Can staff paste client data into ChatGPT or Copilot?

Part of the guide Does your UK business need an AI policy, and what goes in it?

What needs checking before staff paste data?

Ask which tool and account are approved for the task. Then check how the service will handle the information. The NCSC says the terms and privacy policy need to be understood before sensitive questions are submitted.

This guide does not claim that every ChatGPT or Copilot plan handles data in the same way. Use the terms for the exact service being considered, rather than a promise about the brand.

What if the client data includes personal information?

Identify the purpose and the lawful basis, meaning the valid legal reason for that use of personal data. The ICO requires this for each distinct use. If special category data is involved, there must also be an additional legal condition for using it.

Use only the personal data needed for the task. The ICO calls this data minimisation. Do not send a whole file just because it is easy to attach.

Check the privacy information too. It should explain the purpose, how long personal data is kept and who receives it. Assess whether the proposed use needs a DPIA, a review of risks to people’s data rights.

What about staff using their own AI accounts?

The NCSC calls AI outside an organisation’s approved systems and processes shadow AI. Its recent guidance encourages organisations to understand why staff use these tools and provide suitable alternatives.

Ask staff what job they are trying to finish. The aim is to give them useful tools while managing the risk. Staff need rules they can apply to their work.

What if someone has already shared client data?

Ask them to raise it with the person handling security or data protection incidents. Record what was shared, with which service and account, and when. Have that person assess the next steps; do not promise that deleting a chat resolves every issue.

Keep the conversation calm and practical. The NCSC’s guidance supports open discussion of unapproved use so organisations can understand it and provide safer options.

What to do

1. Name the approved tool, account and task in the staff instructions.
2. Read the service terms and privacy policy for that use.
3. Check the purpose, legal reason and minimum personal data needed.
4. Review the privacy information and whether a DPIA is needed.
5. Give staff a clear person to contact when they are unsure or have shared something by mistake.

Common questions

Does paying for an AI account settle the data protection question?

Check the terms and the intended use of the actual service. Your organisation still needs an appropriate lawful basis and must limit personal data to what the purpose needs.

Can we use made-up information to test a workflow?

Ask the internal owner whether the test can use invented information instead of client records. The data protection principle is to use only the personal data needed for the purpose.

Who remains responsible when we use a supplier’s AI?

Where your organisation is the controller, it remains responsible for data protection compliance. Check the actual processing arrangement as part of approving the use.

Where next

• Does your UK business need an AI policy, and what goes in it?
• Who is a data controller, and who is a processor?
• A data breach has happened: who do you call?
• What is AI governance, in plain words?
• Who can write your AI policy?

This is an independent editorial guide, not legal advice.