Are your staff pasting client data into ChatGPT on their phones?

Jeff wants the final daily briefing written from today's editorial analyses.

Quiet news day — no new AI tool worth signing up for this week. But that makes it the right week to tidy up how your team is already using the AI they've got, because there's a real compliance gap hiding in plain sight.

Are your staff pasting client data into ChatGPT on their phones?

Probably, yes. Most small businesses bought one or two AI seats in the last year, and staff quietly use their personal ChatGPT, Copilot or Gemini logins on top to draft client emails, summarise meetings, or rewrite quotes. On personal accounts, that data can be used to train the AI and sits completely outside your GDPR records.

If a client complains, or the Information Commissioner asks where their details went, "one of the juniors pasted it into ChatGPT on her phone" is not a defence. Realistic fines for small businesses run £5,000 to £50,000, plus the cost of writing to every affected client to tell them.

This hits accountants, solicitors, estate agents, salons with client health notes, clinics, recruiters handling CVs, and any agency with a client list.

What to do this week:

1. Pick one tool — ChatGPT Business, Copilot, or Gemini Workspace. Move everyone onto the business tier, which keeps your data out of training by default.
2. Write one page: what staff can paste in (general drafting, public information) and what they can't (client names, financials, health notes, CVs, anything from your CRM).
3. Tell everyone in writing, keep a copy. That's your audit trail.

Budget an hour. Cost of skipping it: the breach you didn't know you were running.

Quick hits

• Anthropic announced a bigger compute deal with Amazon and a fellowship programme. Backroom plumbing — nothing changes for you as a user.
• The Rundown AI mentions a new "Claude Design" feature for generating simple graphics from a description. Details are thin; we'll cover it properly once it's actually available to try.
• HMRC pushed several customs declaration updates. Only relevant if you import or export goods yourself — if you use a freight forwarder, they handle it.

The bottom line

Nothing new to buy this week — but spend an hour getting your team off personal AI logins and onto a business account before the ICO asks where your client data went.

That's today's briefing. Subscribe free to get this in your inbox every morning.