# Can staff paste client data into ChatGPT or Copilot?

Check the task, the account and the information before staff share it with an AI tool.

The Assurance Desk. Published 7 October 2026. Last checked 7 October 2026.

Part of the guide [Does your UK business need an AI policy, and what goes in it?](https://theassurancedesk.com/guides/the-ai-governance-gap.md).

**The short answer.** Do not treat the product name as permission to share client data. Check the actual service, account, terms and intended use first. If personal data is involved, UK data protection duties still apply. The NCSC advises against putting sensitive information into public language models ([NCSC, ChatGPT and LLMs: what's the risk](https://www.ncsc.gov.uk/blog-post/chatgpt-and-large-language-models-whats-the-risk), [ICO, What are the accountability and governance implications of AI?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/what-are-the-accountability-and-governance-implications-of-ai/) and [ICO, How do we ensure lawfulness in AI?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/how-do-we-ensure-lawfulness-in-ai/), checked 7 October 2026).

## What needs checking before staff paste data?

Ask which tool and account are approved for the task. Then check how the service will handle the information. The NCSC says the terms and privacy policy need to be understood before sensitive questions are submitted ([NCSC, ChatGPT and LLMs: what's the risk](https://www.ncsc.gov.uk/blog-post/chatgpt-and-large-language-models-whats-the-risk), checked 7 October 2026).

This guide does not claim that every ChatGPT or Copilot plan handles data in the same way. Use the terms for the exact service being considered, rather than a promise about the brand.

**Before the paste**

1. Name the task: What is the tool meant to help with?
2. Check the service: Which account, terms and controls apply?
3. Check the data: Why is each piece of personal data needed?
4. Confirm the permission: Ask the internal owner before sharing anything unclear.

Approval should relate to this task, this service and this information.

Source: NCSC, ChatGPT and LLMs: what's the risk, https://www.ncsc.gov.uk/blog-post/chatgpt-and-large-language-models-whats-the-risk (checked 7 October 2026); ICO, How do we ensure lawfulness in AI?, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/how-do-we-ensure-lawfulness-in-ai/ (checked 7 October 2026); ICO, How should we assess security and data minimisation in AI?, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/how-should-we-assess-security-and-data-minimisation-in-ai/ (checked 7 October 2026)

## What if the client data includes personal information?

Identify the purpose and the lawful basis, meaning the valid legal reason for that use of personal data. The ICO requires this for each distinct use. If special category data is involved, there must also be an additional legal condition for using it ([ICO, How do we ensure lawfulness in AI?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/how-do-we-ensure-lawfulness-in-ai/), checked 7 October 2026).

Use only the personal data needed for the task. The ICO calls this data minimisation. Do not send a whole file just because it is easy to attach ([ICO, How should we assess security and data minimisation in AI?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/how-should-we-assess-security-and-data-minimisation-in-ai/), checked 7 October 2026).

Check the privacy information too. It should explain the purpose, how long personal data is kept and who receives it. Assess whether the proposed use needs a DPIA, a review of risks to people’s data rights ([ICO, What are the accountability and governance implications of AI?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/what-are-the-accountability-and-governance-implications-of-ai/) and [ICO, How do we ensure transparency in AI?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/how-do-we-ensure-transparency-in-ai/), checked 7 October 2026).

**Questions for the person approving the use**

| Check | Question |
| --- | --- |
| Purpose and legal reason | Why is this use of personal data necessary, and what lawful basis applies? |
| Data needed | Can the task be done with less personal information? |
| Service terms | How does this service handle the information supplied to it? |
| Privacy information | Have people been told the purpose, retention period and recipients? |
| Risk assessment | Does this use need a DPIA, and is that decision recorded? |

Source: NCSC, ChatGPT and LLMs: what's the risk, https://www.ncsc.gov.uk/blog-post/chatgpt-and-large-language-models-whats-the-risk (checked 7 October 2026); ICO, What are the accountability and governance implications of AI?, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/what-are-the-accountability-and-governance-implications-of-ai/ (checked 7 October 2026); ICO, How do we ensure lawfulness in AI?, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/how-do-we-ensure-lawfulness-in-ai/ (checked 7 October 2026); ICO, How should we assess security and data minimisation in AI?, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/how-should-we-assess-security-and-data-minimisation-in-ai/ (checked 7 October 2026); ICO, How do we ensure transparency in AI?, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/how-do-we-ensure-transparency-in-ai/ (checked 7 October 2026)

## What about staff using their own AI accounts?

The NCSC calls AI outside an organisation’s approved systems and processes shadow AI. Its recent guidance encourages organisations to understand why staff use these tools and provide suitable alternatives ([NCSC, The hidden risks of shadow AI](https://www.ncsc.gov.uk/blogs/the-hidden-risks-of-shadow-ai), checked 7 October 2026).

Ask staff what job they are trying to finish. The aim is to give them useful tools while managing the risk. Staff need rules they can apply to their work ([NCSC, The hidden risks of shadow AI](https://www.ncsc.gov.uk/blogs/the-hidden-risks-of-shadow-ai), checked 7 October 2026).

## What if someone has already shared client data?

Ask them to raise it with the person handling security or data protection incidents. Record what was shared, with which service and account, and when. Have that person assess the next steps; do not promise that deleting a chat resolves every issue.

Keep the conversation calm and practical. The NCSC’s guidance supports open discussion of unapproved use so organisations can understand it and provide safer options ([NCSC, The hidden risks of shadow AI](https://www.ncsc.gov.uk/blogs/the-hidden-risks-of-shadow-ai), checked 7 October 2026).

## What to do

1. Name the approved tool, account and task in the staff instructions.
2. Read the service terms and privacy policy for that use ([NCSC, ChatGPT and LLMs: what's the risk](https://www.ncsc.gov.uk/blog-post/chatgpt-and-large-language-models-whats-the-risk), checked 7 October 2026).
3. Check the purpose, legal reason and minimum personal data needed ([ICO, How do we ensure lawfulness in AI?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/how-do-we-ensure-lawfulness-in-ai/) and [ICO, How should we assess security and data minimisation in AI?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/how-should-we-assess-security-and-data-minimisation-in-ai/), checked 7 October 2026).
4. Review the privacy information and whether a DPIA is needed ([ICO, What are the accountability and governance implications of AI?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/what-are-the-accountability-and-governance-implications-of-ai/) and [ICO, How do we ensure transparency in AI?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/how-do-we-ensure-transparency-in-ai/), checked 7 October 2026).
5. Give staff a clear person to contact when they are unsure or have shared something by mistake.

## Common questions

### Does paying for an AI account settle the data protection question?

Check the terms and the intended use of the actual service. Your organisation still needs an appropriate lawful basis and must limit personal data to what the purpose needs ([NCSC, ChatGPT and LLMs: what's the risk](https://www.ncsc.gov.uk/blog-post/chatgpt-and-large-language-models-whats-the-risk), [ICO, How do we ensure lawfulness in AI?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/how-do-we-ensure-lawfulness-in-ai/) and [ICO, How should we assess security and data minimisation in AI?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/how-should-we-assess-security-and-data-minimisation-in-ai/), checked 7 October 2026).

### Can we use made-up information to test a workflow?

Ask the internal owner whether the test can use invented information instead of client records. The data protection principle is to use only the personal data needed for the purpose ([ICO, How should we assess security and data minimisation in AI?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/how-should-we-assess-security-and-data-minimisation-in-ai/), checked 7 October 2026).

### Who remains responsible when we use a supplier’s AI?

Where your organisation is the controller, it remains responsible for data protection compliance. Check the actual processing arrangement as part of approving the use ([ICO, What are the accountability and governance implications of AI?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/what-are-the-accountability-and-governance-implications-of-ai/), checked 7 October 2026).

## Where next

- [Does your UK business need an AI policy, and what goes in it?](https://theassurancedesk.com/guides/the-ai-governance-gap.md)
- [Who is a data controller, and who is a processor?](https://theassurancedesk.com/guides/data-controller-or-processor.md)
- [A data breach has happened: who do you call?](https://theassurancedesk.com/guides/data-breach-who-to-call.md)
- [What is AI governance, in plain words?](https://theassurancedesk.com/guides/what-is-ai-governance.md)
- [Who can write your AI policy?](https://theassurancedesk.com/guides/who-can-write-your-ai-policy.md)

## Sources

- NCSC, ChatGPT and LLMs: what's the risk: https://www.ncsc.gov.uk/blog-post/chatgpt-and-large-language-models-whats-the-risk (checked 7 October 2026)
- ICO, What are the accountability and governance implications of AI?: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/what-are-the-accountability-and-governance-implications-of-ai/ (checked 7 October 2026)
- ICO, How do we ensure lawfulness in AI?: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/how-do-we-ensure-lawfulness-in-ai/ (checked 7 October 2026)
- ICO, How should we assess security and data minimisation in AI?: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/how-should-we-assess-security-and-data-minimisation-in-ai/ (checked 7 October 2026)
- ICO, How do we ensure transparency in AI?: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/how-do-we-ensure-transparency-in-ai/ (checked 7 October 2026)
- NCSC, The hidden risks of shadow AI: https://www.ncsc.gov.uk/blogs/the-hidden-risks-of-shadow-ai (checked 7 October 2026)

---

**Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.