Staff Using ChatGPT: How to Keep Customer Data Safe

What can go wrong

• Customer names, addresses, health details or account numbers pasted into a tool you have not checked.
• Confidential documents, prices or contracts shared outside the business.
• AI-written replies sent to customers with mistakes or made-up details.
• Work done on personal accounts that you cannot see or control.

Check the tool's settings and terms

AI providers handle data differently, and many offer business versions with stronger controls, such as settings that stop your conversations being used to train their models. Before approving a tool, read its data settings and terms, and choose the version and settings that suit how you will use it.

UK GDPR still applies

If staff put personal data into an AI tool, your business is still responsible for that data under UK GDPR. That means having a good reason to use it, using no more than you need, and knowing where it goes. The Information Commissioner's Office (ICO) publishes guidance on AI and data protection that is worth reading.

Simple rules that work

• Use approved tools on business accounts only.
• Remove names and identifying details before pasting text in, unless the tool is approved for personal data.
• Never paste passwords, bank details or anything marked confidential.
• Check every answer before it goes to a customer.
• Write the rules down in a one-page AI policy.