Can your staff put customer data into ChatGPT? A one-page AI policy for small firms

Here's a scene that's likely playing out in an office near you. Someone's got a long email from an unhappy customer. They paste it into a free AI tool, ask for a polite reply and get a pretty good one. Five minutes saved.

They've also just shared a customer's name, details and complaint with a third party, and nobody at the business knows.

This isn't a reason to ban AI. It is a reason to write down some rules. Security and privacy is the barrier most often named by UK small business owners in Simply Business's 2026 survey (44%), and 51% in IONOS and YouGov's survey fear data theft or third-party access. Meanwhile, Pax8's research found 24% of AI-engaged UK small and mid-sized firms had found unapproved AI tools, workflows or agents operating in their business in the past six months.

A note before we go on: we're a creative and digital agency, not lawyers. This is a practical starting point. Have your policy checked by a legal or data protection adviser, especially if you handle sensitive data or work in a regulated sector.

So is it allowed?

There's no simple yes or no. It depends on what the information is, which version of which tool you're using and what the supplier does with it.

If the information identifies a person, UK data protection law applies whichever tool you use. You remain responsible for it. The ICO expects organisations using AI with personal data to be open about why it's being used, how long it's kept and who it's shared with. That guidance is under review after the Data (Use and Access) Act, so check the ICO's site for the latest version. The same Act also means organisations need a data protection complaints process, a requirement that took effect on 19 June 2026.

And it's not only personal data. Your contracts, pricing, client lists and unreleased plans deserve protection, too.

The questions to ask about any AI tool

1. Does the supplier use what we enter to train its models? Can we switch that off?
2. Where is the data stored, and for how long?
3. Is there a data processing agreement, or suitable business terms?
4. Who in our business has access, and can we remove them when they leave?
5. Is this a personal account, or one the business controls?

That last point catches many firms out. Free and personal accounts often have different terms from business plans, so check the terms for the version you're actually using.

The one-page policy

Copy this, change what you need and put your own name on it.

[Your business name]: how we use AI

Last updated: [date]. Owner: [name].

Why we have this policy. AI can save time, and we want you to use it. These rules protect our customers, our business and you.

Approved tools. You may use: [list tools and account types]. If you want to try something else, ask [name] first. We'd much rather you asked than hid it.

🟢 Go ahead - Brainstorming and general research - Drafting content with no personal or confidential information - Rewording your own general text - Summarising public information

🟠 Take care: approved tools only, with a check - Customer-facing emails and marketing copy - Anything summarising internal documents - Removing names and details before you use AI on a real situation

🔴 Never, unless [name] has specifically approved the tool and the use - Customer, patient or client personal data - Staff records - Financial details, passwords or login information - Contracts or commercially confidential documents - Anything sensitive, including health details

You're responsible for what you send. AI can be wrong while sounding completely certain. Check facts, figures and names. Anything that goes out from us is ours, however it was written.

Decisions about people. Don't rely on AI alone for decisions that affect people, such as hiring, firing or customer complaints. A person makes the call.

Be honest with customers. If customers are talking to an AI assistant, we tell them, and we make it easy to reach a person.

If something goes wrong. If you've entered something you shouldn't have, tell [name] straight away. You won't be in trouble for speaking up quickly. Personal data incidents can have legal deadlines, so time matters.

Reviewing this policy. We'll look at this every six months, as the tools change quickly.

Making it stick

A policy in a forgotten folder protects nobody. Three things make the difference.

Find out what's already happening. Ask your team, without blame, what they're using. Amnesty works better than interrogation. You'll learn what's useful, as well as what's risky.

Give people a good alternative. People use personal accounts because they help them get the job done. Provide an approved tool and they've got less reason to go elsewhere.

Review anything you build. Pax8 found that only 23% of AI-engaged UK firms have a formal, documented review process for internally built AI. With today's tools, anybody can connect AI to your systems in an afternoon. Decide who has to sign that off before it touches real data.

Using AI with sensitive information

A policy doesn't have to mean "never". Sometimes the whole point of a system is to work with real customer information, and that's possible with the right planning.

The Beehive Legal AI Voice Agent we built at Just Creative People handles calls from people who may be worried about a legal matter. So the voice and behaviour were carefully taught, and leads go to the firm's CRM. And when we run AI projects, we explain what each tool uses and where your data goes before anything is switched on.

The Just Creative People Client Portal takes a similar approach. Clients see only their own projects, and freelancers see only the projects they're assigned to, with costs hidden. Good AI use starts with those same questions. Who can see this? Where does it go? What happens if something goes wrong?

Do it this week

Take the template. Spend an hour filling it in. Talk to your team on Friday. It won't be perfect, but it'll be a lot better than the rules most small firms have at the moment, which are none at all.