Is It Safe to Upload Client Data to ChatGPT or Claude?

It’s a Thursday evening in March. A client has just emailed twelve months of bank statements as one long PDF, and you’d like a month-by-month summary of money coming in before tomorrow morning’s meeting. ChatGPT or Claude would do it in under a minute. You drag the file into the chat window, your cursor hovers over the send button, and you hesitate.

That hesitation is worth listening to. So, is it safe to upload client data to ChatGPT or Claude? Most articles on the subject answer one question: does the AI company train its models on your chats? That matters, but if you work under a professional code, two other questions matter more. Has your client agreed to their information going to an outside company? And does your plan come with a contract that makes that company answerable to you?

In this guide, I’ll take you through all three questions for both ChatGPT and Claude, and then show you what the rules say in India, the United States, the United Kingdom and Australia. It’s part of our AI safety and rules guides for finance professionals, where you’ll find related guides as they’re published.

What actually happens when you paste a client file

Before we get to the rules, it helps to know where your file goes. When you press enter, your text or document travels to the provider’s servers and stays there, at least for a while. What happens next depends on your plan, and it comes down to three questions. Can the provider use your chats to train future versions of its model (the AI system behind the chatbot)? How long does it keep them, even after you’ve hit delete? And is there a business contract that makes the provider your data processor, meaning it can only handle the data on your instructions?

Here’s how ChatGPT and Claude answer those questions. I checked each provider’s official pages on 23 October 2026.

ChatGPT (OpenAI)

If you’re on a personal ChatGPT account (Free, Plus or Pro), OpenAI’s own help page says ChatGPT “improves by further training on the conversations people have with it, unless you choose to disable training.” In other words, training is on until you switch it off. You’ll find the switch under Settings, then Data Controls, then “Improve the model for everyone”. There’s one catch: OpenAI says conversations saved before you turn it off “may be used for model training if you have not opted out.”

Deleting a chat helps, though not straight away. OpenAI schedules deleted chats for permanent deletion within 30 days, but it says it may keep them longer “for security or legal obligations”. Temporary Chats follow a similar pattern: they don’t appear in your history, and they’re deleted within 30 days.

Business plans work differently. For ChatGPT Business, Enterprise and Edu, and for the API, OpenAI states: “We do not train our models on your data by default.” Your admin decides how long data is kept, the services have passed a SOC 2 Type 2 audit (an independent check of security controls), and OpenAI will sign a Data Processing Addendum for Business, Enterprise and API customers.

Claude (Anthropic)

Claude has a similar split between personal and business plans, although the personal side changed in 2025. On a personal account (Claude Free, Pro or Max), Anthropic now asks every user to choose whether their chats can be used to improve Claude. If you say yes, Anthropic keeps that data for five years. If you say no, the existing 30-day retention period applies. You can change your choice at any time in Claude’s privacy settings, so if you clicked through that prompt in a hurry, it’s worth checking what you picked.

Two exceptions apply even if you said no. When you rate a reply with a thumbs up or down, Anthropic stores the whole conversation for up to five years and may use it for training. Chats flagged for a safety review may also be used to improve Anthropic’s safety systems. Incognito chats, on the other hand, aren’t used for training even if the setting is on.

On business plans (Claude for Work, which covers the Team and Enterprise plans, and the API), Anthropic says it won’t use your inputs or outputs for training by default. It describes itself as the “Processor” for Claude for Work, with your firm as the “Controller” of the data. The thumbs up and down exception still applies, though, so ask your team not to rate replies on client work.

Put side by side, the two providers look like this:

Checked against OpenAI’s and Anthropic’s official privacy pages on 23 October 2026. Providers change these terms often, so check the current pages before you rely on them.

There’s one more thing the privacy pages don’t dwell on: chats stored with a provider can end up in a courtroom. In May 2025, a US court hearing the New York Times copyright case against OpenAI ordered it to preserve ChatGPT output logs that would otherwise have been deleted. That order ended on 26 September 2025, although OpenAI still has to keep the logs it had already preserved, along with data from accounts the Times has flagged. Then, in February 2026, a federal court in New York ruled in United States v. Heppner that a defendant’s chats with Claude weren’t confidential, partly because Claude’s privacy policy reserves the right to disclose data to third parties. That was a criminal case about legal privilege, and neither case involved accountants. Even so, both suggest that a chat stored with a provider is less private than it feels.

Is switching off training enough?

So if you’ve switched training off, are you covered? I don’t think you are, and this is where I’ll take a clear position. Turning training off is good hygiene. It still doesn’t make a personal plan suitable for client files, for three reasons.

The first reason is that the data still leaves your office. Your professional duty is about disclosure: you mustn’t pass client information to anyone else without the client’s permission. Whether that outside company learns from the data is a separate question. An AI provider holding your client’s bank statement for 30 days is a third party either way.

The second reason is that a personal plan has no contract behind it. Consumer terms can change, and they do; Anthropic’s 2025 update is a recent example. A business plan comes with a signed data processing agreement, which the provider can’t rewrite overnight.

The third reason is more practical. A personal account belongs to one person. If a junior on your team uses her own ChatGPT login for client work, your firm can’t see what’s stored there, has no audit trail, and has no way of deleting anything when she leaves. All three problems lead back to a document you already have.

What your professional rules say, country by country

The engagement letter matters because of the rules you practise under. They’re worded differently in each country, but they end up in much the same place: you need the client’s permission, a proper contract with the provider, or (more often than not) both. Here’s how that plays out in the four countries most of our readers work in.

India

If you’re a Chartered Accountant in India, start with the Chartered Accountants Act, 1949. Clause (1) of Part I of its Second Schedule treats it as professional misconduct when a member “discloses information acquired in the course of his professional engagement to any person other than his client” without the client’s consent or a legal requirement. An AI provider is clearly a person other than your client, so you need that consent, and it’s best to have it in writing.

The Digital Personal Data Protection Act, 2023, adds a second layer as its obligations come into force. The DPDP Rules were notified on 14 November 2025, with an 18-month phased rollout. Under the Act, your firm is the “data fiduciary” for your clients’ personal data. That covers individuals’ names, PAN and contact details, and also the details of directors and employees inside a company’s file. Section 8 says a data fiduciary may use a “data processor” only under a valid contract, and must take reasonable security safeguards to prevent a personal data breach. Failing to keep those safeguards in place can attract a penalty of up to ₹250 crore. A personal ChatGPT or Claude account gives you no such contract.

United States

In the US, accountants have two sets of rules to think about. The AICPA Code’s confidentiality rules let a member share confidential client information with a third-party service provider only if there’s a contract requiring the provider to keep it confidential, or the client has given specific consent beforehand. A business plan with a data processing agreement can meet the first test. A personal plan can’t.

If you prepare tax returns, the rules get sharper. Internal Revenue Code section 7216 makes it a crime to knowingly or recklessly disclose or use tax return information, with a fine of up to $1,000 and up to a year in prison for each violation. A separate $250 civil penalty under section 6713 applies even without that intent. Disclosures outside the regulatory exceptions need the taxpayer’s signed, written consent. The IRS’s published section 7216 material doesn’t mention AI tools, so the safest reading is to treat pasting return data into a chatbot as a disclosure. Either anonymise the data first, or get 7216 consent and use a business plan. If your firm uses AI on returns at any scale, it’s worth taking advice from a 7216 specialist.

United Kingdom

The UK position will feel familiar by now. Confidentiality is one of the five fundamental principles in the ICAEW Code of Ethics, and the other UK accountancy bodies follow the same international code. Data protection law then adds a hard requirement. Under Article 28 of the UK GDPR, a controller (your firm) may only use a processor under a written contract with specific terms, and consumer AI terms don’t meet that standard. Both OpenAI and Anthropic offer processor terms on their business plans. Since both are US companies, check how the agreement handles international data transfers too.

Australia

Australia has the clearest guidance of the four, and the most recent. On 22 July 2026, the Tax Practitioners Board released TPB(GS) 55/2026, “The use of Artificial Intelligence and the Code of Professional Conduct”. Its factsheet says practitioners “must continue to comply with your confidentiality obligations when using AI”, and that this “includes obtaining client permission before entering client information into AI tools”. It also asks you to tell clients where their information will be used and stored. This sits under Code item 6, which bars disclosing a client’s information to a third party without permission, and the Privacy Act and the Australian Privacy Principles apply on top.

A ten-second test before you paste anything

Rules are easier to follow once they become a habit. Before I paste anything into an AI tool, I ask which of three groups the material belongs to. It takes about ten seconds.

Fine on any plan

This group covers public information (a published tax rule, a company’s filed annual report), your own templates and checklists, and figures with every identifying detail taken out. For example, “Client A, retail business, turnover 4.2 million, gross margin fell from 31% to 26%” gives the AI everything it needs and tells it nothing about who the client is.

Business plan only, with client consent

Anything that identifies the client or a person goes here: named bank statements, payroll files, tax returns, ledgers with customer or supplier names, and emails from the client. You’ll need a business plan, a signed data processing agreement, an engagement letter that allows it, and a firm policy that says who can do it.

Never, on any plan

Some things should stay out of AI tools altogether: passwords and portal logins, one-time codes, and full government ID numbers (Aadhaar, PAN, SSN, National Insurance number or Tax File Number) unless the task genuinely can’t be done without them. The same goes for anything a client has asked you to keep out of AI tools, and anything covered by a regulator’s or court’s restriction.

Once you’ve stripped out the names, most day-to-day work falls into the first group. That makes anonymising the habit most worth building, and the next section shows you how.

How to strip client details before you upload

The good news is that, for most tasks, the AI doesn’t need to know who your client is. It needs the numbers, the dates and the pattern. Removing names and identifiers (anonymising) usually takes a few minutes, and once it’s done, the confidentiality question largely goes away.

Do the first pass yourself in the original file, swapping names, account numbers, addresses and ID numbers for labels such as Client A or Account 1. For a long document, you can ask AI to help, but only on your business plan, never a personal one. This is the prompt I’d use:

When the AI hands the document back, read it yourself before you use it anywhere. AI tools miss things, such as a name buried in a narration line, an account number split across two lines, or a signature in a scanned image, so the final check has to be yours.

Setting up AI for client work the right way

If anonymising every file sounds like too much work (and for some firms it will be), the alternative is to set up a business plan properly. For a small firm, it’s simpler than it sounds:

1. Choose one tool on one business plan, such as ChatGPT Business or Claude Team, and stop all client work on personal accounts.
2. Sign the provider’s data processing agreement and keep a dated copy in your compliance file.
3. Update your engagement letter to say that you use AI tools, which provider you use, where the data is processed, and that a qualified person reviews every output. Send the updated letter to existing clients at renewal.
4. Set the controls: the shortest retention period that suits your work, no public sharing links, and prompt removal of anyone who leaves.
5. Write a one-page AI policy covering what can be pasted, who can paste it, and who reviews the result.
6. Keep a record of each review. Regulators such as the TPB expect to see evidence that a person checked the output.

The same thinking applies to Gemini, Copilot or any other AI tool you’re weighing up. Check whether you’re on personal or business terms, get your client’s consent, and make sure a contract is in place. We’ll publish a ready-to-use AI policy for small firms in a separate guide.

Frequently asked questions

Is ChatGPT Plus safe for client data if I turn off training?

Not for identifiable client data. Turning off training stops your chats being used to improve the model, but the data still sits with OpenAI under consumer terms, with no data processing agreement. Use Plus for anonymised or public material only.

Is Claude safer than ChatGPT for client data?

Not in a way that changes the answer. On personal plans, both store your chats under consumer terms. On business plans, neither trains on your data by default, and both act as your processor. Choose between them on features, price and the agreement you can sign.

Does anonymised data still need client consent?

If the client genuinely can’t be identified from what you paste, you aren’t disclosing their information, so most rules don’t apply. Be strict about “genuinely”, though. A distinctive business, a large one-off transaction or a small town can identify a client without a single name.

Can I use AI on tax returns in the US?

Yes, but carefully. Section 7216 covers tax return information, and its penalties are criminal. Either anonymise the data, or get the taxpayer’s written 7216 consent and use a business plan with a contract. The IRS material we checked doesn’t address AI directly.

What about Gemini and Microsoft Copilot?

The same test applies. Check whether you’re on consumer or business terms, whether a data processing agreement is in place, and whether your client has agreed. This guide doesn’t cover their terms, so read each provider’s current privacy pages before relying on them.

This guide is general information, not legal or professional advice. Provider terms and professional rules change, so check your professional body’s current rules, your client agreements and the provider’s current terms before using AI on client work. See our Disclaimer and our Editorial policy.

Sources

All checked on 23 October 2026.

1. OpenAI: Data Controls FAQ
2. OpenAI: How to delete and archive chats in ChatGPT
3. OpenAI: Enterprise privacy
4. Anthropic: Updates to Consumer Terms and Privacy Policy
5. Anthropic Privacy Center: Is my data used for model training? (consumer)
6. Anthropic Privacy Center: Is my data used for training? (commercial)
7. Anthropic Privacy Center: Does Anthropic act as a data processor or controller?
8. Engadget: OpenAI no longer has to preserve all of its ChatGPT data, with some exceptions
9. Jones Day: Federal court rules that a defendant’s communications with generative AI are not privileged
10. The Chartered Accountants Act, 1949: Second Schedule, Part I
11. Digital Personal Data Protection Act, 2023: Section 8
12. Press Information Bureau: Digital Personal Data Protection Rules, 2025
13. Journal of Accountancy: AICPA confidentiality rule and third-party service providers
14. IRS: Section 7216 Frequently Asked Questions
15. UK GDPR: Article 28, Processor
16. ICAEW: Generative AI guide, ethics
17. Tax Practitioners Board: Guidance on responsible AI use by tax practitioners
18. Tax Practitioners Board: The use of AI and the Code of Professional Conduct, factsheet