Can you put client information into ChatGPT?

Not into a personal or free account.
Possibly into a business account, once you have made six checks and written down a rule.
And whatever you decide, assume someone on your team is already doing it, because in most small firms someone is.

The account type decides most of the answer

“ChatGPT” covers several products with different terms.
The question that matters is which one your staff log into before they paste something in.

The missing processing agreement is usually what settles it.
UK GDPR requires one whenever a supplier processes personal data on your behalf.
Without it you cannot show the supplier acts only on your instructions.
So a personal account is the wrong place for client details, whatever its privacy settings say.

Confidentiality is a separate problem

Data protection is about people’s personal data.
Confidentiality covers everything a client tells you, including figures about their business that identify nobody.
In February 2024 ICAEW warned its members that inputting client data of any kind into tools such as ChatGPT is a potential breach of confidentiality.

So check your engagement letters and client contracts too.
Some forbid passing client information to a third party without consent, and an AI provider is a third party.

Six checks before client data goes in

• —A signed data processing agreement. Business plans offer one, but it only protects you once you have completed and signed it.
• —Training switched off. Confirm it in the terms for the plan you are on.
  Do not rely on a setting each employee has to remember.
• —Company accounts only. If staff use their own logins, you cannot see what they shared or delete it, and you lose it all when they leave.
• —Where the data goes. Most AI providers process in the United States.
  That transfer needs a legal route, such as the UK extension to the EU–US Data Privacy Framework or the UK’s international data transfer agreement.
• —How long it is kept. Find out how long the provider keeps prompts, files and chat histories, and whether you can delete them when a client asks.
• —Your privacy notice. If client personal data will go into an AI tool, your notice should say so.
  Health, criminal record or children’s data also usually means a data protection impact assessment first.

Your profession may have its own rules

UK GDPR is the floor.
Regulated firms answer to more than that, and generic AI advice tends to drift into American rules that do not apply here.

• —Accountants have ICAEW’s confidentiality warning above, and its guidance on generative AI.
• —Solicitors have the SRA’s and the Law Society’s guidance, and privilege to protect as well as confidentiality.
• —Recruiters should read the ICO’s findings from its audits of AI recruitment tools, especially before any tool sorts or screens candidates.
• —Financial advisers and brokers have the FCA’s Consumer Duty, which applies to AI-assisted communications as to any other.

What staff can use it for today

Most of the time AI saves needs no client information at all.
Job advert templates, first drafts of generic emails, explaining a rule, structuring a report or a checklist: none of these need a name in them.

Be careful with “anonymised”.
Removing a name is not enough if the role, the town and the date still point to one person.
If someone could trace the text back to a person, treat it as personal data.

Getting it checked

For most small firms the six checks above are an afternoon’s work: read the terms, sign the agreement, move everyone onto company accounts, update the privacy notice.
Write the result down as a one-page policy so the rule outlives the conversation.

Any AI supplier you use should be able to show you the same things: a processing agreement and a list of who else handles your data.
Ours are public: our data processing agreement and our sub-processor list.
When the question is bigger than one tool, such as which work to put through AI at all, an AI audit answers it.

This guide explains the questions to ask.
It is not legal advice.
For a decision about your own firm, check the ICO’s guidance or speak to a data protection adviser.