Is ChatGPT GDPR Compliant? UK GDPR FAQ for SME Owners and DPOs

Yes, using ChatGPT can comply with UK GDPR, but only under conditions. Compliance depends on whether personal data enters the prompt, whether your tier and contract prevent inputs training the model and whether you have identified a lawful basis and told people about the processing.

Vendor terms change regularly, so confirm the current wording for your tier before relying on it. The answers below are plain-language, aligned to ICO expectations and written for SME owners, data protection officers and IT leads. They are general guidance rather than legal advice; take professional advice on your own circumstances.

Is using ChatGPT GDPR compliant?

ChatGPT use can comply with UK GDPR, but compliance turns on the pattern of use rather than the tool itself. The failing pattern is familiar: staff paste customer emails, CVs, clinical notes or contract clauses into a personal account, no contract exists between the organisation and the provider and nobody has recorded the processing anywhere, which is unlawful processing and potentially a reportable incident.

The compliant patterns are narrower: either keep personal data out of prompts entirely and use the tool for drafting, summarising public material and writing code or move to a business tier with a data processing agreement, retention controls and model training switched off. If you take the second route, document your lawful basis, update your privacy notice and hold the decision inside your AI governance framework rather than leaving it with individual users.

Can we put personal data into ChatGPT at all?

You can put personal data into ChatGPT only where the processing is lawful and the tool is contracted properly, because personal data in a prompt is processing like any other. That means a lawful basis, a purpose people would reasonably expect, a processor agreement with the provider, clarity on storage and transfers, a retention limit and a defensible answer when a data subject asks what happened to their information.

Consumer tiers rarely support that set of requirements, while business and enterprise tiers usually do, subject to their current terms. Special category data such as health records, biometrics or trade union membership raises the bar again, as does children’s data, so complete a data protection impact assessment before deployment rather than after the first incident. Where the data is already in your systems, our answer on using AI on customer data you already hold covers the purpose-compatibility test.

What is the difference between the consumer tier and the business tier?

Three differences carry the compliance weight for ChatGPT tiers. Training on inputs comes first: consumer tiers have historically used conversations to improve models unless a user changes a setting, while business tiers typically exclude business data from training by default. Contractual role comes second: a business agreement names the provider as your processor and sets out security measures, sub-processors, international transfers and breach notification, none of which a personal account gives you in your own name.

Administrative control comes third, since business tiers offer central user management, retention configuration and audit logging. Verify the current tier terms directly rather than relying on employees to make data protection decisions in a chat window.

Which lawful basis covers feeding data into an AI tool?

Legitimate interests is usually the workable lawful basis for feeding data into an AI tool, with contract applying in some cases and consent rarely suitable. For internal productivity uses such as drafting or summarising, support legitimate interests with an assessment recording the purpose, the necessity test and the balance against people’s rights and reasonable expectations.

Where the AI processing forms part of delivering a service someone has bought, contract may apply; consent is a poor fit for staff-facing tools because employees cannot refuse freely, and a poor fit for customers where the processing is not optional. If the output influences a decision about someone, such as recruitment shortlisting or credit assessment, review the rules on automated decision-making and profiling before proceeding.

Do we need a DPIA before rolling out ChatGPT?

A DPIA is mandatory where processing is likely to result in high risk to individuals, and the ICO treats new technology, large-scale processing and evaluation or scoring of people as risk indicators, so a general-purpose AI tool handling client information across a whole workforce usually meets at least one. Where it is not strictly required, the assessment remains the cheapest way to produce the evidence a regulator, insurer or enterprise customer will ask for.

Cover the data categories involved, the tier and contract, transfers outside the UK, retention, human review of outputs and the controls limiting what staff can paste in. Our AI risk assessment entry sets out how that analysis is structured.

Is staff using ChatGPT without approval a data protection breach?

Unapproved staff use of ChatGPT can amount to a personal data breach. This pattern, commonly called Shadow AI, becomes a breach when identifiable information leaves your control without a lawful basis or a processor agreement, so a client list pasted into a personal account is an unauthorised disclosure that you assess for reportability like any other incident.

Many organisations cannot say which tools staff use, with what data, on which accounts, so start with discovery through network and expense data, then publish a short acceptable use standard naming approved tools and prohibited data types. Provide a sanctioned tier as well, because prohibition without provision pushes usage onto personal devices. Our Shadow AI discovery FAQ covers the discovery steps and our Shadow AI Discovery service runs them for you. If you have no written rules at all yet, start with do we need an AI policy.

Are AI outputs personal data?

AI outputs are personal data when they relate to an identifiable person, so a generated summary of a customer complaint, an AI-drafted performance note or an inferred characteristic about a named individual all count. Inaccurate outputs about a real person engage the accuracy principle and the right to rectification. Where outputs are saved into case notes, CRM records or HR files, they inherit the retention rules and subject access obligations of those records.

Two controls handle most of the exposure: human review before any AI-generated content about a person is acted on, and a marker showing which content was AI-assisted so it can be located and corrected later.

What does the ICO expect a smaller organisation to have in place?

The ICO expects a smaller organisation to hold proportionate documentation rather than a compliance programme built for a bank. In practice that means an approved tool list with tiers and contracts, an acceptable use standard staff have actually read, records of processing updated to include AI tools, a lawful basis assessment, a DPIA where required, transparency in your privacy notice and a route for reporting incidents involving AI tools.

Regulators look for demonstrable decisions rather than perfection, so an organisation that assessed the risk, chose controls and wrote it down is in a defensible position, while one that discovered its exposure through a complaint is not. An AI Security Gap Analysis is designed to build that documentation set with you, typically covering tool inventory, risk assessment, control gaps and a prioritised remediation plan.

Does the EU AI Act change this for UK organisations?

The EU AI Act adds obligations for UK organisations rather than replacing UK GDPR: data protection law governs how you handle personal data, while the EU AI Act governs how AI systems are built, deployed and monitored by risk category. It reaches UK organisations that place systems on the EU market or whose outputs are used there, and its transparency duties around AI interaction and AI literacy for staff apply to many general-purpose deployments.

Most of the groundwork overlaps, since both regimes want an inventory of AI use, risk classification, human oversight and documentation, so building once against ISO 42001 can support compliance work under both without guaranteeing either. See whether the EU AI Act applies to your UK business and our EU AI Act preparedness guide for the wider position, including the deferred high-risk deadlines of 2 December 2027 and 2 August 2028.