# Should staff use ChatGPT with memory switched on?

Memory can make ChatGPT more useful at work, and it also keeps details about people, so it deserves a decision of its own.

The Assurance Desk. Published 21 October 2026. Last checked 21 October 2026.

Part of the guide [Does your UK business need an AI policy, and what goes in it?](https://theassurancedesk.com/guides/the-ai-governance-gap.md).

**The short answer.** It is a choice for each organisation. Memory lets ChatGPT keep details from chats, including details staff did not ask it to save. If those details are about people, the UK GDPR applies to them. One clear option is to switch memory off for work that touches client or health data. Where it stays on, set simple rules ([OpenAI Help Center, Memory in ChatGPT](https://help.openai.com/en/articles/8590148-memory-in-chatgpt), [ICO, Previously asked questions](https://ico.org.uk/for-organisations/advice-and-services/innovation-advice/previously-asked-questions/) and [ICO, What is special category data?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/special-category-data/what-is-special-category-data/), checked 21 October 2026).

## What does ChatGPT memory keep?

When memory is on, ChatGPT can remember preferences and details from chats and other sources. OpenAI lists past chats, saved memories, custom instructions, files in Library and content from connected apps ([OpenAI Help Center, Memory in ChatGPT](https://help.openai.com/en/articles/8590148-memory-in-chatgpt), checked 21 October 2026).

Saved memories are details a user asks ChatGPT to remember, or details ChatGPT saves itself as useful context. OpenAI also says sensitive information can appear in memory if a user shares it ([OpenAI Help Center, Memory in ChatGPT](https://help.openai.com/en/articles/8590148-memory-in-chatgpt), checked 21 October 2026).

A study of 2,050 memory entries from 80 ChatGPT users found that ChatGPT created 96% of them. In the same study, 28% held personal data as the GDPR defines it. It covered 80 users, so it shows how memory can work, not how your own staff use it ([arXiv, The Algorithmic Self-Portrait: Deconstructing Memory in ChatGPT (abstract page)](https://arxiv.org/abs/2602.01450), checked 21 October 2026).

## Who can switch ChatGPT memory off?

Each person can check memory in Settings, then Personalization, then Memory. In ChatGPT Business, any user can turn memory off there at any time ([OpenAI Help Center, Memory in ChatGPT](https://help.openai.com/en/articles/8590148-memory-in-chatgpt) and [OpenAI Help Center, Memory FAQ (Business Version)](https://help.openai.com/en/articles/9295112-memory-faq-business-version), checked 21 October 2026).

Workspace owners decide whether memory is available across the whole Business workspace. If an owner turns it off, the saved memories of every member in that workspace are deleted ([OpenAI Help Center, Memory FAQ (Business Version)](https://help.openai.com/en/articles/9295112-memory-faq-business-version), checked 21 October 2026).

Memories belong to each account. They cannot be passed to colleagues, even in the same Business workspace ([OpenAI Help Center, Memory FAQ (Business Version)](https://help.openai.com/en/articles/9295112-memory-faq-business-version), checked 21 October 2026).

Some plans start with memory off. In ChatGPT for Healthcare and ChatGPT Enterprise with Regulated Workspace, improved memory is off by default. There, project-only memory can keep memory inside one project ([OpenAI Help Center, Memory in ChatGPT](https://help.openai.com/en/articles/8590148-memory-in-chatgpt), checked 21 October 2026).

**Who controls ChatGPT memory, as OpenAI describes it**

| Control | Who uses it | What happens |
| --- | --- | --- |
| Memory setting for one person | The user, in Settings | Memory can be turned off at any time |
| Memory for a whole Business workspace | The workspace owner | Turning it off deletes members' saved memories |
| Improved memory in regulated workspaces | Set by OpenAI as the starting point | Off by default |
| Temporary chat | Any user | No memories are created or updated |

Source: OpenAI Help Center, Memory FAQ (Business Version), https://help.openai.com/en/articles/9295112-memory-faq-business-version (checked 21 October 2026); OpenAI Help Center, Memory in ChatGPT, https://help.openai.com/en/articles/8590148-memory-in-chatgpt (checked 21 October 2026)

## Does OpenAI train its models on work memories?

OpenAI says that by default, data in a ChatGPT Business workspace, including conversations and memories, is not used to train its models ([OpenAI Help Center, Memory FAQ (Business Version)](https://help.openai.com/en/articles/9295112-memory-faq-business-version), checked 21 October 2026).

Staff who also use personal accounts should know one thing. If a member merges a personal workspace into Business, saved memories that apply across chats can move with it. The merge cannot be undone ([OpenAI Help Center, Memory FAQ (Business Version)](https://help.openai.com/en/articles/9295112-memory-faq-business-version), checked 21 October 2026).

## What does the UK GDPR ask when staff use memory?

Memory does not change the basic rules. The ICO says organisations need a lawful basis for each purpose for which they use personal data ([ICO, Previously asked questions](https://ico.org.uk/for-organisations/advice-and-services/innovation-advice/previously-asked-questions/), checked 21 October 2026).

People should know what you do. The ICO says privacy notices should explain how and why an AI tool is used. It also says people should be told before their information is used in new ways ([ICO, Previously asked questions](https://ico.org.uk/for-organisations/advice-and-services/innovation-advice/previously-asked-questions/), checked 21 October 2026).

Here is one example of a firm doing this. When The Assurance Desk recorded Deloitte's UK privacy statement on 19 September 2026, it set out how data for its AI processing is routed. It also said customer data is not used for model training ([The Assurance Desk, Deloitte LLP profile](https://theassurancedesk.com/advisers/deloitte-llp-uk), checked 21 October 2026).

Memory can carry details into later answers, so accuracy matters. The ICO says organisations using an AI tool must check that outputs are accurate and correct anything that is wrong ([ICO, Previously asked questions](https://ico.org.uk/for-organisations/advice-and-services/innovation-advice/previously-asked-questions/), checked 21 October 2026).

## What if memory picks up health or other sensitive details?

The UK GDPR gives some personal data extra protection, and data concerning health is one of these special categories ([ICO, What is special category data?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/special-category-data/what-is-special-category-data/), checked 21 October 2026).

Using special category data needs a second condition under Article 9 of the UK GDPR. The ICO also says profiling that infers things like health status counts as processing special category data ([ICO, Previously asked questions](https://ico.org.uk/for-organisations/advice-and-services/innovation-advice/previously-asked-questions/) and [ICO, What is special category data?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/special-category-data/what-is-special-category-data/), checked 21 October 2026).

## Do you need a DPIA before using ChatGPT memory?

A DPIA is most likely needed. The ICO says that in the vast majority of cases, using AI is likely to be high risk. That legally requires a DPIA, a written check of the risks to people. You decide case by case ([ICO, What are the accountability and governance implications of AI?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/what-are-the-accountability-and-governance-implications-of-ai/), checked 21 October 2026).

The ICO's guidance on AI accountability is under review because of the Data (Use and Access) Act. Check it again before you finalise your approach ([ICO, What are the accountability and governance implications of AI?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/what-are-the-accountability-and-governance-implications-of-ai/), checked 21 October 2026).

## What if memory already holds client data?

Delete the saved memory itself, and the chat it came from. OpenAI says deleting a chat alone does not necessarily delete a saved memory, and turning memory off does not delete past chats ([OpenAI Help Center, Memory in ChatGPT](https://help.openai.com/en/articles/8590148-memory-in-chatgpt), checked 21 October 2026).

Deletion is not instant. OpenAI may keep logs of deleted saved memories for up to 30 days. Turning off Reference chat history schedules what ChatGPT learned from past chats for deletion within 30 days ([OpenAI Help Center, Memory in ChatGPT](https://help.openai.com/en/articles/8590148-memory-in-chatgpt), checked 21 October 2026).

For work you do not want remembered, a temporary chat does not create or update memories ([OpenAI Help Center, Memory in ChatGPT](https://help.openai.com/en/articles/8590148-memory-in-chatgpt), checked 21 October 2026).

## What to do

1. Decide whether memory is on for work, and for which tasks.
2. If you use ChatGPT Business, set memory at workspace level, knowing that switching it off deletes members' saved memories ([OpenAI Help Center, Memory FAQ (Business Version)](https://help.openai.com/en/articles/9295112-memory-faq-business-version), checked 21 October 2026).
3. Tell staff where the setting is: Settings, then Personalization, then Memory ([OpenAI Help Center, Memory in ChatGPT](https://help.openai.com/en/articles/8590148-memory-in-chatgpt), checked 21 October 2026).
4. Ask staff to use a temporary chat for work with client or health data ([OpenAI Help Center, Memory in ChatGPT](https://help.openai.com/en/articles/8590148-memory-in-chatgpt), checked 21 October 2026).
5. Update your privacy notice to explain how the AI tool is used ([ICO, Previously asked questions](https://ico.org.uk/for-organisations/advice-and-services/innovation-advice/previously-asked-questions/), checked 21 October 2026).
6. Record your decision, and check whether a DPIA is needed ([ICO, What are the accountability and governance implications of AI?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/what-are-the-accountability-and-governance-implications-of-ai/), checked 21 October 2026).

## Common questions

### Does turning memory off delete everything?

No. Turning memory off does not delete past chats. In ChatGPT Business, a workspace owner who turns memory off deletes members' saved memories ([OpenAI Help Center, Memory in ChatGPT](https://help.openai.com/en/articles/8590148-memory-in-chatgpt) and [OpenAI Help Center, Memory FAQ (Business Version)](https://help.openai.com/en/articles/9295112-memory-faq-business-version), checked 21 October 2026).

### Can colleagues see each other's ChatGPT memories?

No. Memories are tied to each account and cannot be passed to other users in the same Business workspace ([OpenAI Help Center, Memory FAQ (Business Version)](https://help.openai.com/en/articles/9295112-memory-faq-business-version), checked 21 October 2026).

### What happens to memories from a personal account?

If a member merges a personal workspace into Business, eligible saved memories can move across, and the merge is permanent ([OpenAI Help Center, Memory FAQ (Business Version)](https://help.openai.com/en/articles/9295112-memory-faq-business-version), checked 21 October 2026).

## Where next

- [Can staff paste client data into ChatGPT or Copilot?](https://theassurancedesk.com/guides/staff-client-data-chatgpt-copilot.md)
- [A DPIA for an AI tool: when and how](https://theassurancedesk.com/guides/dpia-for-an-ai-tool.md)
- [What must your UK privacy notice say?](https://theassurancedesk.com/guides/what-your-privacy-notice-must-say.md)
- [Who can write your AI policy?](https://theassurancedesk.com/guides/who-can-write-your-ai-policy.md)

## Sources

- OpenAI Help Center, Memory in ChatGPT: https://help.openai.com/en/articles/8590148-memory-in-chatgpt (checked 21 October 2026)
- ICO, Previously asked questions: https://ico.org.uk/for-organisations/advice-and-services/innovation-advice/previously-asked-questions/ (checked 21 October 2026)
- ICO, What is special category data?: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/special-category-data/what-is-special-category-data/ (checked 21 October 2026)
- arXiv, The Algorithmic Self-Portrait: Deconstructing Memory in ChatGPT (abstract page): https://arxiv.org/abs/2602.01450 (checked 21 October 2026)
- OpenAI Help Center, Memory FAQ (Business Version): https://help.openai.com/en/articles/9295112-memory-faq-business-version (checked 21 October 2026)
- The Assurance Desk, Deloitte LLP profile: https://theassurancedesk.com/advisers/deloitte-llp-uk (checked 21 October 2026)
- ICO, What are the accountability and governance implications of AI?: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/what-are-the-accountability-and-governance-implications-of-ai/ (checked 21 October 2026)

---

**Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.