issues.
Vendor Choice: A Quick UK SME Guide
For most UK SMEs in 2026:
- Microsoft Copilot Enterprise: Best for businesses already on Microsoft 365. Tight integration, EU data residency, GDPR-friendly.
- ChatGPT Enterprise/Team: Most powerful general-purpose option. £25/user/month for Team.
- Claude for Work: Strong on writing and analysis. Anthropic's privacy posture is generally favourable.
- Google Gemini for Workspace: Good if you're on Google Workspace. Enterprise data protections improving.
Pick one as your default rather than letting staff choose individually. Reduces vendor sprawl and security gaps.
Compliance Checklist
Before approving an AI tool for company use:
- Enterprise/Team tier (not free or consumer)
- Signed DPA in place
- Inputs not used for model training (confirmed in writing)
- EU/UK data residency option used
- SOC 2 or ISO 27001 certified
- Internal AI policy published and trained
- Staff aware of what data is and isn't acceptable
- Listed in your record of processing activities (ROPA) under UK GDPR
Common Mistakes UK SMEs Make
- Letting staff use free ChatGPT for client work. Number one risk we see in audits.
- No internal AI policy. Without it, every employee makes their own (often risky) decisions.
- Pasting financial spreadsheets to summarise. This is exactly the kind of thing GDPR exists to protect.
- Using AI to draft client emails without redacting names. Easily fixed with a quick anonymise habit.
- Assuming "private mode" means private. Some tools' private mode still logs server-side. Check the small print.
For more on the broader trust angle, our guide on using AI without damaging your brand trust covers customer-facing risks.
Frequently Asked Questions
Is it safe to use ChatGPT for my business? The free tier, no, for anything sensitive. ChatGPT Enterprise or Team, yes, with proper setup (DPA, training disabled, internal policy).
What's the cheapest GDPR-safe option? If you're already on Microsoft 365 Business Premium, Copilot is the lowest incremental cost. Otherwise ChatGPT Team at £25/user/month.
Do I need to tell customers we use AI tools? If AI processes their personal data, your privacy policy should disclose it. You don't need explicit consent for productivity tools, but transparency builds trust.
What's the biggest risk? Staff pasting client confidential information into free AI tools, where it can be used to train future models accessible to anyone.
How often should I audit AI tool use? Quarterly. Tools change quickly. New ones appear. Settings get updated.
The Bottom Line
AI tools used carelessly can leak the most valuable thing your business owns: trust. Used carefully, they remain a productivity multiplier without the risk. The difference is enterprise-tier subscriptions, signed DPAs, internal policy and team training.
If you want help building an AI policy and tool stack that protects your business, get in touch. We help UK SMEs implement secure AI workflows as part of our AI and technology services.
