Accountants using ChatGPT with client data: what is safe, what breaches the rules, and which plan to use
The safe rule for accountants using ChatGPT with client data is simple. Keep identifiable client data out of Free, Plus and Pro accounts entirely. Take names and numbers out before asking anything client-related. Put real client data only into a business plan with a data processing agreement, and only where the client would expect it. ChatGPT itself is welcome in a practice. Client data is what needs care.
Three kinds of task
Most everyday uses of ChatGPT in a practice fall into one of three groups. Sort the task first. Then pick the account.
Safe with no client data
- Explaining a tax rule in plain English for your own understanding.
- Writing a spreadsheet formula from a made-up example.
- Drafting a general newsletter or a template engagement letter.
- Summarising public guidance or a published HMRC manual page.
None of these need a client. So no client goes in. Check any tax answer against the source, as ChatGPT can be confidently wrong.
Safe with redaction
- Polishing a client email once names, amounts and references are taken out.
- Asking how to treat an unusual transaction, described in general terms.
- Rewording a management letter point without the client being identifiable.
Only on a business plan with a contract
- Summarising a client's full accounts or trial balance.
- Uploading payroll exports, bank statements or a client list.
- Anything you cannot sensibly anonymise.
Rule of thumb: if the task needs the client's identity to work, it needs a business plan and a contract. If it does not, take the identity out.
What the UK rules say
UK GDPR
Client data about people, such as sole traders, directors, employees and payroll, is personal data. When an outside company processes it for you, the law expects a written contract. The Information Commissioner's Office explains that UK GDPR requires a written contract under Article 28(3) whenever an organisation engages a third party, such as an AI vendor, to process personal data on its behalf. A personal ChatGPT login gives you no such contract.
ICAEW and PCRT confidentiality
The professional bodies are direct about this. ICAEW guidance says confidentiality "means not loading confidential information into public Generative AI tools, even if such information has become publicly available". It gives the reason as "limited visibility and control over who the information is shared with, how it is secured and how long it is retained." That wording is quoted in a summary of ICAEW's position by ICAEW, Generative AI and ethics (via Develop-ed summary).
For tax work, the PCRT topical guidance on the ethical use of AI tools was published on 19 January 2026 by the seven bodies that jointly prepare PCRT. According to The AI Consultancy, it states that inputting client data into publicly available AI tools is likely to breach client confidentiality unless the client has consented.
Anti-money laundering records
Your customer due diligence and AML records must sit in your own systems, where you can produce them. A chat history is not a record-keeping system. Never put details of a suspicion or a report into an AI tool. That information is among the most sensitive a practice holds.
ChatGPT Free, Plus, Business and Enterprise compared
The plans differ on three points. Training, retention and admin controls.
On Free, Plus and Pro, the OpenAI Help Centre says conversations may be used to train models by default. You can opt out in Settings, Data Controls, "Improve the model for everyone". The opt-out only affects new conversations. And it still gives you no processing contract.
The OpenAI Enterprise privacy FAQ says OpenAI does not train on business data from Team, Enterprise or the API by default. Deleted or unsaved conversations are removed within 30 days, unless OpenAI is legally required to keep them.
That caveat is real. A 2025 preservation order in the New York Times copyright case required OpenAI to keep some consumer ChatGPT data beyond normal deletion. Enterprise and Edu were excluded. Meetily reports OpenAI stated the going-forward obligation ended on 26 September 2025.
| Plan | Trains on your data by default | GDPR processing agreement | Admin controls |
|---|---|---|---|
| Free, Plus, Pro | Yes, unless you opt out | No | None for the firm |
| Business (formerly Team) | No | Yes | Basic workspace management |
| Enterprise | No | Yes | Automated offboarding, extended audit logs, custom retention |
The Business and Enterprise detail comes from AI Policy Desk. For a small practice, Business is the realistic floor for client work. Enterprise matters if you need audit logs and retention you can set yourself.
A redaction worked example
Take Ashcombe, a fictional practice. Priya wants help with a tricky email to a client.
Her draft: "Dear Mr Hall, Fenwick Joinery's corporation tax for 2025-26 shows £18,240 due. Your HMRC reference is 123/AB456."
Before pasting, she swaps each item for a label.
"Dear [Name], [Client]'s corporation tax for [Year] shows [Amount] due. Your HMRC reference is [Reference]."
The question still goes. ChatGPT improves the tone. Priya puts the real details back in her own email client. Nothing identifying left the PC.
Watch for: labels are not always enough. The AI Consultancy notes anonymised data can still identify a client through other means, such as an uncommon service a business is known to provide. Take out the clue, not just the name.
Accounting-specific AI tools
Tools built for accountants, such as TaxGPT and Digits, are not automatically safer. Ask each vendor the same questions.
- Will you sign a UK GDPR data processing agreement?
- Do you train any model on our data?
- Where is our data stored, and for how long?
- Which other AI providers do you send it to?
- Can we delete our data, and get confirmation?
If the answers are vague, treat the tool like a public one.
If client data has already been pasted
- Stop using that conversation. Delete it.
- Write down what went in, which account, who, and when.
- Tell whoever handles data protection in the practice.
- Decide whether it is a personal data breach. If it is likely to put people at risk, the ICO must be told within 72 hours of the practice becoming aware.
- Consider whether the client should be told.
- Fix the cause. That might be training, a business plan, or a technical check.
Keep calm about it. A clear record of what happened and what you did is what clients and insurers want to see.
Firms on Microsoft 365
Many practices already pay for Microsoft 365 and are weighing Copilot instead. The rules differ there, so read whether Copilot is safe for client data before choosing.
Making redaction automatic
Redaction works only if everyone does it, every time. That is where Helio Guard fits. It runs on each Windows PC in Chrome and Edge. It checks every paste, message and file upload on listed AI sites. Card numbers, bank details, National Insurance numbers and lists of people are taken out before anything is sent. Your own client names can be swapped for a stand-in such as "Client A", which turns back into the real name when the answer is copied. Checked on the PC. We never see what your team types. It also records each person's agreement to your AI policy. You can see pricing for your practice on our site.
Related: What happens to the data you paste into DeepSeek, and should you block it at work?, ChatGPT Team vs Enterprise vs free: which one protects client data?, Recruiters and ChatGPT: is it safe to paste CVs into AI?