To use ChatGPT safely at work, give staff a work account in ChatGPT Business or Enterprise, check a handful of settings, agree short rules on what can go in, and train people before or as they get access. On the personal plans, chats can be used to train OpenAI’s models unless the user switches that off. On Business and Enterprise, OpenAI says it does not train on your content by default. The right plan lowers the risk, and most of what is left depends on what people paste and what they do with the answer.
This guide is for UK employers whose staff already use ChatGPT, officially or not. Every ChatGPT fact was checked against OpenAI’s own pages on 9 November 2026. For Microsoft Copilot as well, see our guide to training staff on Microsoft Copilot and ChatGPT.
Is it safe to use ChatGPT at work?
It can be. The risks are practical ones:
- Work information in personal accounts, where your organisation has no contract with OpenAI or admin control, and the user decides whether chats train OpenAI’s models.
- Personal data pasted in when the task did not need it.
- A confident answer that is wrong, sent out under someone’s name.
- Sharing features that open a chat or project to more people than intended.
The ICO (now formally the Information Commission) is direct: “There is no ‘AI exemption’ to data protection law.” Its response to the generative AI consultations adds that the law applies even when processing is incidental or unintentional, so a customer’s name left in a pasted email thread counts.
Personal ChatGPT or ChatGPT Business: which should staff use?
Free, Go, Plus and Pro are personal plans. ChatGPT Business (called Team until August 2025, minimum two seats) and Enterprise put staff in a workspace your organisation controls.
| Personal plans (Free, Go, Plus, Pro) | Business and Enterprise | |
|---|---|---|
| Content used to train OpenAI’s models | Yes, unless the user opts out | Not by default |
| Who sets the rules | The individual | Workspace owners and admins |
| Data Processing Addendum | None with your organisation | OpenAI offers one |
| Shared chat links | Anyone with the link can view | Only members of your workspace |
There is a legal reason to keep work in the work account. When staff use personal data for work, your organisation is responsible for that processing, and Article 28 of UK GDPR requires a written contract with any processor acting for you. OpenAI’s enterprise privacy page says it can sign a Data Processing Addendum for ChatGPT Business and Enterprise, and that workspace admins can control how long data is kept. Ask your data protection lead to review it, including international transfers.
A business plan does not make every use lawful. The ICO’s guidance on AI and data protection, currently under review after the Data (Use and Access) Act 2025, says using AI will in the vast majority of cases involve high risk processing that needs a data protection impact assessment (DPIA), judged case by case. If staff will use ChatGPT with personal data, do the DPIA first.
Six ChatGPT settings to check before staff start
1. Which account is signed in
On 30 October 2026 OpenAI started rolling out account switching in the phone apps, so people can stay signed in to two accounts at once. Teach them to check which one is active before they paste anything.
2. Model training
On a personal account, Improve the model for everyone sits under Settings, then Data controls. Turning it off keeps the chat history, and voice mode has its own control. OpenAI’s data controls page warns that a thumbs up or down can send the whole conversation for training even after opting out. On Business and Enterprise, training happens only if you explicitly opt in, and OpenAI gives feedback as an example. Tell staff what those buttons do.
3. Memory
Memory can draw on past chats, saved memories, custom instructions and, on some plans, saved files and connected apps such as Gmail. Staff can review it under Settings, Personalization, Memory, and workspace admins can manage it. Deleting a chat does not necessarily delete a saved memory made from it, so remove both (OpenAI, Memory in ChatGPT).
4. Temporary chats
A temporary chat stays out of history, does not create or update memories and is not used to train models, though OpenAI may keep it for up to 30 days for safety. It suits a one-off question, never information that should not go in at all.
5. Projects and shared links
Projects hold the chats, files and instructions for one piece of work, and can be shared. If an owner sets a project to Anyone with a link, any logged-in ChatGPT user who has the link can join (OpenAI, Projects in ChatGPT). For work, invite named colleagues only. Workspace owners can decide who may create and share projects.
6. Connected apps and custom GPTs
Admins choose which apps can connect to the workspace. If teams built custom GPTs, OpenAI is retiring them on 11 December 2026 (later for some approved deferrals) and replacing them with plugins. Old conversations stay accessible, so move each GPT’s instructions and files and test the replacement (OpenAI, custom GPT retirement FAQ).
What should employees learn about ChatGPT?
Settings protect you only if people use the tool well. ChatGPT training for staff should cover:
- Everyday jobs: summaries, first drafts, plain English explanations, plans and rewrites. Give it the material, the reader and the shape, then steer with follow-ups.
- What can go in. We teach a traffic light rule. Green is public or non-sensitive. Amber is internal, such as plans and anonymised data, and goes only into the work account. Red is personal, confidential or secret, and stays out unless that exact use has been approved.
- Files and images: ask questions with clause or page references, delete name columns before uploading a spreadsheet, and crop photos, because ChatGPT reads everything in an image.
- Checking every figure, name, date and claim. Search and deep research give sources, so open them and go to the original.
- Their own settings, and what to do when something goes wrong.
A simple ChatGPT policy for staff
Your AI policy for employees sets the overall rules. Staff also need a short ChatGPT version. Adapt this:
- Use ChatGPT for work only in our workspace, signed in with your work email. Never put work information into a personal account.
- Green can go in. Amber goes only into the work account. Red stays out unless that use has been approved.
- Never paste passwords, card or bank details, anyone’s health or HR information, or anything under an NDA.
- Remove names and identifiers the task does not need.
- Check every fact, figure and source before you use or send the output. You own what you send.
- Decisions about people, such as hiring, discipline and pay, are made by people and follow HR’s process.
- Share projects and chats with named colleagues only.
- Report anything that went in by mistake to IT or the data protection lead the same day. Deleting the chat does not undo it.
How do you know ChatGPT training has worked?
Completion figures alone tell you little. At 30 and 90 days, look at:
- Records: who completed which course, when, and their quiz results.
- Use: the workspace usage figures your plan provides.
- Behaviour: an anonymous pulse survey asking whether anyone still uses a personal account for work.
- Quality: managers sample AI-assisted work for checked figures and sources.
- Reports: a few early reports of mistakes usually mean people know the rule.
- Value: real examples from each team of time saved.
Review every quarter and after big ChatGPT changes. If you provide or deploy AI in the EU, these records also help with Article 4 of the EU AI Act, explained in our guide to AI literacy training for employees.
ChatGPT courses for your staff
There are three ways to start, all online and self-paced on a phone, tablet or computer:
- AI at Work: The Essentials is free with a free account and no card. In about 20 minutes it covers the traffic light rule, approved tools and shadow AI, a first good prompt and checking results.
- ChatGPT for Work is a 20 minute course built around the settings and habits in this guide: data controls, memory, everyday jobs, files, projects, the custom GPT retirement, search, deep research and voice. Pass the end quiz to get a Capytech certificate of completion. £9 including VAT.
- All Access gives you all 24 courses for 12 months, including Prompting That Works, Writing with AI and AI Safety and Data Protection alongside ChatGPT for Work, plus every new course we add. £49 including VAT, or £29 until 31 January 2027.
For teams of 5 or more, All Access is £39 a person after the launch price ends. Talk to us about larger teams, or see the Capytech AI Academy for AI training across the whole organisation.
Always updated
AI changes every week. Don’t worry, so do we. Every course in our store, not only ChatGPT for Work, is checked every week against the latest ChatGPT, Microsoft Copilot, Claude and Gemini updates and against the law and guidance. When a setting is renamed, a feature is retired or a rule changes, we update the course, usually the same week. The account switching and custom GPT retirement above show why that matters. Each course page shows the date of its last check, so you know your staff are learning the tools as they are today, and every update is included in your 12 months of access at no extra cost.
Frequently asked questions
Only in the right account and within your rules. ChatGPT Business and Enterprise do not use your content for training by default, have admin controls, and OpenAI offers a Data Processing Addendum for them. Even then, keep health records, HR matters, passwords and anything under an NDA out unless that use has been approved.
It is best not to allow it. Your organisation has no contract with OpenAI covering a personal account and no admin control over it, and personal plans can use chats for model training unless the user opts out. Give people an approved work account and make the rule clear in your policy.
Not by default. OpenAI says it does not train on business data unless you explicitly opt in, for example through its feedback mechanisms. Workspace admins can also control how long data is kept.
That depends on how your organisation uses it. You need a lawful basis for any personal data, a processor contract such as OpenAI’s Data Processing Addendum for Business or Enterprise, a DPIA where the risk is high, and staff who share only what a task needs. Ask your data protection lead to approve the setup first.
No. The safety rules and everyday habits apply on every plan, and most can be practised on the free version. Allowances and admin controls vary by plan, so training should show people what their own account can do.
AI changes every week. Don’t worry, so do we. Every week we check each course against the latest ChatGPT, Microsoft Copilot, Claude and Gemini updates, against the law and guidance, and for every fact and link. When a setting is renamed or a feature is retired, we update the course, usually the same week, and the course page shows the date of the last check. Updates are included in your 12 months of access at no extra cost.
Train your whole team to use AI safely
The Capytech AI Academy gives every employee practical, safe AI skills in short lessons, starting with the AI Licence.