Pasting a customer email, a CV or a spreadsheet of clients into ChatGPT, Claude or Gemini is processing personal data, so the GDPR applies. With GDPR and ChatGPT, Claude or Gemini, the rules are not new, but the tools make it easy to break them without noticing, mostly by using a personal account for work. This guide shows what changes between personal and business plans, the checks to make before using AI with customer data and what never to paste.
This guide is based on the providers’ official privacy and data-processing pages and on the text of the GDPR, all checked on 28 October 2026. Providers change their terms often, so check the linked pages before signing up. It is not legal advice. See our editorial policy.
Quick answer: to make GDPR and ChatGPT, Claude or Gemini work together, use a business plan for anything involving personal data (ChatGPT Business or Enterprise, Claude Team or Enterprise, Gemini in Google Workspace, or the APIs), not a personal Free or Plus account. Business plans do not use your data to train models by default and come with a data processing agreement (DPA), which the GDPR requires when a provider processes personal data for you. Then minimise what you paste, never enter sensitive data, tell people in your privacy notice and keep a person in charge of decisions about people.
Table of Contents
GDPR and ChatGPT: Why the Rules Apply
Any information about an identifiable person is personal data: a name, an email address, an order history, a CV, a voice recording. When your business decides to process it with an AI tool, your business is the controller. A provider that processes it only on your instructions is a processor, and GDPR Article 28 requires a written contract with it, the DPA.
That is the core problem with personal accounts. A Free or Plus account is a contract between the provider and the individual employee under consumer terms, not a processing agreement with your business, and on most of them the data can be used to improve the provider’s models.
Personal vs Business Plans: What Each Provider Says
| Tool and plan | Used to train models? | Data processing agreement | Notes |
|---|---|---|---|
| ChatGPT Free, Plus, Pro | Yes by default; you can switch off “Improve the model for everyone” in Settings > Data controls | No | OpenAI says that if you send feedback on a response, the whole conversation may be used even if you opted out |
| ChatGPT Business, Enterprise, API | No by default | Yes, via OpenAI’s DPA form; customers in the EEA contract with OpenAI Ireland Ltd | European data residency for eligible Enterprise and Edu customers and for new API projects |
| Claude Free, Pro, Max | Only if you turn the model-training setting on | No | With training on, data is kept up to 5 years; with it off, 30 days. Chats flagged for safety review can be used regardless |
| Claude Team, Enterprise, API | No by default (feedback you send can be used) | Yes, built into Anthropic’s Commercial Terms, with EU standard contractual clauses | Admins can switch off members’ feedback submission |
| Gemini app with a personal Google account | Yes while Keep Activity is on, which is the default for adults; human reviewers may read chats | No | Chats reviewed by humans are kept up to 3 years even if you delete your activity; with Keep Activity off, chats are still kept 72 hours |
| Gemini in Google Workspace (business editions) | No, not without your permission; not human-reviewed outside your domain | Yes, prompts are customer data under Google’s Cloud Data Processing Addendum | Managed by your Workspace admin |
Sources: OpenAI data controls, DPA and European data residency; Anthropic consumer training, commercial training and DPA; Google Gemini Apps Privacy Hub and Workspace generative AI Privacy Hub. Checked 28 October 2026.
Switching off training on a personal account helps, but it does not turn the provider into your processor or give you a DPA. For customer or employee data, that is not enough.
GDPR and ChatGPT: Seven Checks Before Using Personal Data
- Business account and DPA (Article 28). Put work use on a business plan or API and confirm the DPA is in place. Keep a copy or a link with the date.
- Training off. Check the default on your plan and any admin setting, such as feedback submission.
- Where the data goes (Articles 44–49). Transfers outside the EEA need a legal basis, such as an adequacy decision or standard contractual clauses. Check what the DPA uses and whether an EU data-residency option exists for your plan.
- Minimise (Article 5). Paste only what the task needs. Replace names and IDs with placeholders when the model does not need them, for example “Customer A”.
- No special categories (Article 9). Health, religion, union membership, sexual orientation, biometric or genetic data need a specific legal basis. Keep them out of general AI tools.
- Tell people (Articles 13–14) and record it (Article 30). Mention AI providers in your privacy notice and add the processing to your record of processing activities.
- People decide about people (Article 22, and Article 35 for high risk). AI can draft or rank, but a person makes decisions with legal or similarly significant effects, such as rejecting a candidate. Systematic evaluation of people may also require a data protection impact assessment.
What You Can Paste, With Care, or Never
| Usually fine (business plan) | With care: minimise or anonymise first | Never in a general AI tool |
|---|---|---|
| Your own product descriptions, public web pages, internal templates, anonymised FAQs | Customer emails, order details, meeting notes with names, CVs for a summary a person will review | Health data, ID and passport numbers, bank card details, passwords and API keys, other people’s confidential documents you are not allowed to share |
Business secrets deserve the same care even when they are not personal data: contracts, prices offered to a client or unreleased plans. A business plan with a DPA reduces the risk; it does not remove the need to think before pasting.
A Privacy-Notice Paragraph You Can Adapt
Written by us as a starting point for any business combining GDPR and ChatGPT, Claude or Gemini. Fill in the brackets and only keep what is true for your set-up:
“We use artificial intelligence tools provided by [OpenAI Ireland Ltd / Anthropic / Google] to [draft replies to your enquiries / summarise support requests]. These providers act as our data processors under a data processing agreement, process your data only on our instructions and do not use it to train their models. [Where data is transferred outside the European Economic Area, the transfer is covered by standard contractual clauses.] A member of our team reviews any response before it is sent, and no decision about you is made by AI alone.”
If a chatbot talks to your customers directly, you also need a visible notice that it is an AI under the AI Act; see our Article 50 guide for templates.
Automations and Agents
When you connect an AI model to your inbox or CRM through Zapier, Make or n8n, there are two processors: the automation platform and the AI provider. You need a DPA with both, and their data locations can differ: Zapier stores data in the US, Make lets you choose an EU region and n8n Cloud hosts in Frankfurt. We compare them in Make vs Zapier, and our guide to AI agents for small business explains how to keep a human approval step in the flow.
Common Mistakes
- Staff using personal accounts for customer work. The most common gap. Give people an approved business tool instead of banning AI.
- Thinking “training off” means GDPR-compliant. You still need a DPA, a transfer basis and a privacy notice.
- Pasting whole spreadsheets when the task needs three columns.
- Letting AI reject candidates or customers on its own. That runs into Article 22 and, from December 2027, the AI Act’s high-risk rules.
- No written policy. A one-page rule on allowed tools and forbidden data also covers your AI literacy duty; see our AI literacy guide.
For the wider picture of AI rules, deadlines and grants, see AI rules for businesses in Spain and the EU.
Frequently Asked Questions
GDPR and ChatGPT: is it legal to use ChatGPT with customer data?
It can be, if you use a business plan or the API with a data processing agreement, have a legal basis and a valid basis for any transfer outside the EEA, paste only what is needed, inform people in your privacy notice and keep sensitive data out. Using a personal Free or Plus account for customer data is hard to justify because there is no processing agreement with your business.
Do ChatGPT, Claude and Gemini train on my business data?
On their business plans and APIs, OpenAI, Anthropic and Google say they do not use your data for training by default. On personal plans it depends on settings: ChatGPT trains by default unless you opt out, Claude trains only if you turn the setting on, and the Gemini app uses activity for improvement while Keep Activity is on.
How do I get a data processing agreement with OpenAI, Anthropic or Google?
OpenAI offers a DPA form for ChatGPT Business, Enterprise and API customers, and EEA customers contract with OpenAI Ireland Ltd. Anthropic’s DPA, with EU standard contractual clauses, is automatically part of its Commercial Terms. In Google Workspace, Gemini prompts are customer data under the Cloud Data Processing Addendum.
Is turning off training on a personal account enough?
No. It reduces the risk, but it does not create a processing agreement between the provider and your business, which GDPR Article 28 requires when a provider processes personal data on your behalf.
Can I paste CVs into an AI tool to shortlist candidates?
Only with care: on a business plan with a DPA, informing candidates, minimising the data and with a person making the decision. Fully automated rejection can breach GDPR Article 22, and AI used in recruitment becomes high-risk under the AI Act from 2 December 2027.
Official Sources
- EUR-Lex: GDPR, Regulation (EU) 2016/679
- OpenAI: Data controls in ChatGPT
- OpenAI: Data Processing Addendum (effective 1 January 2026)
- OpenAI: Data residency in Europe
- Anthropic: Is my data used for model training? (consumer plans)
- Anthropic: Is my data used for model training? (commercial products)
- Anthropic: Data Processing Addendum
- Google: Gemini Apps Privacy Hub
- Google: Generative AI in Google Workspace Privacy Hub