The first thing agency owners ask me is whether it's safe to put client data into AI at all. It usually comes up before we've talked about anything the tools can do, and fair enough. Your clients trust you with their plans and often their own customers' details.
It can be, once you've done some fairly boring checks. The gap I'd worry about sits between the tools your team really uses and the ones you'd sign off if somebody asked, so this is a five-step plan for closing it this month.
This is general guidance and it isn't legal advice. Your own client contracts are what count, so check them, and get a solicitor or your data protection lead to look at anything that isn't clear.
Why the plan matters when you put client data into AI
On Claude's Free, Pro and Max plans, you decide whether your chats can be used to train future models. Anthropic changed its consumer terms in August 2025 so every user has to make that choice, and saying yes stretches how long it keeps your data from 30 days to five years. Its privacy centre adds that incognito chats stay out of training, while chats flagged for a safety review can still feed its safety systems.
On ChatGPT's Free, Plus and Pro plans, OpenAI says it may use your content to train its models unless you switch off "Improve the model for everyone" under Data controls. Clicking thumbs up or down on an answer also lets OpenAI use that whole conversation for training, even after you've opted out.
For an agency, the trouble is that the setting on a personal account belongs to the person, and you've no way to see or check it. So step one is finding out which accounts your team uses for client work today. Don't be surprised by a mix of company logins, personal paid accounts and a free one somebody set up in a hurry.
Move client work onto a business plan
Business plans change the default. OpenAI's enterprise privacy page says it doesn't train on data from ChatGPT Business, ChatGPT Enterprise or its API by default, and that you own your inputs and outputs where the law allows. Anthropic's commercial terms, which cover Claude Team, Claude Enterprise and the API, say it may not train models on customer content, and that you keep your inputs and own your outputs.
The words "by default" are doing a lot of work there. Anthropic says it can use a business chat for training if someone sends feedback or a bug report, and it keeps that feedback for up to five years, so on Team and Enterprise it's worth having an owner switch the thumbs buttons off (the setting's called Rate chats). OpenAI says feedback on its business plans doesn't allow training on the conversation.
You also get controls somebody at the agency can check. ChatGPT Business admins can view, export and delete conversations, and OpenAI says deleted chats leave its systems within 30 days unless the law, or protecting its services, means they're kept longer. Claude Enterprise owners can set a custom retention period of 30 days or more (without one, the data is kept indefinitely). Anthropic also says deleted chats leave its back end within 30 days on its business products, though chats flagged for breaking its usage policy can be kept for up to two years.
This wording moves, so reread the terms every few months. OpenAI updated its help page on training on 13 October.
Read what your client contracts say
What you've promised your clients lives in your contracts and NDAs, and those promises can be stricter than any vendor's terms. Pull out the agreements for your three biggest clients and look for four things.
- Confidentiality clauses that limit sharing client information with third parties. An AI provider is a third party, even on a business plan.
- Rules on subcontractors or sub-processors, especially any that need the client's written approval.
- Any clause that names AI or automated tools. If there's one, it outranks everything else in this post.
- Where data can be stored. If a contract says client data stays in the UK, check your plan can promise that.
If a contract is vague, ask the client. A short email naming the tool, the plan and the kind of work takes five minutes, and it puts the answer in writing.
The UK GDPR basics an agency needs
UK GDPR is about personal data, meaning information about a person who can be identified, such as a client's customer list or a recorded sales call.
The ICO describes two roles. A controller decides why and how personal data is used, and a processor handles it on the controller's behalf. When a client hands you their customer data to run a campaign, they're normally the controller and you're their processor. Put that data into an AI tool and the provider becomes your sub-processor, and a controller's contract with its processor has to include rules on sub-processors, including the controller's authorisation. So if your client's agreement says new sub-processors need their sign-off, that includes ChatGPT and Claude.
For your agency's own personal data, like staff records and your own leads, you're the controller. You need a lawful basis for each purpose and a record of which one you're relying on, and the regulator says there must be a written contract each time you use a processor. That's what a data processing agreement, or DPA, is for. OpenAI says it can sign one for ChatGPT Business, Enterprise and the API, and Anthropic's DPA forms part of its commercial terms and names Anthropic as the processor. Both are tied to the business plans, so neither covers a staff member's personal account.
Last, there's the data protection impact assessment, or DPIA. AI is one of the ICO's examples of innovative technology, which can mean you need one alongside other risk factors, and its advice is "If in any doubt, we would always recommend that you do a DPIA." If you'll be putting client customer data through AI regularly, I'd do one. Its AI guidance is under review after the Data (Use and Access) Act, so check it again before you finalise anything.
A one-page AI data policy you can adopt this month
Keep the policy to one page and walk everyone through it in a meeting. I've written about why manager support decides whether a team uses AI at all, and I'd expect a policy to work the same way.
The first rule sits above the rest: client work only goes into the agency's business account, and that includes the people paying for their own ChatGPT Plus or Claude Pro. After that, everything sorts into three groups.
- Fine to paste: your own agency's material (process docs, internal training, proposals with names taken out), anything the client has already made public, and general questions about copy or code that don't name anyone.
- Anonymise first: client strategy documents, briefs, campaign results and meeting notes. Swap the client, their brands and any people for placeholders like Client A, strip out emails and phone numbers, and keep the list of who's who somewhere else.
- Never goes in without the client's written yes: customer lists and CRM exports, sensitive details about real people such as health or money, unreleased results or launches, and anything a contract says can't go to a third party. Passwords and API keys don't go in at all.
On the middle group, the ICO says pseudonymised data is still personal data for whoever holds the extra information, which here is you, so placeholders lower the risk without making it go away. They won't get you round a contract that bans sharing, either.
Then give the policy an owner, often the ops lead, who people can ask when they're unsure and who checks the account settings once a month.
Where I'd start this week
If you only do one thing, find out which accounts your team uses for client work and move all of it onto one business plan, with the feedback setting checked. Honestly, everything else in this post gets a lot easier once you know where the data's going.
And if you want help getting your team using AI on real client work, here's how I work with agency teams.