ChatGPT for business in the UK: 2026 practical guide (UK GDPR, ICO, sovereign alternatives)
Quick answer: can a UK business use ChatGPT in 2026?
Yes, but on strict conditions. Three non-negotiable rules.
- Never consumer ChatGPT (free or Plus) on non-public business data. OpenAI’s consumer terms reserve compliant commercial use for the Team and Enterprise tiers. Using a personal account on client data breaches both OpenAI’s terms and UK GDPR.
- ChatGPT Team or Enterprise with a signed Data Processing Agreement for everyday business use: DPA available, training opt-out by default, admin-side audit logs, SSO on Enterprise.
- On-premises (Mistral self-hosted, Llama 3) or sovereign cloud as soon as data is sensitive — financial market data under FCA SYSC, legal privilege, NHS patient data, defence — see our local LLM in business guide.
The structural risk that remains, even on ChatGPT Enterprise, is the UK-US transfer. Since the UK left the EU, transfers to the United States rely on the UK Extension to the EU-US Data Privacy Framework, an extension signed in October 2023 and contested by the same legal community that brought down Privacy Shield in Schrems II. If a UK Schrems-equivalent ruling or a withdrawal of the extension occurs, every UK ChatGPT deployment running on US-hosted infrastructure becomes legally precarious overnight. UK organisations that want to remove this dependency are increasingly looking at European-hosted alternatives.
Why this matters now
Three things have shifted on the UK enterprise AI landscape between 2024 and 2026.
One, FTSE 100 adoption of ChatGPT Enterprise has accelerated dramatically. Major UK banks under FCA supervision, leading law firms in the Magic Circle, and a growing number of NHS-adjacent research bodies have signed Enterprise contracts — usually with Zero Data Retention and bespoke security addenda. The “ChatGPT is not for the enterprise” line is dead in the UK; OpenAI has a UK go-to-market team and enterprise customer success staff in London.
Two, the ICO has tightened its expectations. Its 2024 generative AI consultation series and the 2025 guidance on accuracy and lawful basis have made clear that UK regulators expect documented DPIAs, lawful basis analysis, and minors’ protection. The ICO has not banned anything, but it has signalled that ungoverned consumer ChatGPT use inside an organisation is a regulatory liability waiting to be enforced.
Three, the UK AI policy framework has crystallised. The UK has not adopted the EU AI Act directly, but UK businesses that touch EU users or data fall in scope. The Department for Science, Innovation and Technology (DSIT) “pro-innovation” approach combined with sectoral regulators (FCA, MHRA, Ofcom) means UK firms cannot point to a single exemption — they must satisfy both UK GDPR and, where relevant, the EU AI Act’s literacy obligation under Article 4.
The calculation has changed. Using ChatGPT in a UK enterprise is feasible and compliant — but it is no longer the default. It is a deliberate choice that has to be defended.
Three very different things called “ChatGPT”
Before any decision, kill the ambiguity. Four offerings sit under the ChatGPT brand in 2026, on the same underlying models but with radically different contractual envelopes.
| Tier | Price (UK indicative) | DPA | Retention | Hosting | Suited to |
|---|---|---|---|---|---|
| ChatGPT (free) | 0 | No | Variable, training on by default | US | Personal use only |
| ChatGPT Plus | ~17 GBP/month | No | Same as free | US | Personal use only |
| ChatGPT Team | ~20 GBP/user/month | Standard | 30 days, no training | US (limited regional) | SMEs, teams of 5-150 |
| ChatGPT Enterprise | 45-55 GBP/user/month (negotiable) | Reinforced | Configurable, ZDR available | US (configurable region) | FTSE / regulated sectors |
Technically, all four run on the same models (GPT-4o, o3-mini, etc.). The difference is entirely contractual and operational. It is the framework, not the technology, that makes ChatGPT usable in a UK enterprise.
The four UK GDPR risks specific to ChatGPT
Risk 1 — Personal-account leakage
The most common and most underestimated risk. A staff member opens ChatGPT Plus on a personal account and pastes in a client email, an HR memo, or a board paper. The data:
- Leaves the organisation’s perimeter
- Is processed by OpenAI without a DPA
- Can feed model training (default-on for personal accounts)
- Is no longer traceable from the UK side
UK GDPR consequence: an unmanaged transfer of personal data to a third country, with no lawful basis and no contractual envelope. If the ICO investigates, this is a direct breach of Articles 5, 28 and 32 UK GDPR.
Mitigation: a formal prohibition in the AI usage policy, a sanctioned alternative (Team / Enterprise account, or Mistral Le Chat Enterprise), and training that explains the difference clearly — with documented attendance for AI Act Article 4 compliance.
Risk 2 — UK-US transfer and post-Brexit fragility
Even on ChatGPT Enterprise, OpenAI’s primary infrastructure is in the United States. The legal mechanism for UK transfers is the UK Extension to the EU-US Data Privacy Framework, recognised by the UK Secretary of State in October 2023. Several UK legal commentators (notably the same circle that drove Schrems I and II) have signalled they intend to challenge it. The German BfDI and Italian Garante have already issued reservations on the underlying EU framework.
Practical consequence: if the UK Extension is suspended or invalidated, every UK ChatGPT deployment running on US infrastructure faces an emergency migration scenario. Organisations that have not pre-mapped a sovereign fallback face a hidden cost they have not provisioned for. See our GDPR-compliant AI guide and our sovereign AI guide for alternatives.
Risk 3 — Conversation retention
By default, OpenAI retains conversations for 30 days in clear text for security purposes (abuse detection). On ChatGPT Enterprise, this retention is negotiable down to zero days for selected workspaces. On Team, the 30-day floor applies.
UK GDPR consequence: this retention must be documented in the Article 30 record of processing, consistent with the principal purpose’s retention period, and auditable. Many organisations forget this entry, creating an Article 5(1)(e) breach.
Risk 4 — Algorithmic inaccuracy on identifiable individuals
ChatGPT hallucinates. When those hallucinations concern an identifiable person — a candidate wrongly described as unsuitable, a client credited with views they never held, a barrister attributed a fabricated case citation — this is a direct breach of Article 5(1)(d) UK GDPR (accuracy). The Italian Garante has already sanctioned OpenAI on this ground in 2024. The ICO has flagged accuracy as a priority concern in its 2024-2025 generative AI guidance.
Mitigation: a formal prohibition on generating identifiable content about individuals without human review, a clause in the AI usage policy, and a logged incident register.
ChatGPT Team vs Enterprise vs European alternative: UK decision matrix
For most UK organisations, the choice comes down to a three-way trade-off.
| Criterion | ChatGPT Team (~20 GBP/user/month) | ChatGPT Enterprise (45-55 GBP/user/month) | Mistral Le Chat Enterprise (~12-20 GBP/user/month) |
|---|---|---|---|
| DPA | Standard | Reinforced | Native |
| Training on data | Disabled | Disabled | Never |
| Hosting | US (limited regional) | US (configurable) | France (Scaleway) |
| UK Extension dependency | Yes | Yes | None |
| SSO / enterprise controls | Limited | Full | Available |
| Audit logs | Basic | Advanced | Available |
| Vision and multimodal | Yes | Advanced | Pixtral |
| Ecosystem (custom GPTs, plug-ins) | Internal share | Extended | Building |
| Raw performance | GPT-4o, o3-mini | GPT-4o, o3-mini | Mistral Large |
| Jurisdictional sovereignty | No | No | Yes |
| FCA / regulated-sector friction | Material | Manageable with ZDR | Lowest |
Decision tree for UK businesses
What data class is involved?
│
├── Non-sensitive business data only
│ └── User volume?
│ ├── < 50 → ChatGPT Team OR Mistral Le Chat Enterprise
│ └── 150+ → ChatGPT Enterprise OR Mistral Le Chat Enterprise
│
├── EU/UK personal data at scale
│ └── Mistral Le Chat Enterprise (removes UK Extension dependency)
│
├── FCA-regulated trading / market-sensitive data
│ └── Microsoft 365 Copilot via Azure OpenAI (UK-resident, existing FCA-cleared framework)
│ OR Mistral Le Chat Enterprise
│
└── NHS patient data, defence, legal privilege at scale
└── On-premises (Mistral self-hosted, Llama 3)Seven best practices for a UK ChatGPT deployment
1. Match the tier to volume and sector. Team up to 150 users, Enterprise above. Enterprise pricing is negotiable on annual commitment — do not pay rack rate for any deployment above 50 seats. For FCA-supervised firms, only Enterprise with ZDR is realistic.
2. Sign the DPA and archive it. Not just OpenAI’s DPA — record the sub-processor chain (Microsoft Azure for hosting, etc.). Keep dated versions. The ICO will ask.
3. Confirm training is disabled. Default-off on Team and Enterprise. Verify in the admin console and keep a screenshot as evidence. An audit will expect it.
4. Configure SSO and centralised logging. On Enterprise, integrate SSO (Microsoft Entra ID, Okta) and turn on audit logs. Without this, per-user traceability collapses and incident response is blind.
5. Record the processing. Purpose (“generative AI productivity assistance”), lawful basis (legitimate interest in most cases, with a documented LIA), categories of data, retention period, sub-processors, third-country transfers. Skip this and you breach Article 30 UK GDPR directly.
6. Issue an AI usage policy. A short, enforceable document specifying which data classes are permitted, which are prohibited, and the incident procedure. See our business AI charter guide.
7. Train staff and document attendance. EU AI Act Article 4 mandates documented AI literacy for any organisation processing EU users’ data — which catches most UK enterprises with EU customers. Without recorded training, the organisation is exposed on both UK GDPR and the AI Act. See our business AI training guide.
Where ChatGPT genuinely delivers in UK enterprises
Not all use cases are equal. Where ChatGPT (Team or Enterprise) creates real value in 2026:
- Marketing copy and external communications — tone, fluency, format constraints
- Ideation and brainstorming — variation, structure, counter-arguments
- Long-transcript summarisation (board meetings, town halls, investor calls) using o3-mini’s long context
- Code generation in structured form, particularly via custom GPTs with Code Interpreter
- Image analysis (GPT-4o vision) for product, design and accessibility use cases
- Translation to and from less common languages — GPT-4o has broader Asian-language coverage than Mistral
Use cases to avoid or rethink
- Automated decisions about individuals (HR shortlisting, credit scoring, access control): Article 22 UK GDPR prohibits except under narrow exceptions. Always document a meaningful human review.
- Identifiable medical data: outside an NHS-cleared infrastructure (DSPT, DTAC), avoid. ChatGPT Enterprise is not registered.
- Professional privilege (solicitors, barristers, doctors, accountants under ICAEW, FCA-regulated client communications): direct deontological risk — prohibit unless explicitly cleared.
- Press releases without review: hallucination risk on quotes and figures — always verify before publication.
- Legally enforceable content generation: contracts, clauses, legal opinions generated by AI and used without human review create direct organisational liability.
What we refuse to promise
Three anti-patterns we systematically dismantle when we frame an enterprise AI deployment.
“We’ve signed ChatGPT Enterprise, so we’re compliant.” No. The contract is necessary, not sufficient. Compliance also requires the AI usage policy, documented training (AI Act Article 4), the Article 30 record, the DPIA where applicable, and the incident procedure. Without those layers, the contract alone fails on first inspection.
“ChatGPT is the most-known tool, so let’s standardise on it.” Brand recognition is not the same as fit. For most UK enterprise use cases, Mistral Le Chat Enterprise is now at functional parity, with a clear advantage on sovereignty and a typically lower per-seat price. The 2026 reflex is to compare both on actual workloads before locking in.
“We can send any business data, OpenAI doesn’t train on it.” True on Team and Enterprise, but incomplete. The real issue is not training — it is the transfer outside the UK and EU. As long as servers sit in the United States, the UK Extension dependency stays. For large-scale processing of personal data, a documented Transfer Impact Assessment is expected, and migration to a sovereign alternative remains the safest path.
FAQ
Our company already pays ChatGPT Plus for staff — is that fine?
No. ChatGPT Plus is still a consumer account governed by OpenAI’s consumer terms. There is no Data Processing Agreement (Article 28 UK GDPR), no universal opt-out from training, no centralised audit logging, no enterprise SSO. For business use on non-public corporate data, moving to ChatGPT Team or Enterprise is the absolute minimum. Continuing on Plus exposes the organisation to direct breaches of Articles 5, 28 and 32 UK GDPR.
Is ChatGPT Enterprise approved for NHS workloads?
Not as a standalone solution. As of April 2026, ChatGPT Enterprise is not registered against NHS England’s Data Security and Protection Toolkit (DSPT) for direct processing of identifiable patient data, and it has not received DTAC approval as a clinical tool. NHS trusts experimenting with generative AI are doing so via Microsoft Azure OpenAI Service under the existing NHS-Microsoft framework, with strict data minimisation. For identifiable patient data, the realistic options remain on-premises models or LLMs on UK-resident, NHS-aligned infrastructure. See our healthcare AI guide.
Can we fully disable retention on ChatGPT Enterprise?
On Enterprise, you can negotiate Zero Data Retention (ZDR) for specific workspaces — meaning conversations are not stored beyond the session. OpenAI typically grants this for FCA-regulated firms, legal practices, and high-volume contracts. On Team, you cannot: the 30-day security retention applies. Whatever the regime, retention must be documented in your Article 30 record and consistent with the underlying business purpose.
Is Microsoft Copilot the same as ChatGPT?
Not exactly. Microsoft 365 Copilot uses OpenAI models (GPT-4o, o3) hosted on Azure OpenAI Service — but the contract is with Microsoft, not OpenAI. Microsoft offers its own DPA, EU Data Boundary commitment for most data, and native integration with the Microsoft 365 estate that most FTSE 100 firms already run. For UK organisations already standardised on Microsoft, Copilot is often the more defensible route than direct ChatGPT — though residual US transfer risk persists, since Microsoft as a US-headquartered group remains in scope of the CLOUD Act.
Are custom GPTs safe to use on internal data?
On ChatGPT Team and Enterprise, custom GPTs are private to the workspace and their system prompts do not leak. Two caveats. One, every query still hits OpenAI’s models, so DPA, retention and transfer apply normally. Two, a custom GPT is not an access control layer — if you connect it to an internal knowledge base, enforce authorisation at the data source, otherwise any workspace user can retrieve anything indexed.
Is ChatGPT banned anywhere in Europe?
Not currently. The Italian Garante temporarily banned ChatGPT in March 2023 then fined OpenAI 15 million euros in December 2024 for transparency failures — and separately fined Replika 5 million euros. Italy is the European reference point on regulatory hostility to consumer-grade ChatGPT. The UK ICO has not issued a ban; its position is that generative AI is lawful provided UK GDPR is respected. The German DSK and Spanish AEPD have published warnings but no ban.
What is the strongest alternative to ChatGPT for a UK enterprise?
Mistral Le Chat Enterprise covers most business use cases on a European stack hosted at Scaleway — eliminating the US transfer risk entirely. Pricing is typically 12-20 GBP per user per month versus 20 GBP for ChatGPT Team. For organisations already invested in Microsoft, Azure OpenAI Service via Microsoft 365 Copilot offers a UK-resident contractual path with broadly similar capability. See our Mistral vs ChatGPT comparison.
What does a ChatGPT deployment cost for 100 users in the UK?
ChatGPT Team at around 20 GBP per user per month: roughly 24,000 GBP per year for 100 users, before VAT and implementation. ChatGPT Enterprise typically negotiates between 45 and 55 GBP per user per month depending on commitment: 54,000 to 66,000 GBP per year. Add first-year implementation: 12,000 to 35,000 GBP. Annual run cost: 8,000 to 18,000 GBP. By comparison, Mistral Le Chat Enterprise on the same scope lands around 14,000 to 24,000 GBP per year for 100 users.
Sources: OpenAI Team and Enterprise terms (openai.com/enterprise-privacy); UK GDPR and Data Protection Act 2018; UK Extension to the EU-US Data Privacy Framework, October 2023; ICO guidance on generative AI (2024-2025); EU Regulation 2024/1689 (AI Act), notably Article 4; Garante per la protezione dei dati personali — OpenAI decisions 2023 and 2024; EDPB Opinion 28/2024 on AI models and GDPR; FCA SYSC sourcebook on operational resilience.
To frame a ChatGPT deployment in your UK organisation — tier choice, AI usage policy, Article 30 record, training, or comparison with Mistral Le Chat Enterprise — see our GDPR-compliant AI guide, our Mistral vs ChatGPT comparison, our business AI charter guide, or get in touch through our custom AI solutions.