How to Give AI Access to Your Business Data Safely (And What Never to Share)

Quick answer

You give AI access to business data safely by using business tier tools that exclude your data from model training by default, sending each tool only the minimum data the task needs, completing a data protection impact assessment and processing agreement before any personal data is involved, and never sharing credentials, special category personal data, NDA material, or unpublished financials with any AI tool.

Somebody in your business pasted customer data into a free AI chatbot this week. I'd put money on it. Microsoft commissioned Censuswide to survey just over 2,000 UK employees in October 2025, and 71 percent admitted using unapproved consumer AI tools at work, with 51 percent doing it every week. That's not a fringe behaviour any more. That's the default state of a British workplace in 2026, and it's happening whether you've written a policy or not.

Here's the short answer before we go deep. You give AI access to your business data safely by doing four things: use business or enterprise tier tools that contractually exclude your data from model training, send each tool only the minimum data it needs for the specific task, put a data protection impact assessment and a processing agreement in place before anything touches personal data, and draw a hard line around the categories that never go in at all, which for me means passwords and credentials, special category personal data, anything under NDA, and unpublished financials. Everything else in this article is the detail behind those four moves, grounded in what the ICO and the NCSC actually require of UK businesses, with real prices in pounds.

I've set up AI access for my own studio and helped a handful of other small UK businesses do the same, and I've watched people get this badly wrong in both directions. Some firms hand an AI assistant the keys to their entire Google Drive on day one. Others ban everything, which just pushes staff onto personal phones where nobody can see what's being shared. Neither approach survives contact with reality.

Why This Stopped Being Optional

The genie is out. The question is no longer whether your team uses AI with business data, it's whether they do it through channels you control.

The UK numbers are stark. Alongside Microsoft's 71 percent figure, a Turbotic survey of more than 1,000 senior UK decision makers found that 88 percent believe unapproved AI is already in use inside their organisation, and 51 percent fear staff are feeding sensitive company data into those tools. The department most often named for unauthorised use was IT itself, at 36 percent, followed by customer service, marketing, and sales. When the people responsible for controlling the problem are its biggest offenders, a ban clearly isn't the answer.

The risk isn't theoretical either. The Samsung incident remains the textbook case: engineers pasted confidential source code into ChatGPT while debugging, and the company responded by restricting generative AI across the business. As the benchmark compiled by Technology Radius puts it, once data goes into a public tool, the company loses control over where that information goes, even when the employee meant no harm.

And this is the bit UK businesses keep underestimating: when the data in question is personal data, this isn't just a commercial embarrassment, it's a regulatory matter. Which brings us to the rules.

The Rules That Actually Apply in Britain

Forget what you've read about American lawsuits and the FTC. In the UK, the framework is UK GDPR and the Data Protection Act 2018, enforced by the Information Commissioner's Office, the ICO. The ICO has published dedicated guidance on AI and data protection which makes one thing very clear: the ordinary principles of data protection law, lawful basis, minimisation, purpose limitation, accuracy, and accountability, apply in full to AI. There is no AI exemption, and "the model is a black box" is not a defence.

Two pieces of the framework matter most for our purposes.

First, the DPIA. A data protection impact assessment is a structured document explaining what data you're processing, why, where it goes, and how you're keeping it safe. Under UK GDPR you must carry one out where processing is likely to result in high risk to individuals, and as Data Protection People note in their compliance guide, the regulator treats AI as a high risk technology, so a DPIA is strongly recommended before you connect AI to personal data. The ICO's updated guidance goes further: your DPIA should show you considered less risky alternatives and explain why you didn't choose them. It sounds bureaucratic. In practice it's a one or two page exercise that forces exactly the thinking this article is about, and the ICO publishes free templates aimed at smaller organisations.

Second, the penalties. The ICO can fine up to £17.5 million or 4 percent of total worldwide annual turnover, whichever is higher, for the most serious breaches, with a lower tier of £8.7 million or 2 percent for other infringements. Those figures come straight from the ICO's own fining guidance. Fines are discretionary and the ICO applies them proportionately, so a small business won't get the maximum for one bad paste. But an investigation alone is disruptive and expensive, and the reputational damage of telling clients their data went into a chatbot is its own punishment.

The legal landscape also moved recently. The Data (Use and Access) Act 2025 became law on 19 June 2025. It amends rather than replaces UK GDPR, with its biggest AI relevant change being to the automated decision making regime, and from February 2026 it also raised maximum fines for serious electronic marketing breaches to the same £17.5 million level. As GDPR Local's overview of ICO enforcement notes, the regulator's current strategy runs through 2026 with generative AI, agentic AI, and automated decision making named as priority areas. In plain terms: the ICO is actively looking at exactly the thing you're about to do.

One more UK institution deserves a mention. The National Cyber Security Centre, the NCSC, has been publishing advice on AI since early 2023, and its core warning has aged well: be careful what you put in a prompt, because queries containing sensitive data raise real concerns, and if you're sending information to an external service you must assume it can be stored. The NCSC also advised organisations automating business tasks to prefer hosted private services over public consumer tools. That was written before most of the business tiers existed, and it's essentially a description of them.

What Never Goes In, Full Stop

Before we talk about doing it safely, let's talk about the categories I treat as radioactive regardless of which tool or tier is involved. This is the "what never to share" half of the title, and I hold these lines even on enterprise contracts with every protection in place, because tools get misconfigured, accounts get shared, and screenshots get taken.

Passwords, API keys, and credentials. Never, in any form, in any tool. An AI assistant doesn't need your database password to help you, and once a credential has been in a chat log you should consider it burned and rotate it. This is the single most common mistake I see technical staff make, usually by pasting an error log or a config file without scrubbing it first.

Special category personal data. Under UK GDPR this means health information, sexual orientation, religious beliefs, political opinions, ethnic origin, trade union membership, genetic and biometric data. This data carries extra legal protection, and serious failures involving it sit in the ICO's higher fining tier. If your business handles any of it, an AI workflow touching that data needs proper legal advice, not a blog post.

Anything covered by an NDA or client confidentiality. Your contract with a client almost certainly doesn't permit disclosure to a third party AI provider. Even with a no training guarantee, you're still transmitting the material to another company's servers. If you want AI help on confidential client work, either get the client's written agreement or anonymise the material so thoroughly that nothing identifies them.

Unpublished financials and market sensitive information. The NCSC flagged early on that prompting a chatbot with non public financial information can create genuine legal exposure. For most SMEs the risk is less exotic: your margins, your pricing strategy, and your acquisition talks simply don't belong on anyone else's infrastructure without contractual protection.

Other people's personal data where you have no lawful basis. This is the quiet one. Pasting a customer email thread into a free chatbot to draft a reply is processing that customer's personal data through an unauthorised processor. Multiply that by every employee doing it weekly and you have a systemic compliance failure that nobody signed off.

Everything outside those categories, general drafting, published information, anonymised data, your own marketing copy, internal process documents with nothing sensitive in them, is negotiable, and the rest of this article is about how to negotiate it.

The Tier Problem Nobody Explains Properly

Here's the thing that trips up almost everyone, including people who think they've paid their way to safety: with most AI providers, paying for a personal subscription does not change how your data is treated.

The pattern across the industry is consistent. Free and personal paid plans use your conversations to train future models by default, with an opt out buried in settings that most people have never touched. Business and enterprise plans exclude your data from training by default. As one analysis of the ChatGPT tiers put it, the default is the one that favours the company, and it's written down in the help pages that almost nobody reads. A review of the wider landscape by The Professor found the same pattern across ChatGPT, Gemini, Claude, Copilot, Grok, and Perplexity: consumer plans opt you in, business plans opt you out.

So the £20 a month ChatGPT Plus subscription your marketing manager expensed is, from a data protection standpoint, nearly identical to the free tier unless they've manually disabled training in the data controls. I've checked this setting on other people's accounts more times than I can count, and it has been switched on almost every time. If your business runs on individual consumer subscriptions, your first practical action from this article is a ten minute audit of that toggle on every account. Your second is planning the move to a proper business tier, because opt outs are a sticking plaster; contractual defaults are the fix.

What do the business tiers actually cost in the UK? Here's the honest picture as of my research for this piece, with the caveat that these providers bill in US dollars, so the pound figures are approximate and move with the exchange rate.

ChatGPT Business (the old Team plan) is $20 per user per month on annual billing after OpenAI's April 2026 price cut, roughly £16 plus VAT, with a two seat minimum. It excludes your data from training by default and adds an admin layer. For most small businesses this is the sensible entry point into OpenAI's ecosystem. ChatGPT Enterprise is quote only; procurement reporting gathered by Beam Cloud puts 2026 contracts around $45 to $75 per seat with a reported floor of about 150 seats, which prices it out of genuine SME territory. Usefully for British firms, OpenAI launched UK data residency in October 2025, so eligible business customers can keep data at rest in the UK.

Claude Team from Anthropic runs at roughly £24 per seat per month on annual billing with a five user minimum, and Claude's enterprise tier now has published pricing of $20 per seat plus usage billed at API rates. Same no training default on the business tiers.

Microsoft 365 Copilot is a $30 per user per month add on, roughly £24, on top of a qualifying Microsoft 365 licence, and note that the base licences themselves went up in 2026 and volume discounts on the add on expired in June 2026, so the real cost is the bundle, not the sticker. Its data protection story is genuinely strong for firms already living in Microsoft 365: prompts and documents stay inside your existing tenant, covered by the sensitivity labels, conditional access, and compliance controls you already run, and the data isn't used to train external models. But there's a catch I'll come back to: Copilot inherits your existing permissions, and if your SharePoint permissions are a mess, Copilot makes the mess searchable.

For completeness, if you have developers in house, the API route is often the cleanest of all. Data sent through the major providers' APIs is excluded from training by default, retention is limited, and you control exactly what gets sent. You pay per use rather than per seat, which for light workloads can cost pennies.

How to Actually Connect Your Data

Right, the practical sequence. This is roughly the order I follow when setting this up for a business, and every step exists because skipping it has burned someone I know.

Start with an inventory, not a purchase. You cannot govern what you can't see, as the governance guide from Ergos puts it, and their advice to check web filtering and network logs for AI traffic before doing anything else is exactly right. Find out what's already in use and what data is already flowing. In every business I've looked at, the answer surprised the owner.

Pick one narrow, low risk use case first. Not "roll out AI", but "summarise internal meeting notes" or "draft first versions of marketing copy". The seven point checklist published by LAN Support makes the point well: "we want to use AI" is not a business purpose, and a defined purpose is what everything downstream hangs on. It's also what your DPIA describes, which is why vague rollouts produce vague, useless DPIAs.

Do the DPIA before you connect anything to personal data. One to two pages: what data, whose data, what for, which provider, which tier, where it's stored, how long it's kept, what could go wrong, what you've done about it. If you have a data protection officer, they'll have a template; if you don't, the ICO's SME resources are free and genuinely usable. This document is your evidence of accountability if anything ever goes wrong, and the ICO expects it to show you weighed less risky alternatives.

Sign the data processing agreement and check the terms. Any AI provider processing personal data on your behalf is a processor under UK GDPR, and you need a data processing agreement in place, which the business tiers all offer as standard. While you're in the paperwork, confirm three things in writing: no training on your data by default, where the data is stored and whether UK or European residency is available, and what the retention period is. If a vendor can't answer those three questions crisply, walk away. Plenty can.

Apply data minimisation ruthlessly. This is the principle that does the most protective work in practice. As the practitioners at GoAgentic phrase it in their UK GDPR data safety guide, send the tool only the data it needs for the job: an agent drafting a customer reply doesn't need the full client database, and one processing an invoice doesn't need access to salary data. Concretely, that means scoping integrations to specific folders rather than whole drives, redacting names and account numbers from pasted text where they're irrelevant to the task, and resisting every vendor's cheerful suggestion to "connect everything for the best experience".

Fix your permissions before you switch on anything that searches them. This is the Copilot trap and it applies to any tool that indexes your existing file store. AI powered search makes years of quiet oversharing suddenly visible: the salary spreadsheet someone saved to a shared drive in 2021, the board minutes with open access. Run a permissions review on whatever the AI will see, on the assumption that anything visible to a user is now one natural language question away.

Put monitoring and DLP around it. Data loss prevention, DLP, is software that spots patterns like card numbers, credentials, and personal data leaving your network and blocks or flags them. Ergos recommend DLP rules around AI traffic with human review on edge cases, and I'd echo that for any business above about ten staff. Below that size, you can get most of the value from a clear policy plus periodically reviewing the admin logs your business tier provides, which is itself a reason to be on a business tier.

Write the one page policy and train people on it. Not a twelve page legal document. One page: these tools are approved, this data never goes into any AI tool, here's who to ask when unsure. The UpGuard research reported by Cybersecurity Dive found fewer than half of workers understood their company's AI policy, while 70 percent knew of colleagues inappropriately sharing sensitive data. A policy nobody reads protects nobody. Fifteen minutes in a team meeting, with real examples of what's fine and what isn't, beats any document.

Agents Are a Different Animal

Everything above covers the chat style tools most businesses start with. Agentic AI, tools that don't just answer but act, reading your inbox, updating your CRM, moving files, running multi step tasks, deserves its own paragraph of caution, because the blast radius is different. A chatbot with bad data gives you a bad answer. An agent with broad access takes bad actions, at speed.

The NCSC published guidance on exactly this, and its summary of the risks is worth internalising: agents inherit the known weaknesses of language models, including prompt injection, where malicious instructions hidden in content the agent reads can hijack its behaviour, and they add broader system access, unpredictable goal interpretation, and actions that arrive faster than humans can review them. The NCSC's prescription, as summarised in Bratby Law's analysis of the guidance, is to start small, confine agents to low risk tasks, apply established security controls from the outset, and keep meaningful human oversight throughout.

My own rule is simpler: an agent gets read access before write access, gets its own scoped account rather than piggybacking on a human's, and never gets irreversible powers, no deleting, no sending money, no external emails without a human click. If a vendor tells you their agent needs full admin access to work properly, that tells you more about the vendor than about your requirements. The ICO has also signalled it's watching this space, with its early views on agentic AI stressing that the growing volumes of personal data these systems touch remain fully subject to UK GDPR.

Where the Common Advice Is Wrong

A few points where I'd push back on things you'll read elsewhere.

"Just block AI tools" is the worst option on the table. Blocking before you've provided a sanctioned alternative pushes usage onto personal devices and personal accounts, where you lose all visibility and all your contractual protections. The UK survey data shows staff are using these tools anyway. Offer a governed tool that does the job at least as well, then close off the rest. Block last, not first.

"On premise or nothing" is overkill for almost every SME. You'll occasionally meet a consultant insisting that the only safe AI is a model you host yourself. For a defence contractor, maybe. For a normal British business, a business tier from a major provider with a data processing agreement, no training default, and ideally UK data residency is a defensible, ICO compatible position, and it's what the NCSC's preference for hosted private services over public tools points towards. Self hosting swaps a well resourced provider's security team for yours.

"We're too small for the ICO to care" misreads the risk. True, the ICO won't fine a five person firm £17.5 million. But fines aren't the main exposure at that size. The main exposure is a client discovering their confidential data went into a chatbot, an insurance claim complicated by an undocumented data flow, or the sheer cost in time of responding to a complaint with no DPIA and no paper trail. The paperwork isn't for the regulator. It's for you, on your worst day.

And one warning by name rather than by category: be careful with the free consumer tiers of every major assistant for anything work related, full stop. Not because the companies are villains, but because the defaults are against you, the retention periods are long, and none of the business protections apply. The gap between the free tier and the roughly £16 to £24 per seat business tiers is the cheapest risk reduction you will buy this year.

The Questions I'd Ask Any Vendor

If you take one checklist from this piece, take this one. Before connecting any AI product to business data, get written answers to: Is our data used to train your models, and is that the default or an opt out? Where is our data stored, and is UK or European residency available? What is the retention period, and can we configure it? Will you sign a data processing agreement under UK GDPR? What admin controls, audit logs, and access management do we get? What happens to our data when we leave?

Six questions, ten minutes of a sales call. The good vendors answer instantly because they're asked daily. The evasive ones have just saved you a subscription.

What to Do This Week

If you want to give AI access to your business data safely and you're starting from the typical position, unofficial usage everywhere and no policy, here's the week one version. Audit the training opt out on every individual AI account currently used for work. Write the one page policy, especially the never share list: credentials, special category data, NDA material, unpublished financials, and personal data without a lawful basis. Pick one low risk use case and price up a business tier for the people who'd use it, budgeting roughly £16 to £24 per seat per month depending on provider. And start the DPIA the day you decide to connect anything to personal data, not the day after something leaks.

None of this is glamorous, and that's rather the point. The businesses getting AI right aren't the ones with the flashiest tools. They're the ones who put boring, sensible controls around a specific use case before the problem found them. The technology will keep changing; the discipline of minimum necessary data, contractual protection, and a hard never share line will not.

Sources

Microsoft UK Stories, Rise in Shadow AI Tools Raising Security Concerns for UK: https://ukstories.microsoft.com/features/rise-in-shadow-ai-tools-raising-security-concerns-for-uk/
Onrec, Half of UK Firms Fear Staff Are Feeding Company Secrets to AI: https://www.onrec.com/news/statistics/half-of-uk-firms-fear-staff-are-feeding-company-secrets-to-ai
ICO, Guidance on AI and Data Protection: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/
ICO, The Maximum Amount of a Fine Under UK GDPR and DPA 2018: https://ico.org.uk/about-the-ico/our-information/policies-and-procedures/data-protection-fining-guidance/statutory-background/the-maximum-amount-of-a-fine-under-uk-gdpr-and-dpa-2018/
nibusinessinfo.co.uk, GDPR Penalties and Fines: https://www.nibusinessinfo.co.uk/content/gdpr-penalties-and-fines
Data Protection People, How to Ensure GDPR Compliance When Using AI: https://dataprotectionpeople.com/resource-centre/how-to-ensure-gdpr-compliance-when-using-ai/
GDPR Local, ICO Artificial Intelligence: Data Protection Rules and Enforcement: https://gdprlocal.com/ico-artificial-intelligence-navigating-ai-compliance-and-governance/
Computer Weekly, NCSC Warns Over AI Language Models but Rejects Cyber Alarmism: https://www.computerweekly.com/news/365532535/NCSC-warns-over-AI-language-models-but-rejects-cyber-alarmism
Bratby Law, NCSC Agentic AI Guidance and Article 32: https://bratby.law/ncsc-agentic-ai-guidance/
Ergos, AI Governance for UK Businesses: https://ergos.uk/blog/ai-governance-for-uk-businesses/
LAN Support Systems, AI and GDPR for UK Businesses: https://lansupport.co.uk/compliance/ai-and-gdpr-for-uk-businesses/
GoAgentic, AI and UK GDPR: A Practical Data Safety Guide: https://goagentic.co.uk/blog/ai-uk-gdpr-data-safety-guide/
The AI Consultancy, Claude vs ChatGPT Enterprise: UK Anthropic Consulting View: https://theaiconsultancy.ai/blog/claude-vs-chatgpt-enterprise-uk-smes-2026
Beam Cloud, ChatGPT Enterprise Pricing Guide 2026: https://www.beam.cloud/BLOG/chatgpt-enterprise-pricing
Coworker AI, ChatGPT Enterprise Pricing in 2026: https://coworker.ai/blog/chatgpt-enterprise-pricing
LLM Gateway, Microsoft Copilot Enterprise Pricing in 2026, Explained: https://llmgateway.io/blog/microsoft-copilot-enterprise-pricing
Greencube, Does ChatGPT Train on Your Data? The Honest Answer: https://www.greencube.app/does-chatgpt-train-on-your-data
The Professor, Your AI Tool Is Training on Your Conversations: https://www.theprofessor.info/insights/your-ai-tool-is-training-on-your-conversations
Cybersecurity Dive, Shadow AI Is Widespread and Executives Use It the Most: https://www.cybersecuritydive.com/news/shadow-ai-employee-trust-upguard/805280/
Technology Radius, 20 Shadow AI Statistics 2024 to 2026: https://technologyradius.com/statistic/shadow-ai-statistics-2024-2026

Frequently asked questions

Is it safe to put company data into ChatGPT?

It depends entirely on the tier. Free and personal paid plans train on your conversations by default unless you opt out in settings, so they are not suitable for company data. ChatGPT Business excludes your data from training by default and costs about £16 per seat per month, which makes it the sensible entry point for business use.

What should you never share with an AI tool?

Passwords, API keys and other credentials, special category personal data such as health information, anything covered by an NDA or client confidentiality, unpublished financials, and other people's personal data where you have no lawful basis. These lines hold even on enterprise contracts, because tools get misconfigured and accounts get shared.

Does UK GDPR apply to AI tools?

Yes, in full. The ICO's guidance on AI and data protection makes clear that lawful basis, data minimisation, purpose limitation, accuracy and accountability all apply to AI, and there is no exemption because a model is hard to explain. The Data Protection Act 2018 and the Data Use and Access Act 2025 also apply.

Do I need a DPIA before using AI in my business?

If the AI will process personal data, almost certainly yes, because the regulator treats AI as a high risk technology. A data protection impact assessment is a short structured document covering what data you process, why, where it goes and how you protect it, and the ICO expects it to show you considered less risky alternatives. The ICO publishes free templates for smaller organisations.

How much do business AI tools cost in the UK?

Roughly £16 to £24 per seat per month for the main options. ChatGPT Business is about £16 plus VAT per user on annual billing, Claude Team is around £24 per seat, and Microsoft 365 Copilot is about £24 as an add on to a qualifying Microsoft 365 licence. These providers bill in dollars, so pound figures move with the exchange rate.

What is shadow AI and why does it matter?

Shadow AI is staff using AI tools without approval or oversight. Microsoft research found 71 percent of UK employees have used unapproved AI tools at work, and a Turbotic survey found 88 percent of UK decision makers believe it is happening in their organisation. It matters because data entered into unapproved tools leaves your control with no contractual protection.

Can the ICO fine my business for misusing AI with personal data?

Yes. The ICO can fine up to £17.5 million or 4 percent of worldwide annual turnover for the most serious breaches, with a lower tier of £8.7 million or 2 percent. Fines are discretionary and proportionate, but even without a fine, an investigation with no DPIA and no paper trail is costly and disruptive.

Should I just block AI tools at work instead?

No, blocking first is the worst option because staff move to personal devices and accounts where you have no visibility or contractual protection. Provide an approved business tier tool that does the job at least as well, write a one page policy, then close off the rest. Block last, not first.

Are AI agents riskier than chatbots?

Yes, because they act rather than just answer, so mistakes become actions instead of bad text. The NCSC advises starting small, confining agents to low risk tasks and keeping meaningful human oversight. A sensible rule is read access before write access, a scoped account of its own, and no irreversible powers such as deleting data or sending money.

Is paying for a personal AI subscription enough to protect my data?

No. Personal paid plans generally treat your data the same way as free plans, training on your conversations by default unless you manually opt out. Real protection comes from business tiers, where no training is the contractual default and you get admin controls, audit logs and a data processing agreement.