Someone on Your Team Is Pasting Client Data Into ChatGPT

Workplace AI policy: a one-page guide for UK SMEs

Picture this. Someone in your business used AI last week. Your brilliant team had a long email to write in twenty minutes, so they opened ChatGPT. They pasted a customer complaint and asked for a polite reply. They dropped a spreadsheet into Copilot. They asked Gemini to summarise a document. A workplace AI policy wasn’t in sight.

It saved time. The work went out. Job done. But nobody told them not to. Nobody told them how. And that gap, between “everyone is using it” and “we have no rules about it”, is where risk sits. A clear workplace AI policy closes that gap fast.

Why a workplace AI policy matters

Let’s keep it practical. I’m not here to ban anything. AI can help small teams get more done with less faff. What I want is guardrails.

• You are the data controller under UK GDPR. If staff paste personal data into public tools, it’s your risk to explain.
• AI writes confidently. It can also be confidently wrong. If that error reaches a client, it lands as your mistake.
• Personal accounts mean zero visibility and a painful exit when people leave.
• Tools can import bias into hiring, rating and reward. “The software did it” won’t wash.

Suggested stat to include: Recent UK surveys show meaningful adoption of AI tools by SMEs. Source candidates: ONS or DSIT technology adoption reports (2024–2025). Add a verified percentage and date.

Suggested expert quote: An ICO spokesperson or data protection lawyer commenting on putting personal data into public AI tools. Add an exact, cited line.

The four risks to fix now

One. Data going into public tools

When someone pastes a customer’s details, a colleague’s sickness record, a supplier contract or your pricing into a public AI tool, that information leaves your business. It may be stored elsewhere or processed outside the UK. Once it’s gone, it’s gone.

Here’s the sting. Under UK GDPR, you’re the data controller. It doesn’t matter that you didn’t approve it. If personal data went into a tool your business never cleared, you own that problem.

• Control: Your workplace AI policy must state what staff can and can’t paste into AI tools. No personal data. No confidential client or pricing data. No contracts or tenders.

Two. Confidently wrong output going to a customer

AI can fabricate facts and write plausible nonsense. If someone ships that out under your letterhead, it’s your reputation, and sometimes your contract, on the line.

• Control: Your workplace AI policy should say a human checks and owns anything that leaves the business. AI drafts. People decide.

Three. Personal accounts doing company work

If staff use personal logins and devices, you lose the record, the version history and the lot walks out when they leave.

• Control: Your workplace AI policy should require company accounts on company systems for any business use, with audit and offboarding in place.

Four. Bias and unfairness in people decisions

Sifting CVs, scoring interviews or drafting performance ratings via AI might feel efficient. It also risks discriminatory outcomes you can’t explain.

• Control: Keep a human making the actual decision. Document criteria. Record reasons for selection and rejection. If AI supports, log how.

Quick view: risk to control

External resources:

• ICO Generative AI guidance (how data protection applies): https://ico.org.uk/for-organisations/ai/
• Acas: Using AI at work (employer guidance): https://www.acas.org.uk/using-ai-at-work

Why hiring is the sharp end

Recruitment is high risk. Under the Equality Act 2010, a discrimination claim can be brought by an applicant who never worked a day for you. There’s no qualifying period. If AI touches shortlisting, scoring or interview questions, you must be able to explain the process and the outcome.

Practical stance:

• Keep the human decision-maker accountable.
• Record your shortlisting criteria in Plain English.
• Keep notes that show why Candidate A progressed and Candidate B didn’t.
• If an AI tool helped, keep a copy of prompts and outputs in the company account.

What to put in your workplace AI policy

Good news. This does not need a project. One readable page is plenty. Long, unread policies are a warm blanket that hide cold risks. Short, clear and shared beats long and ignored.

Your workplace AI policy should cover:

1. Approved tools and uses

• Name the tools staff can use and for what types of tasks.
• Add a simple route to request others before use.

1. No-go data

• Spell it out: customer data, candidate data, staff data (sickness, performance, pay), confidential pricing, tenders and contracts are off limits.
• Add: “If in doubt, don’t paste. Ask first.”

1. Human review for anything external

• AI can draft. A person checks, edits and owns anything client-facing, regulatory or public.

1. Company accounts only

• Use work logins on managed devices. Keep prompts and outputs inside your systems. Offboard access when people leave.

1. Who to ask

• One named person or inbox for approvals and questions. Guessing creates risk; easy access to help reduces it.

September timing checks

Two quick timing flags to keep you lovely lot protected:

• Workplace monitoring consultation: Government is consulting on fair, transparent and responsible use of workplace monitoring technologies. If you use tools that monitor, manage or make decisions about workers, have your say. Check GOV.UK for the live consultation page and closing date. Link: https://www.gov.uk/government/consultations

• Tribunal time limits: There has been discussion about extending time limits for bringing some employment tribunal claims. Before you update policies or comms, check the current position on GOV.UK and the Employment Tribunal site. Start here: https://www.gov.uk/employment-tribunals

If either applies, add a calendar note to review your workplace AI policy and hiring process on those dates.

Ten-minute action plan

• Write your one-page workplace AI policy using the five headings above.
• Add approved tools to your IT list and switch on company accounts.
• Share the policy in a team meeting. Ask for questions. Bake in “If in doubt, ask.”
• Add a hiring note: AI can support admin, humans decide. Keep notes.
• Log where AI is used in client work. Add the human checker’s name.

FAQs

• What should a workplace AI policy include in the UK?

  • Approved tools, banned data, human review rules, company account use, an approvals contact, and a short log process.

• Is it lawful to use AI for recruitment decisions?

  • Yes, but you must comply with the Equality Act 2010 and data protection law. Keep decisions human, explainable, and documented.

• Can staff paste personal data into ChatGPT?

  • No. Treat it like posting data to an external service. Keep personal and confidential data out of public tools.

• Do we need an AI impact assessment?

  • For higher risk uses, complete a Data Protection Impact Assessment (DPIA). See the ICO link above for when a DPIA is required.

• What about copyright on AI outputs?

  • UK law is developing. If IP is important to you, use internal approvals and keep records. Seek legal advice for high-value content.

• How do we keep client work safe if we use AI?

  • Use company accounts, keep prompts/outputs inside your systems, and have a human sign-off for anything external.

Final thoughts and next steps

None of this is about fear. With a simple workplace AI policy, you get the benefits without the heartache. Set clear rules now, before you’re explaining a data breach in real time.

Want a quick health check before you roll it out? Start with our free HR Health Check. It takes a few minutes and gives you a neat red, amber, green view of your risks and priorities.

• HR Health Check: https://kateunderwoodhr.co.uk/hr-health-check
• Press coverage (why we’re trusted to translate this stuff): https://kateunderwoodhr.co.uk/about-us/press
• Manager training that turns policy into practice: Cake, Coffee and Compliance https://kateunderwoodhr.co.uk/managers

Kettle On. Standards Up. Until next time, keep buzzing and take care of your people!