Is ChatGPT (or Copilot, Gemini, Claude) GDPR compliant for a UK small business?

Short answer: no AI tool is "GDPR compliant" on its own. UK GDPR applies to how your firm uses it. You can use ChatGPT, Copilot, Gemini or Claude lawfully with personal data if you use a business plan with a data processing agreement, have a lawful basis, assess the risk (a DPIA), tell people in your privacy notice, and keep a person reviewing anything that matters. Government guidance is clear that personally identifiable information should not go into free or online tools.

Does UK GDPR apply to a small firm?

Yes. The ICO is clear that data protection law covers organisations of all sizes, "from sole traders and people who work for themselves through to large global corporations", and most small firms hold customer and staff details (ICO, data protection advice for small organisations, checked 21 Oct 2026).

What does the ICO say about using ChatGPT?

In advice it released to a business that wanted to use ChatGPT to draft responses to client enquiries, the ICO said the business would need to:

work out whether OpenAI acts as a controller or processor for that data;
identify a lawful basis, and if relying on legitimate interests, complete a legitimate interests assessment;
meet an extra Article 9 condition for special category data such as health information;
update its privacy notice with a detailed explanation of its use of ChatGPT, noting that a privacy notice alone is not valid consent;
respect the restrictions on solely automated decisions with legal or similarly significant effects.

(ICO advice, released document, checked 21 Oct 2026). The ICO's wider AI guidance adds that you must choose and document a lawful basis before you start, and can't swap it later without good reason (ICO, how do we ensure lawfulness in AI?).

Free versus business plans

The Department of Health and Social Care's guidance for care providers puts it plainly: "If you're using a free or online tool, you should not use personally identifiable information because you would be providing confidential information to a third party" (DHSC, Using AI in adult social care). For business plans, check what the supplier's terms say about training on your data and data processing.

Tool	What to use for work with personal data	What to check
Microsoft 365 Copilot	Work accounts with enterprise data protection. Microsoft says prompts and responses stay within the Microsoft 365 service boundary, its Data Protection Addendum applies, and they are not used to train the underlying models (Microsoft)	File permissions, prompt retention, who has a licence
Gemini in Google Workspace	A paid Workspace business plan; Google lists enterprise-grade security and privacy for Gemini on these plans (Google)	Admin settings, whether your plan includes data regions, sharing permissions
Claude	Anthropic's commercial services. Its Commercial Terms say Anthropic may not train models on customer content and that data is processed under Anthropic's Data Processing Addendum (Anthropic Commercial Terms)	Which terms your account is on, retention

For ChatGPT, read the OpenAI terms that apply to your account, including how your data is used and processed, before using it with personal data.

A one-page AI checklist for a small firm

Approved tools list: which AI tools and accounts staff may use for work.
Never-paste list: health data, bank details, anything about children, and client data in free tools.
Lawful basis recorded for each use that involves personal data.
DPIA where personal data is involved, especially special category data.
Privacy notice updated to say how AI is used.
Human review: a named person checks output before it is sent or acted on.
Training so staff know the rules.

When to bring in a specialist

If you process special category data at scale, make decisions about people with AI, or work in a regulated sector, speak to your DPO or a data protection solicitor. For care providers, see what DHSC and CQC expect. Our AIOS service helps you put the basics in place and set AI up properly. It is not legal advice.

How we approach it

On our five-stage AI maturity scale, a process only scores 4 (Agent-assisted) or 5 (Agentic) once an AI policy, a DPIA where personal data is involved, and human review are in place. GK Healthcare, a UK recruitment company, cut its Director of Finance's reconciliation from about two days a week to one 30-minute weekly run, with the Director of Finance still checking every output (case study).

The £450 Payback Check is a two-hour session that looks at how your team uses AI today and scores one real process, with a written report and a fixed quote. The £450 is credited if you book a build within 30 days.

FAQ

Is ChatGPT GDPR compliant?

No AI tool is compliant on its own. UK GDPR applies to how your firm uses it. A business plan with a data processing agreement, a lawful basis, a DPIA, an updated privacy notice and human review are the basics.

Can staff put customer data into the free version of ChatGPT?

They should not. DHSC guidance for care providers says that if you are using a free or online tool, you should not use personally identifiable information, because you would be providing confidential information to a third party.

Do we need a DPIA to use AI?

Where personal data is involved, especially health or other special category data, a DPIA is the sensible starting point. The ICO says you should decide and document your lawful basis before you start processing.

Do we need to update our privacy notice?

Yes, if you use AI with personal data. The ICO said a business using ChatGPT must update its privacy policy with a detailed explanation of that use.

What does Microsoft say about Copilot and GDPR?

Microsoft says that with enterprise data protection, Copilot prompts and responses stay within the Microsoft 365 service boundary, its commitments including GDPR support and the Microsoft Data Protection Addendum apply, and prompts are not used to train the underlying models.

Get your score

£450 Payback Check. Credited if you book a build within 30 days.