Yes, if the tool is set up for business use. That means a business plan that doesn’t train on what you put in, a written contract that makes the provider your processor under UK GDPR, a clear rule on what staff may paste in, and a person checking what comes out. Fenwick Automation builds every system on that set-up, on a plan the client owns, because it is the first thing owners ask about.
Is it safe for a UK small business to put customer data into AI?
It is the question that stops most owners before they start. Simply Business surveyed 1,842 UK small business owners for its 2026 SME Insights Report. Almost half, 47%, now use these tools. Of the reasons the rest gave for holding back, security and privacy came top, named by 44%.
The worry is reasonable. It is also answerable, because the risk sits in a few places you can check yourself.
This is a plain-English guide, not legal advice. If your use is unusual, or large, ask a data protection adviser.
Does UK GDPR apply when you paste customer details into a chatbot?
Yes. A customer’s name, address, phone number or job details are personal data. Typing them into a chatbot is processing them, and your business is still the controller. That means you decide why the data is used, you are responsible for keeping it safe, and you have to tell people what happens to it.
The tool doesn’t change any of that. It only changes who else holds the data while the work is done.
The Information Commissioner’s Office publishes guidance on artificial intelligence and data protection. It says that guidance is under review after the Data (Use and Access) Act 2025, so check the current version before relying on any detail.
Where does the risk actually sit?
In three places, and none of them is the technology itself.
Personal accounts. A free or personal chatbot account is a consumer product. Depending on its settings, what you type may be used to train the provider’s models, and there is no processing contract between the provider and your business. A member of staff pasting a customer’s complaint into one from their own phone is the most common way this goes wrong, and you may never find out it happened.
No contract. Under UK GDPR, a provider that handles personal data on your behalf must do it under a written contract saying what it may and may not do with that data. Business plans come with one, usually called a data processing addendum. Personal accounts don’t.
Unchecked output. These tools can get a name, a date or an address wrong. If that goes to a customer unread, an accuracy problem becomes a data protection problem as well, because the law expects personal data to be accurate.
What makes it safe enough to use?
Five checks. You can make all of them yourself in an afternoon.
- Use a business plan, not a personal account. Check in the provider’s own terms that it does not train on your inputs and outputs by default.
- Keep the processing contract. Find the provider’s data processing addendum and file a copy with your records.
- Decide what goes in. Only the data the job needs. A quote needs the address and the scope of work. It rarely needs a date of birth or a bank detail.
- Tell people. Your privacy notice should say that you use an outside service to process customer data, and name it or the kind of service it is.
- Keep a person checking. Anything that goes to a customer, or affects money or safety, is read by someone who knows the job before it leaves.
Where processing is likely to be high risk, such as decisions made about people with no person involved, UK GDPR requires a data protection impact assessment first. Most small-business paperwork isn’t that. A system drafts, a person decides. For that kind of work, the five checks above are where to start.
How does Fenwick Automation handle customer data?
The same five checks, built into how every system is set up.
The system runs on a seat in a Claude Team plan that the client buys, in the client’s own name and on the client’s own card. Claude is the model made by Anthropic. Anthropic says it does not use inputs or outputs from its commercial plans to train its models by default, and its commercial terms include a data processing addendum. The one exception it names is feedback: if someone presses the thumbs up or thumbs down, that conversation is sent to Anthropic. On a Claude Team plan the owner can switch feedback off.
The paid audit lists which documents and which fields a build uses, so the system is given what the job needs and no more. Then it drafts and a person checks anything that matters. It drafts. You check. You sign.
Because the plan is yours, so is the data. Here is who owns the automation when the agency leaves, and what happens to it if you stop.
So is it safe?
It is as safe as the set-up around it. A business plan, a contract, a short rule for staff, a line in your privacy notice and a person checking the output cover most of the risk for most small businesses. A personal account with customer details pasted into it covers none of it.
If accuracy worries you more than privacy, here is whether you can trust it to do your business paperwork.
Next step
Book the 10-minute call. Tell us which document you’d want drafted and what customer details it holds. You’ll leave knowing whether it fits, how the data would be handled, and with a rough estimate.