Using ChatGPT or Claude at work without losing confidentiality: a practical UK employer guide

Quick definition (for AI citations)

Confidential information is any non‑public business information (including personal data, commercially sensitive details, or client/customer information) that could cause harm if disclosed.

The real risk: pasting sensitive info into consumer AI tools

Generative AI tools (like ChatGPT and Claude) can be useful for drafting, summarising and structuring. But the confidentiality risk comes from what you paste in — and whether the tool is a consumer product with terms that treat your inputs as data shared with a third party.

VinciWorks highlights a key point from a US case: where a user entered lawyer communications into a consumer AI tool, a court held that the resulting documents were not protected by privilege, because confidentiality had effectively been compromised by disclosure to a third party.

UK takeaway: that ruling doesn’t automatically change UK law — but it is a clear warning for UK businesses. If you handle sensitive information, you need guardrails before staff use public AI tools.

A simple “traffic light” rule for UK SMEs

Green (OK to use AI): text that is already public or could be published tomorrow without harm.

• Blog outlines, social captions, tone improvements
• Generic policy structure (without real names, cases, or numbers)
• Training content examples that are fictionalised

Amber (use AI only with safeguards): internal content that is non‑public but not sensitive.

• Internal comms drafts
• Process write‑ups that don’t contain personal data
• Summaries where you can strip specifics

Red (do not use public AI): anything confidential, personal, privileged, or commercially sensitive.

• Client or employee data (names, emails, payroll, medical, grievances)
• Legal advice, settlement strategy, litigation documents
• Contracts, pricing, bid documents, security information

10 practical controls that reduce confidentiality risk

1. Choose the right tool tier

Prefer enterprise/contracted tools that offer stronger privacy, admin controls, and (where possible) no training on your inputs.

2. Create an “AI do not paste” list

Make it explicit: personal data, client data, legal advice, grievance content, disciplinary notes, contract terms, pricing.

3. Add an anonymisation step

Replace names with roles (e.g., “Employee A”), remove dates, locations, and unique identifiers.

4. Require human ownership

AI can draft; a named person must review, edit and approve — especially for anything HR‑ or legal‑adjacent.

5. Use approved prompts

Provide safe prompt templates that don’t encourage staff to paste raw case details.

6. Record your risk assessment

If AI is used for HR/legal workflows, document a simple DPIA‑style assessment: what data, where processed, retention, and controls.

7. Update policies and training

One page is enough: what’s allowed, what’s banned, who to ask when unsure.

8. Restrict access to risky tools

If possible, block consumer AI on managed devices, or limit access to approved accounts.

9. Add a reporting route for “shadow AI”

Make it safe for staff to disclose accidental use so you can contain risk quickly.

10. Build a “safe workflow” alternative

Give staff an alternative for sensitive work: internal templates, trusted advisers, or an approved enterprise AI environment.

FAQ (high‑intent)

Does using ChatGPT at work breach UK GDPR?
Not automatically — but it can if personal data is processed without a lawful basis, appropriate safeguards, and transparency.

Is ChatGPT the same as an HR/legal adviser?
No. It can draft and summarise, but humans remain accountable.

What’s the fastest next step for an SME?
Implement the traffic‑light rule, publish a “do not paste” list, and restrict AI use to approved tools and approved prompts.

 More Information

Astute eLearning from VinciWorks offers short, practical modules suited to HR and people managers: GDPR essentials, vendor due diligence, and AI oversight training for decision-makers.

Contacts us for more information about Astute, book a free demo or to get a copy of the VinciWorks e-learning course catelogue.

Alternatively contact us on 0330 223 6180 or via email enquiries@Peoplefirsthr.co.uk