Is it safe for a UK firm to put client data into ChatGPT?

OpenAI's Europe privacy policy, last updated on 24 August 2026, names two different companies as the controller of what people type into ChatGPT. Users in the European Economic Area or Switzerland get OpenAI Ireland Limited. Users anywhere else, which on the policy's own wording includes a user in the UK, get OpenAI OpCo, LLC in San Francisco. That sentence sits in section 12 of a page most partners will never open, and it answers more of the safety question than anything on the product page.

The question a managing partner is really asking is not whether the software is secure. It is who decides what happens to a client's file once somebody in the practice has pasted it in. On one kind of account that is OpenAI, under its own policy. On another it is the firm, under a contract. Both look almost identical on screen, which is why a partner often cannot tell which one their people are using.

The plan decides who controls what you paste

OpenAI's privacy policy states that it does not apply to content processed on behalf of customers of its business offerings. Those customers are governed by their own agreements instead. “On behalf of” is not casual wording. The Information Commissioner's Office defines a processor as a body that processes personal data on behalf of the controller, and a controller as the body that determines the purposes and means.

OpenAI's enterprise privacy page confirms which side of that line each account sits on. It will execute a data processing addendum for its business plans and its API, and it does not train on that data by default. A personal account has no addendum to sign. The privacy policy applies instead, and it says content may be used to train the models that power ChatGPT.

Paying for a personal subscription does not move an account across. A Plus account expensed by somebody at a UK practice is still, in OpenAI's own terms, a service for individuals.

What a firm can paste in, and where

Removing a client's name does not make a file anonymous. A turnover figure and a postcode can identify a client of a local practice as surely as a name does, so edited client work sits in the same band as the original.

Switching off training is not a business contract

On a personal account, turning off “Improve the model for everyone” stops OpenAI training on new conversations, and that is all it does. The controller does not change, and the privacy policy still governs the content. OpenAI's help centre adds a detail most people who have opted out do not know: if they rate a response with a thumbs up or down, the entire conversation associated with that feedback may be used to train its models.

Temporary Chat is narrower again. Those conversations stay out of history and out of training, which reduces exposure without creating a contract. A partner who hears “I turned training off” has been told something true that does not answer the question.

Your own rules already answer most of it

The ICAEW's generative AI guide tells members that confidentiality means not loading confidential information into public generative AI tools, even where it has become publicly available. The reason it gives is limited visibility over who the information is shared with and how long it is kept. Choosing a better plan improves both. It does not turn the question into one the software answers for you.

A recruitment agency has a statutory version of the same duty. Regulation 28 of the Conduct of Employment Agencies and Employment Businesses Regulations 2003 bars disclosing information about a work-seeker without prior consent, except for a short list of purposes led by providing work-finding services to that work-seeker. It belongs alongside the rules that decide what an agency should automate first, and it applies to a pasted CV as much as to a database.

Every firm then has one test it can run on itself in two minutes. Article 13(1)(e) of the UK GDPR requires the privacy information given to clients to name the recipients or categories of recipients of their personal data. Open the firm's own privacy notice. If no artificial intelligence provider appears in it, the people pasting client files are ahead of what the firm has told its clients.

The check to run before anyone pastes anything

Four questions settle where a firm stands, and none of them needs a supplier.

A business workspace answers the contract question. Whether the paid tier is worth it is a separate sum, and it turns on whether the assistant needs to read the firm's own files at all.

When a firm should not hire anyone for this yet

Two conditions make outside help premature.

• The only use is drafting from public material. That sits in the green row on any plan, and paying a specialist to configure it buys nothing
• Nobody has written down which client data may go where. A supplier will build a workspace around a policy that does not exist, so write the brief before anyone quotes for it

Where the assistant genuinely needs to work on client files, the job changes shape. Connecting it to practice systems and setting retention is configuration work, and it is worth doing properly. Saying so costs us the introduction fee when the answer is a setting, because we are paid by the agency and only when a relationship works. What we assess before recommending anyone is set out for professional services firms across the country.