AI and personal data
Can a small firm put customers' personal data into AI?
Yes, if the firm has a business account with a data processing agreement (GDPR Art. 28), a legal basis, and puts in only what the task needs; customer data is better kept out of personal free accounts. According to the providers' terms as of 06.11.2026, data in the business plans of ChatGPT, Microsoft 365 Copilot and Claude is not used to train models by default, but check this in your own contract.
Checked 06.11.2026. A general overview, not legal advice. Sources:
GDPR (EUR-Lex) · AI Act (EUR-Lex) · OpenAI · Microsoft 365 Copilot · Anthropic · Privacy
Personal or business account: what is the difference
In a personal account you accept the terms as a private person, and the firm has no data processing agreement with the provider. In business plans (ChatGPT Business or Enterprise, Microsoft 365 Copilot, Claude Team or Enterprise, the API) the provider acts as a processor under contract, and the firm's administrator manages access.
On model training the providers write: OpenAI says it does not train on your business data; Microsoft says prompts, responses and data accessed through Microsoft Graph are not used to train foundation models; Anthropic says inputs and outputs of its commercial products are not used for training by default (except feedback you send yourself, for example with the thumbs buttons). In a personal ChatGPT account it depends on the settings.
A short checklist for a firm of 5–30 people
- One business account for the firm; no work data in personal accounts.
- A data processing agreement (DPA) with the provider and, if data leaves the EEA, standard contractual clauses (SCC).
- A rule for staff: what may go in straight away, what only without names and ID codes, and what never (for example health data).
- As little data as possible: a quote draft usually needs no customer name, personal ID code or phone number.
- Staff training: since 02.02.2025, Article 4 of the AI Act requires a firm using AI to take care of its staff's AI literacy.
What to tell your customers
If AI processes your customers' data, say so in your privacy notice: which service, for what, and where the data is transferred. If your site has a chatbot, from 2 August 2026 Article 50 of the AI Act requires it to say that it is AI.
How we do it
In a working project the AI runs in your own ChatGPT, Copilot or Claude account; you grant access for the setup and revoke it yourself. In every project we sign a data processing agreement (GDPR Art. 28) and write AI usage rules for staff; we name in writing, before work starts, where the data is processed.
A document sent for a free sample is processed in an AI service (currently Claude by Anthropic) and deleted at your request. Please send it without personal data. Our privacy notice has the details.
What you can do now
We set up ChatGPT, Copilot or Claude on your documents, with AI usage rules and a guide. €990 one process · €1,900 three processes.
Packages and prices →Send one drawing, order or customer email without personal data to info@lifkuru.com. Within 2–3 working days we return a finished draft. Free, no call and no obligation, one sample per company.
Send a document →Prices are final: lifkuru is not VAT-registered, no VAT is added. All prices are on the home page; we agree the fixed price in writing before the start.
Frequently asked
- May we put a customer contract into ChatGPT?
- If the firm has a business account with a data processing agreement and the contract is needed for the task, this is a normal working case, as long as the employee knows the rules. Better not in a personal free account. Remove what the task does not need before you upload.
- Do providers use our data for training?
- By their own terms as of 06.11.2026, data from the business products of ChatGPT, Microsoft 365 Copilot and Claude is not used for training by default. In personal accounts it depends on the settings. Check the terms of your plan.
- Where is the data processed?
- It depends on the provider and plan. For example, Microsoft says Microsoft 365 Copilot stays within the EU Data Boundary for EU customers, except Anthropic models used as a subprocessor. If data goes to the USA, standard contractual clauses are needed.
- What happens to the data if we stop working with lifkuru?
- Nothing changes: the AI runs in your account, you revoke our access, and the templates, settings and guide stay with you.