UK data guide for trades and construction
Is it safe to use ChatGPT with client data?
For builders, contractors and tradespeople using ChatGPT or Claude: what each does with what you type, what UK data protection law expects of you, and a red, amber, green list of what you can and can’t paste in.
Is it safe to use ChatGPT or Claude with client data?
It is safe enough for some client data, on the right plan, with clear rules. It is not safe to paste client names with addresses, CIS or payroll numbers, health and accident records or confidential tender documents into a free or personal account. Business plans of both ChatGPT and Claude are published as not training on your data by default, which makes them the sensible starting point.
Construct Virtual helps UK construction and trades firms set up AI safely, with a written rule set the whole team can follow. Below you’ll find the rule set, a plan-by-plan table and the UK law behind it.
Red, amber, green: what can you paste into ChatGPT or Claude?
This is our framework for a construction or trades firm, not a legal standard. It sorts data by the harm if it leaks.
Green: fine on any plan
- Generic drafting, with no names
- Marketing copy and blog ideas
- Tender and method statement wording using made-up or anonymised details
- Spreadsheet formulas and templates
- Public information about your own firm
Amber: business plan only, names removed
- Quotes and scopes with the client name and address removed
- Snagging lists and site notes
- Email replies, with details trimmed
- Site photos with faces and number plates blurred
Red: never into a consumer tool
- Client names with addresses and phone numbers
- CIS, UTR and National Insurance numbers
- Payroll and employee records
- Accident, RIDDOR and health information
- CCTV footage and children’s details
- Alarm codes, access details and security plans
- Documents under an NDA or main contractor confidentiality clause
Red data can only go into a tool if you have checked the contract, the data processing terms and the settings first, and have a reason that justifies it. For most small firms, the answer is to keep it out.
What do ChatGPT and Claude do with the data you type in?
| Plan | Used to train models? | Your control | Retention | Data location |
|---|---|---|---|---|
| Claude Free, Pro and Max | Only if you allow it. Anthropic made this a user choice in its 2025 consumer terms update | Privacy setting, changeable at any time. Only new or resumed chats are affected | 5 years if training is allowed, 30 days if not | Not stated as a UK option |
| Claude Team, Enterprise and API | No. Anthropic’s consumer changes do not apply to commercial terms | Admin controls and contract terms | API inputs and outputs deleted within 30 days. Zero data retention is available by agreement | Not stated as a UK option |
| ChatGPT Free, Plus and Pro | Conversations can be used to improve models unless you switch the setting off | Data controls setting and Temporary Chat | Governed by the setting and your chat history | Not stated |
| ChatGPT Business, Enterprise, Edu and API | OpenAI says it does not train on your organisation’s data by default | Admin controls. Data processing addendum available | Configurable for qualifying organisations | Data at rest can be held in the UK for eligible Enterprise, Edu and API customers |
Sources: Anthropic’s consumer terms announcement (28 August 2025) and commercial retention page (1 July 2026), and OpenAI’s business data pages, read in November 2026. Providers change terms often, so what you rely on is the setting and plan in your own account, not a blog post. The ChatGPT consumer row reflects OpenAI’s published setting wording, and we have not tested it account by account.
Claude consumer plans only use your chats for training if you choose that setting.
Anthropic, August 2025Business, Enterprise and API plans of both ChatGPT and Claude are published as not training on your data.
OpenAI and Anthropic business termsThe same prompt can be treated very differently on a personal account and a business account.
Construct Virtual summaryNot sure which to pick? Our guide to Claude versus ChatGPT for construction businesses compares them on everyday work, and getting started with Claude covers set-up.
What does UK data protection law expect of you?
When you type a client’s personal data into an AI tool, you are still responsible for it. The Information Commissioner’s Office has published guidance on AI and data protection. In practice, five points matter for a trades firm:
- You stay the controller. The AI provider acts as your processor on a business plan. You need a contract that says so, which is what a data processing addendum is for.
- Have a lawful reason. Using client details to deliver the job you were hired for is usually fine. Using them for something unrelated is not.
- Be open about it. If AI handles customer data, say so in your privacy notice.
- Think about transfers. Providers are mostly US companies. Transfers out of the UK need a lawful mechanism, such as the UK-US data bridge where the provider is certified to it.
- Assess the risk. For anything high-risk, such as health data or large volumes, write down a data protection impact assessment before you start.
The Data (Use and Access) Act 2025 amended UK data protection law, and most of those changes were reported to be in force from 5 February 2026. The core duties above did not go away. Nobody can say a tool is “GDPR compliant” on its own: what gets assessed is how you use it. This is general information, not legal advice.
Which construction and trades data needs extra care?
Client details and site photos
Addresses, phone numbers and photos of homes show where people live and what they own. Blur faces, number plates and house numbers, and keep names out.
CIS and payroll
UTR, National Insurance and bank details belong in your accounts software, not an AI chat. See our guide to CIS compliance and AI automation.
Health and safety records
Accident and RIDDOR records contain health data, a special category with higher protection. Keep names and details out.
Security-sensitive plans
Plans for secure or high-value buildings, alarm codes and access arrangements can be restricted by the client or contract. Check the contract before you share any of it with a third party.
NDAs and tenders
Many main contractor and client contracts restrict sharing documents with third-party processors. Read the confidentiality clause first.
Insurance and tender questionnaires
Some ask how you handle client data and whether you use AI. Have a written answer ready, and make sure it’s true.
of UK senior decision-makers believed staff were using outside AI tools.
Turbotic survey, 1,000+ decision-makers, September 2026. Belief, not measured use.feared sensitive data was being typed into unauthorised AI tools.
Same survey. Fear, not confirmed incidents.is the UK GDPR time limit for telling the ICO about a breach that puts people at risk, counted from when you become aware of it.
UK GDPR Article 33A one-page AI policy for a small construction or trades firm
Most firms don’t need a long document. They need a short rule that everyone follows. Copy this and adjust it:
Use only approved tools and plans
Name the tools and the plan. Staff use work accounts, not personal ones.
Follow the red, amber, green list
Red data never goes in. Amber goes in with names removed. Green is fine.
Turn off training and sharing where offered
Check the data controls setting when you set up any account, and switch off public sharing links.
A person checks everything
Nothing generated by AI goes to a client, an insurer or a regulator without a named person reading it.
Say so in your privacy notice
If customer data is processed by AI tools, your privacy notice should say it.
Report mistakes straight away
Tell the person in charge the same day. A fast report is far better than a hidden one.
What if someone has already pasted client data into ChatGPT?
- Stop and note what was shared: who, when, which tool and which plan, and what the data was.
- Delete the chat and any shared links, and switch off training for that account.
- Judge the risk. If personal data was exposed in a way that could harm someone, it may be a reportable breach. You must tell the ICO within 72 hours of becoming aware of a breach that is likely to put people at risk.
- Tell the client if there is a real risk to them, and keep a written record either way.
- Fix the cause: move the team to a business plan, adopt the policy above and brief everyone.
Use AI properly in your business
Safe use is the start, not the finish. Read our AI prompts for construction companies for practical ways to work, can AI do construction estimating for where it helps and where it doesn’t, and AI tools for construction companies for the wider toolkit. For done-for-you systems built with these rules in mind, see the AI admin system for trades, the AI receptionist for trades and AI automation for construction companies.
AI and client data: common questions
Is it safe to use ChatGPT with client data?
It can be on a business plan with clear rules. Keep client names with addresses, CIS and payroll numbers, health records and confidential documents out of free or personal accounts, and use the red, amber, green list in this guide.
Does ChatGPT use my data to train its models?
On free and personal plans, conversations can be used to improve models unless you switch the setting off. OpenAI says it does not train on your organisation’s data by default on Business, Enterprise, Edu and API plans.
Does Claude use my data to train its models?
Anthropic made training on consumer chats a user choice in 2025, so it depends on your setting. Its commercial terms, covering Team, Enterprise and API, are not affected by that change.
Is ChatGPT or Claude GDPR compliant?
No tool is compliant on its own. UK GDPR assesses how you use it: your lawful reason, your contract with the provider, what you tell customers and how you protect the data.
Can I put customer names and addresses into ChatGPT?
We advise against it on any personal account. On a business plan, remove names and addresses wherever the task allows, because you rarely need them for drafting a quote or an email.
Can I put site photos into AI tools?
Yes, with care. Blur faces, number plates and house numbers first, and avoid photos of security-sensitive areas or anything covered by a client confidentiality clause.
Do I need to tell clients I use AI?
If AI processes their personal data, your privacy notice should say so. Some clients and tender questionnaires also ask directly, so give a truthful answer.
Does Construct Virtual set this up for construction firms?
Yes. We set up AI systems for UK construction and trades firms with a written rule set, the right plans and your team trained to follow them, scoped on a free diagnostic call.
Keep reading
Can AI do construction estimating and quotes?
What it can and can’t do, with a three-quote back-test.
What does an AI receptionist cost for trades?
UK prices, what’s included and a break-even sum.
AI for HVAC businesses in the UK
Where AI helps, with a gas emergency escalation table.
Use AI in your firm without risking client data
In thirty minutes we look at how your team uses AI today, where client data could leak and which safe, useful systems to build first. No obligation, and a straight answer on what to avoid.
- A review of the tools and plans your team uses
- Your red, amber, green list, tailored to your trade
- A scoped plan for safe AI systems
Free AI search check
Does ChatGPT recommend your company?
When someone asks ChatGPT, Gemini or Perplexity to recommend a builder or contractor, is your company named? Find out where you stand today.
See how AI engines answer about you