Is ChatGPT safe for confidential data?
A plain answer for organisations whose staff want to use public AI tools on work they are not allowed to share.
Last updated 15 October 2026
The short answer
It depends on which version you use, the terms you have agreed and what the data is. For client confidential material, personal data and regulated records, a public AI tool is rarely the right default. A business tier with the right terms can be acceptable for some work. A private platform is the safer choice when the data must stay inside your own estate.
This guide uses ChatGPT as the example because it is the tool most people ask about. The same points apply to any public AI service.
What happens to what you paste in
When someone pastes a document into a public AI tool, it is sent over the internet to the provider's servers and processed by the provider's model. Depending on the product and its settings, the conversation may be stored in the user's history, kept for a period for safety review, and, on some consumer plans, used to improve future models unless the user opts out.
None of that is necessarily careless. It is how a shared service works. But it means the document now sits on another company's systems, under that company's terms, outside your own audit and change process.
Consumer and business tiers
Business and enterprise tiers of the main AI tools usually exclude your data from model training by contract, offer controls over retention, and connect to your identity provider. These are real improvements. What they do not change:
- The data is still processed on the provider's infrastructure, with the provider's subprocessors.
- Where it is processed may not be the UK, which brings international transfer rules into play.
- Changes to the service happen on the provider's timetable, not through your change process.
- Your security team can review the contract, but not the system.
What UK GDPR and the ICO expect
If the data includes personal data, UK GDPR applies however clever the tool is. The ICO guidance on AI points organisations to the same core duties:
- a lawful basis for the processing, and transparency with the people whose data it is
- a data protection impact assessment where the processing is likely to be high risk
- a clear view of who is controller and who is processor, with a proper contract
- safeguards for any transfer outside the UK
- using no more personal data than the task needs
A public AI tool can sometimes meet these duties, but only if someone has done the work. Staff pasting client files into a personal account will not have.
What regulators in your sector say
- Legal. The Solicitors Regulation Authority has warned about confidential client information being entered into AI tools without proper safeguards.
- Financial services. The FCA has said its existing rules, including those on outsourcing, operational resilience and senior manager accountability, apply to the use of AI.
- Health and life sciences. Health data is special category data under UK GDPR, with extra conditions for processing it.
There is more on each sector in private AI for regulated industries.
Your staff are probably using it already
In most organisations, some staff already use public AI tools for work, because the tools are useful. Banning them rarely works on its own: the use moves to personal phones. A safer approach has three parts. Set a clear policy on what may and may not go into public tools. Offer an approved alternative for the work that matters. And find out where the real demand is, because that tells you where AI is worth investing in.
When a private platform makes sense
A private AI platform is worth considering when:
- the documents are client confidential, privileged or commercially sensitive
- personal or special category data is involved
- your regulator, your clients or your own policies require the data to stay in your estate
- many people need the same capability over the same documents
- you need to show auditors exactly where data goes and who can see it
If some of those apply, find out where AI is safe to start with a readiness assessment, or read more questions answered.
Start with an assessment.
An assessment shows where AI is safe to use on your data, and where it is not.
Thank you. Your request is on its way. We will reply from info@tlgsolutions.co.uk to arrange a first discussion.
That did not send. Please email info@tlgsolutions.co.uk instead, and we will reply from there.