It happens in most offices now. Someone has a messy spreadsheet, a long email thread or a contract they need to understand quickly, so they paste it into ChatGPT or another AI chat tool and ask for a summary. Often the answer is genuinely useful. The question is what happened to the information on the way.
The honest answer is that it depends, mostly on which version of the tool you are using and what you pasted in. This guide sets out the general picture, the practical rules that keep you on the right side of it, and where a different approach makes more sense. If you are new to AI at work, our plain guide to AI for small businesses is a good place to start.
What people are pasting in
When we ask clients how their teams use AI chat tools, the same things come up again and again:
- Customer lists, to tidy up, de-duplicate or segment for a mailing.
- Financials, such as sales exports, cash flow sheets or management accounts, to spot trends.
- HR issues, like a draft disciplinary letter or notes from a difficult conversation with a named employee.
- Contracts, to get a plain English summary or check a clause.
- Emails, often whole threads with a customer's name, address and order history, to draft a reply.
None of these are unreasonable things to want help with. But several of them contain personal data about people who never agreed to it being shared, and some contain commercially sensitive information you would not hand to a stranger.
Consumer accounts and business accounts are not the same
This is the single most useful thing to understand. At the time of writing, the popular AI chat tools broadly come in two kinds:
- Consumer and personal accounts. This covers free plans and individual paid plans. These may use your conversations to help improve the provider's models, unless you switch that off in your settings.
- Business offerings. Team and enterprise plans, and access through the provider's API, generally do not use your data for training by default.
So a member of staff pasting a customer list into their own free account is in a very different position from the same person using a business plan the company has set up. Terms differ between providers and they do change, so check the current terms and settings for whichever tool your team actually uses rather than relying on what you read a year ago.
The risk is not "AI" in general. It is which version of the tool you are using, how it is set up, and what you paste into it.
Why personal data matters under UK GDPR
If your business holds information about customers, staff or suppliers, you are responsible for where it goes. Under UK GDPR, that includes deciding which services it is shared with and making sure those services handle it appropriately. Pasting a customer's details into a tool you have not checked, on an account the business does not control, makes that hard to do.
This is not legal advice, and the right approach depends on your business and the data involved. If you are unsure, the Information Commissioner's Office publishes guidance for small organisations, and it is worth speaking to someone qualified. The general principle is simple though: treat other people's information as something you are looking after, not something you own.
Practical rules for your team
You do not need to ban AI chat tools to use them sensibly. A handful of clear rules covers most of the risk:
- Use a business account for work. If your team uses AI chat tools regularly, set up a business or team plan so the company controls the settings and the terms.
- Keep personal and customer data out of personal accounts. No customer lists, staff details or client emails in anyone's own free or individual account.
- Strip names out. Often you only need the shape of the data. Replace names, emails and addresses with "Customer A" or a reference number before pasting, and the answer is usually just as good.
- Turn off chat history or training where available. Many tools let you opt out of your conversations being used to improve their models. Check the settings and switch it off on any account used for work.
- Think twice about commercially sensitive material. Pricing, margins, unsigned contracts and supplier terms deserve the same care as personal data, even if the law treats them differently.
- Write a simple staff policy. One page is enough: which tools are approved, which account to use, what must never be pasted in, and who to ask if in doubt.
A short policy does more than any setting, because most problems come from someone not knowing the rule rather than ignoring it.
The bigger point: one-off answers versus joined-up insight
Even when it is done safely, copying and pasting into a chatbot has a limit. You get a one-off answer about the snapshot you pasted in. Next week the data has moved on, so someone exports it again, pastes it again and asks again. The insight never builds up, and nothing connects your sales figures to your bookings or your customer notes.
The more useful version of AI for most businesses works the other way round. Instead of bringing your data to a chatbot, the AI is built into your own systems: it connects to your accounts, bookings or shop with read-only access, runs in a private workspace that only your business can see, and is never trained on your data. Because it is looking at live, joined-up information, it can tell you things that are actually actionable, such as which customers have gone quiet, which jobs are overdue or where cash is getting stuck, and keep telling you as things change.
That is how we build AI into client systems at Pixel & Shovel, including our own CRM, Jeanus. If you are weighing up any supplier who offers something similar, our guide on whether your data is safe with AI software has the questions to ask them.
So, should you put your business data into ChatGPT?
For general questions, drafting and ideas, AI chat tools are useful and most businesses will benefit from using them. For anything containing personal or customer data, use a business account with the right settings, strip out names where you can, and give your team a clear rule to follow. And if you find people pasting the same exports in every week, that is usually a sign the business would be better served by AI working directly and privately across its own systems.
Common questions
Does ChatGPT use what I paste in to train its models?
At the time of writing, consumer and personal accounts of popular AI chat tools, including free and individual paid plans, may use conversations to improve their models unless you switch this off in settings. Business offerings such as team and enterprise plans, and API access, generally do not train on your data by default. Terms change, so check the current terms and settings for the tool you use.
Is it against UK GDPR to paste customer data into an AI chatbot?
Not automatically, but you are responsible for where your customers' personal data goes and for making sure it is handled appropriately. Pasting it into an unchecked personal account makes that difficult. Use a business account with suitable terms, remove names where possible, and take qualified advice if you are unsure about your situation.
How can staff use AI chat tools safely at work?
Use a business account the company controls, keep personal and customer data out of personal accounts, replace names with references before pasting, turn off chat history or training where the option exists, and follow a simple written policy setting out which tools are approved and what must not be shared.
What is the alternative to copying data into a chatbot?
AI built into your own systems. It connects to your existing tools with read-only access, runs in a private workspace and is never trained on your data. Because it works from live, joined-up information, it gives ongoing, actionable insight rather than a one-off answer about a pasted snapshot.
If you would like AI that works across your own data privately, have a look at how we bring your systems into one view, or ask for a free concept and we will show you what it could look like before you commit to anything.
