Should staff use ChatGPT with memory switched on?

Part of the guide Does your UK business need an AI policy, and what goes in it?

What does ChatGPT memory keep?

When memory is on, ChatGPT can remember preferences and details from chats and other sources. OpenAI lists past chats, saved memories, custom instructions, files in Library and content from connected apps.

Saved memories are details a user asks ChatGPT to remember, or details ChatGPT saves itself as useful context. OpenAI also says sensitive information can appear in memory if a user shares it.

A study of 2,050 memory entries from 80 ChatGPT users found that ChatGPT created 96% of them. In the same study, 28% held personal data as the GDPR defines it. It covered 80 users, so it shows how memory can work, not how your own staff use it.

Who can switch ChatGPT memory off?

Each person can check memory in Settings, then Personalization, then Memory. In ChatGPT Business, any user can turn memory off there at any time.

Workspace owners decide whether memory is available across the whole Business workspace. If an owner turns it off, the saved memories of every member in that workspace are deleted.

Memories belong to each account. They cannot be passed to colleagues, even in the same Business workspace.

Some plans start with memory off. In ChatGPT for Healthcare and ChatGPT Enterprise with Regulated Workspace, improved memory is off by default. There, project-only memory can keep memory inside one project.

Does OpenAI train its models on work memories?

OpenAI says that by default, data in a ChatGPT Business workspace, including conversations and memories, is not used to train its models.

Staff who also use personal accounts should know one thing. If a member merges a personal workspace into Business, saved memories that apply across chats can move with it. The merge cannot be undone.

What does the UK GDPR ask when staff use memory?

Memory does not change the basic rules. The ICO says organisations need a lawful basis for each purpose for which they use personal data.

People should know what you do. The ICO says privacy notices should explain how and why an AI tool is used. It also says people should be told before their information is used in new ways.

Here is one example of a firm doing this. When The Assurance Desk recorded Deloitte's UK privacy statement on 19 September 2026, it set out how data for its AI processing is routed. It also said customer data is not used for model training.

Memory can carry details into later answers, so accuracy matters. The ICO says organisations using an AI tool must check that outputs are accurate and correct anything that is wrong.

What if memory picks up health or other sensitive details?

The UK GDPR gives some personal data extra protection, and data concerning health is one of these special categories.

Using special category data needs a second condition under Article 9 of the UK GDPR. The ICO also says profiling that infers things like health status counts as processing special category data.

Do you need a DPIA before using ChatGPT memory?

A DPIA is most likely needed. The ICO says that in the vast majority of cases, using AI is likely to be high risk. That legally requires a DPIA, a written check of the risks to people. You decide case by case.

The ICO's guidance on AI accountability is under review because of the Data (Use and Access) Act. Check it again before you finalise your approach.

What if memory already holds client data?

Delete the saved memory itself, and the chat it came from. OpenAI says deleting a chat alone does not necessarily delete a saved memory, and turning memory off does not delete past chats.

Deletion is not instant. OpenAI may keep logs of deleted saved memories for up to 30 days. Turning off Reference chat history schedules what ChatGPT learned from past chats for deletion within 30 days.

For work you do not want remembered, a temporary chat does not create or update memories.

What to do

1. Decide whether memory is on for work, and for which tasks.
2. If you use ChatGPT Business, set memory at workspace level, knowing that switching it off deletes members' saved memories.
3. Tell staff where the setting is: Settings, then Personalization, then Memory.
4. Ask staff to use a temporary chat for work with client or health data.
5. Update your privacy notice to explain how the AI tool is used.
6. Record your decision, and check whether a DPIA is needed.

Common questions

Does turning memory off delete everything?

No. Turning memory off does not delete past chats. In ChatGPT Business, a workspace owner who turns memory off deletes members' saved memories.

Can colleagues see each other's ChatGPT memories?

No. Memories are tied to each account and cannot be passed to other users in the same Business workspace.

What happens to memories from a personal account?

If a member merges a personal workspace into Business, eligible saved memories can move across, and the merge is permanent.

Where next

• Can staff paste client data into ChatGPT or Copilot?
• A DPIA for an AI tool: when and how
• What must your UK privacy notice say?
• Who can write your AI policy?

This is an independent editorial guide, not legal advice.