The short answer
It depends on your firm, not on the tool. Where the information identifies a living person, your practice is the controller and the tool is processing on your behalf. Article 28 of the UK GDPR requires that arrangement to be governed by a written contract containing specified terms. An ordinary personal account is not that contract, so the question is settled before anyone reaches the privacy policy.
Key takeaways
- The deciding fact is a contract your practice either holds or does not, which takes minutes to check and does not change when a vendor updates its terms.
- A consumer sign-up does not meet Article 28. Business agreements may, which is a thing to verify in writing rather than infer from a product page.
- Deleting a name is not anonymising. The test is whether anyone could work out who the information is about from what is left.
- Article 35 puts the assessment duty on your firm, before processing begins, and no supplier invoice discharges it.
- A use that nobody has written down cannot be reviewed or withdrawn cleanly when a client asks what happened to their information.
The usual way this gets researched is a partner reading a vendor privacy page and settling the matter on whether it reads as reassuring. It is the wrong document. Whether a British practice may put client information into a general purpose tool is not primarily a question about the tool's security, and reading harder about the technology will not answer it.
It is a question about which of two roles your firm is in, and what the law then requires to exist on paper before anything is pasted. That has the useful property of being checkable today, in your own files, without waiting for anyone to answer a security questionnaire.
What a practice can and cannot paste
Sort what you were about to paste by whether anyone could work out who it is about, rather than by how sensitive it feels, because that is the sort the law actually runs on. The rows below are the ones that come up in accountancy practices and advisory firms, in roughly the order partners raise them.
- A client's trial balance with the business named
- Not without a contractIdentifies a client, so the tool is processing on your behalf
- A candidate CV or an employee file
- Not without a contractPersonal data about a living person, and rarely yours to move
- Figures with the name deleted but the sector, county and year left in
- Usually still personal dataRe-identifiable by anyone who knows the market
- A letter you are drafting, with the recipient removed
- JudgementDepends entirely on whether the facts narrow it to one client
- Your own firm's marketing copy or internal template
- FineNo client, no personal data, no controller question
- A question about how a rule works, with no figures at all
- FineThis is most of what people actually want it for
Why the contract decides it, and not the technology
Article 28 of the UK GDPR says processing by a processor must be governed by a contract that binds it to act only on documented instructions, and that sets out the subject matter, duration, nature and purpose of the processing. The Information Commissioner's Office sets out what that contract has to contain. Read the requirement and the consequence falls out: a personal account opened with an email address is not a contract of that kind, and no setting inside the product turns it into one.
This is why the question is more stable than it looks. Vendors change retention defaults and training settings, and a verdict written on those is out of date within months. The contract test survives all of it, because it asks what your practice holds rather than what the supplier is currently doing.
Removing the name is not the same as anonymising
The test is whether a person could work out who the information is about from what remains, which is a considerably higher bar than deleting the obvious identifiers. Practices reach for redaction because it feels like the responsible move, and for genuinely aggregated figures it is. The failure case is narrow context: one county and one unusual number. Anyone who works in that market reads straight through it.
The workable habit is to ask the question out loud before pasting. If the honest answer is that a competitor could probably name the client from the paragraph, it is personal data and the contract question applies to it.
Before you buy anything to fix this
Not sure whether you need a supplier or a policy?
Free to your firm. The agency pays us, and only if the relationship works, which is why we would rather tell you that this is a half day of partner time than introduce somebody to sell you a platform.
Get a recommendationThe four things that have to exist first
Four documents or decisions have to be in place before client information goes into any external tool, and every one of them lands on the practice rather than on the vendor.
- A processor contract that actually says so. Article 28 sets out what it must contain. A subscription confirmation is not it, and neither is a page describing how seriously security is taken
- An assessment, dated before the processing started. Article 35 puts that on the controller. The Information Commissioner's Office lists nine indicators of likely high risk and says a combination of two usually means one is needed
- An entry in the record of processing activities. Article 30 requires the purposes, the categories of personal data and of data subjects, the recipients and the retention periods. A use missing from that record cannot be answered on when a client asks
- A decision taken when the means were chosen, not afterwards. Article 25 attaches at the time the means of processing are determined, which is the day somebody decided the tool would be used, not the day it was rolled out
None of the four is expensive. All four are awkward to produce retrospectively, which is the practical argument for doing them before anyone starts rather than after a client asks. The same discipline of measuring and writing down what a process does before commissioning anything is what makes a brief worth quoting against.
What the vendor can carry, and what stays with you
A supplier can take on the security of the processing, but not the decision to process, and firms routinely buy the first believing they have bought the second.
The vendor can carry this
Buy it, check it, hold them to it in the contract.
- Technical and organisational security measures
- Acting only on your documented instructions
- Restrictions on engaging anyone further down the chain
- Returning or deleting the data when you say so
This stays with your practice
No invoice moves any of it. Every item is yours by law.
- Deciding the purpose, and whether to process at all
- The assessment, before processing begins
- The record of the activity, kept current
- Answering the client who asks what happened to their file
The distinction is the whole reason the buying decision goes wrong. A practice that treats this as a software purchase acquires a tool and keeps every obligation, which is the same mistake as assuming a supplier's expertise settles the order of work in a recruitment agency. The question of whether to buy a licence or hire somebody to build around it is a separate fork with its own test.
When a firm should not be pasting anything yet
Two conditions make the question premature, and neither is about which product you chose.
- Nobody can say which accounts staff are using. An instruction that cannot be checked is not a control, and a policy written over the top of it records an intention rather than a practice
- The activity is not in the record of processing. Until it is written down it cannot be reviewed or withdrawn cleanly, and the first time anyone reconstructs it will be under a deadline
Saying so costs us the introduction fee, because we are paid by the supplier and only when a relationship works. Where a supplier genuinely is needed, what we assess before recommending anyone, including the cases where we recommend nobody, is set out for professional services firms across the UK.
Frequently asked questions
What partners ask us before they write an AI policy.
Is it safe to put client data into ChatGPT?
Safety is decided by your firm's position rather than by the product. If the information identifies a living person, your practice is the controller and the tool is processing on your behalf, which under Article 28 of the UK GDPR requires a written contract containing specified terms. An ordinary personal account carries no such contract, so the processing is unauthorised before any question about the technology arises.
Does an ordinary ChatGPT account count as a data processor?
Not in the sense the law requires. Article 28 says processing by a processor must be governed by a contract that binds it to act only on documented instructions and sets out the subject matter, duration, nature and purpose of the processing. A consumer sign-up is not that contract. Business agreements may be, which is precisely the thing to check in writing rather than to assume from a marketing page.
Can we just remove the names before pasting client information?
Only if nobody could work out who it is about, which is a higher bar than deleting a name. A paragraph naming a turnover figure and a county often identifies one business to anyone who knows that market. Ask whether a person could re-identify the subject from what remains, and if the answer is that they probably could, treat it as personal data.
Do we need a data protection impact assessment before using an AI tool?
Often, and before processing begins rather than at go-live. Article 35 of the UK GDPR puts that duty on the controller, which is your firm. The Information Commissioner's Office lists nine indicators of likely high risk and says a combination of two usually means an assessment is needed. Using a technology new to the practice on client records will frequently meet two.
When should a firm stop staff using AI tools altogether?
When nobody can say which account is being used, because an instruction that cannot be checked is not a control. The other case is a practice that has not yet recorded the activity in its record of processing, since a use nobody has written down cannot be reviewed or withdrawn cleanly when a client asks what happened to their information.
Sources and useful reading
- Article 28, processor, for the requirement that processing be governed by a contract and for what that contract must set out.
- Information Commissioner's Office, what needs to be included in the contract, for the terms in practice.
- The same office, when do we need to do a DPIA, for Article 35 and the nine indicators of likely high risk.
- Article 30, records of processing activities, and Article 25, data protection by design and by default, for what must be recorded and when the obligation attaches.
This article is commercial decision support and is not legal or regulatory advice. It makes no claim about any named product's current terms or where data is held, neither of which were examined for this article and all of which change. It also makes no claim about professional confidentiality obligations, which sit under your own institute's code and are a separate question for your advisers. Whether any particular paste is lawful is a judgement for the practice.