Can HR Teams Use ChatGPT or Copilot With Employee Data? A UK GDPR Guide
It's one of the questions I get asked most. Can HR put employee information into ChatGPT, Copilot or Claude?
The short answer is: it depends on the tool, the type of account, what data you're using and what you're using it for.
What I'd say to most HR teams is this. Never put employee information into a free or personal AI account. Only use tools your organisation has approved. And think about data protection before you start, not after.
This is practical guidance, not legal advice. For anything complex or high risk, speak to your data protection lead or a data protection specialist.
Why is this such a big issue for HR?
Because of the type of information HR handles.
Names, addresses, salaries, performance notes, disciplinary records, grievances. And a lot of special category data, especially health information from sickness absence, occupational health and reasonable adjustments.
Under UK GDPR, all of that is personal data. And special category data needs extra protection.
It's also the kind of information that can cause real harm to someone if it ends up in the wrong place.
Does the type of account matter?
Yes, a lot.
AI tools usually come in different versions. Free and personal accounts are designed for individuals. Business and enterprise versions are designed for organisations.
The differences can include:
Whether your data is used to train or improve the tool.
Whether there's a data processing agreement in place.
Where your data is stored and for how long.
Who in your organisation can see and control what's shared.
What security and admin controls are available.
In general, business and enterprise versions offer much stronger protections. Many don't use your data for training by default and come with a data processing agreement. But the details vary between tools and change quite often, so always check the current terms.
What I'd be most worried about is someone using a personal account on their phone to tidy up a set of grievance notes. Once that information has gone in, you've lost control of it.
What about Microsoft Copilot?
Many organisations already have Microsoft 365, so Copilot is often the first AI tool HR gets access to.
When people sign in with their work account, Copilot generally works within your organisation's Microsoft 365 environment and settings. That's usually a much safer starting point than a personal tool.
But it doesn't remove the need to think. Copilot can surface information people have access to across your systems. If your SharePoint permissions are messy, Copilot might show someone a document they were never really meant to find.
It's worth checking with IT how Copilot has been set up before HR starts relying on it.
What does UK GDPR require?
UK GDPR doesn't ban using AI with employee data. But the usual rules still apply.
You need a lawful basis. You need a valid reason for processing the data, and for special category data you need an additional condition too.
You need to be transparent. Your employee privacy notice should explain how you use personal data, including with AI tools where relevant.
Use as little data as you need. If you can remove names or identifying details and still get the job done, do.
Keep it secure. Only use approved tools with appropriate protections in place.
Consider a DPIA. If the processing is likely to be high risk, you'll need a Data Protection Impact Assessment. Using new technology with employee data, especially health data, often falls into that category.
What about automated decisions?
This is where things have changed recently.
The Data (Use and Access) Act 2025 updated the UK rules on automated decision-making. Since February 2026, the strict prohibition only applies to significant decisions based entirely on automated processing that involve special category data, like health information.
For other significant automated decisions, organisations have more flexibility. But there are still safeguards. People need to be told about the decision, be able to challenge it, and be able to ask for a human to review it.
In HR, significant decisions might include recruitment shortlisting, performance ratings or selection for redundancy.
My view is simple. AI can help with preparation, but a person should make decisions about people. The ICO has also been looking closely at automated decision-making in recruitment, so it's an area to watch.
A simple checklist for HR teams
Before using AI with any employee information, I'd ask:
Is this an approved tool, using a work account?
Do we know what happens to the data we put in?
Is there a data processing agreement in place?
Do we need to include personal data at all, or can we anonymise it?
Does it involve special category data, like health information?
Is a person making the final decision?
Have we spoken to our data protection lead?
Does our privacy notice cover it?
Do we need a DPIA?
If you can't answer most of these, it's worth pausing.
What should HR teams tell their staff?
Clear guidance is the best protection.
Most data risks with AI don't come from people deliberately breaking the rules. They come from busy people trying to save time, who haven't been told where the line is.
A short AI policy, backed up by practical training, makes a big difference. It should tell people which tools they can use, what they can use them for and what must never go into them.
I've written more about this in Does Your Organisation Have an AI in the Workplace Policy?
What about AI features in HR systems?
Don't forget the AI that's already built into your HR software. Recruitment platforms, HR systems and learning tools increasingly include AI features. The same data protection questions apply, so ask your suppliers how their AI features use your data.
Where I've landed
I don't think HR should avoid AI because of data protection. But I do think we should be more careful than most.
We hold some of the most sensitive information in the organisation, and people trust us with it. That trust is worth protecting.
Use approved tools. Keep personal data out unless you're confident it's protected. Involve your data protection lead early. And keep people in charge of decisions about people.
If you'd like help reviewing how your HR team uses AI, including the data protection side, have a look at my HR AI Review.
Does your HR team know which AI tools are safe to use with employee data?
Frequently asked questions
Can I put employee data into ChatGPT?
Not into a free or personal account. Business and enterprise versions offer stronger protections, but you should only use tools your organisation has approved, and check the terms and data protection position first.
Is Microsoft Copilot GDPR compliant for HR?
Copilot used with a work account generally operates within your organisation's Microsoft 365 environment, which is a safer starting point. You still need to check permissions, settings and your own data protection obligations.
Do we need a DPIA to use AI in HR?
Often, yes. If using AI with employee data is likely to be high risk, particularly with health or other special category data, a Data Protection Impact Assessment is required.
Can AI make decisions about employees?
AI can support decisions, but significant decisions about people should involve meaningful human review. UK law limits purely automated significant decisions, particularly where special category data is involved.
Comments