AI Data Security for SMEs: GDPR Guide

When a small business pastes a customer list, a contract, or a support ticket into an AI tool, one question matters more than any feature comparison: where does that data actually go, and who gets to keep it? Most AI vendors answer this in their documentation. The problem is that the answer changes depending on whether you signed up with a personal account or a business plan, and almost nobody reads the page that explains the difference.

This guide walks through the four things that decide whether adopting AI is a controlled risk or an open-ended one: where your data is processed, what GDPR requires of you, whether the model is being trained on what you type, and how to lock all of it down through configuration and your vendor contract. None of it requires a legal team. It requires about an hour and a willingness to read the right settings page.

Does AI train on my data?

For most paid business and API tiers, no — your inputs are not used to train the model by default. For free consumer tiers, often yes, unless you turn it off. This single distinction trips up more small businesses than any other, because the same brand name can sit on both a “we never train on your data” enterprise product and a “we may use your conversations to improve our models” free app.

The practical rule is this: the account you signed up with on a whim is rarely the account you should be running company data through. A free personal login and a business workspace from the same vendor can have opposite default behaviours. Before you put anything sensitive into a tool, find out which side of that line your account sits on.

Here is how the major vendors actually handle it, based on their published policies:

A few details are worth pinning down because they are easy to get wrong. OpenAI’s API has not used customer data for training since March 2023, and its business tiers (Business, Enterprise) carry the same protection — but the consumer apps (Free, Plus, Pro, Go) default to yes, and you have to switch the toggle off yourself. Turning it off only affects future conversations; anything already absorbed into a previous training run does not get pulled back out, which is exactly why the setting should be the first thing you change, not the last.

Anthropic does not train on inputs or outputs from its commercial products by default, and in September 2025 it cut standard API log retention from 30 days to 7. Microsoft states plainly that Microsoft 365 Copilot prompts, responses, and the data it retrieves through Microsoft Graph are not used to train the underlying foundation models. The pattern across all three is the same: pay for a business relationship and training is off; use the free front door and you are often part of the training set until you say otherwise.

Where does your data actually go when you use an AI tool?

When you send a prompt, your text leaves your device, travels to the vendor’s servers, is processed by a model that may run in a data centre on another continent, and the response travels back. Along the way, three things can happen to it: it can be stored for a period (logs, abuse monitoring, chat history), it can be used to train future models, and it can be shared with sub-processors — the other companies the vendor relies on to run the service. Data security with AI means understanding and constraining all three.

Storage is usually the least discussed and the most consequential. Even when a vendor never trains on your data, it may retain logs for a window — to investigate abuse, to debug, or because you asked for chat history. Anthropic’s standard API retention is now 7 days; OpenAI retains data for a defined period unless you have a zero-retention arrangement. For genuinely sensitive material, the question to ask is not “do you train on this?” but “how long do you keep it, and can you keep none of it?”

Location matters under European law. If your provider processes data outside the European Economic Area, you need a lawful transfer mechanism. This is why several vendors now offer EU data residency or an “EU Data Boundary”: traffic from EU customers is kept within EU infrastructure. It is worth confirming this explicitly rather than assuming, because residency commitments sometimes carve out specific models or features that still route elsewhere.

What does GDPR require when you use AI tools?

Under GDPR, when you decide what data to feed into an AI tool and why, you are the data controller and the vendor is your data processor. That relationship is not optional and not informal — it has to be governed by a written contract, the Data Processing Agreement (DPA), under Article 28. If you are processing personal data through an AI tool without a signed DPA in place, you have a compliance gap regardless of how careful the vendor is internally.

Article 28 sets out what that contract must contain. The processor may only act on your documented instructions; it must keep its staff under confidentiality obligations; it must help you respond to data-subject requests (access, deletion, and the rest); it must delete or return the data when the contract ends; and it must submit to audits or provide audit reports. A reputable AI vendor will already have a DPA you can sign — usually a click-through or a downloadable addendum. If a vendor cannot produce one, that is a decision in itself.

Two GDPR obligations bite specifically when AI is involved. First, data minimisation: you should only put into the tool the personal data you actually need for the task. Pasting an entire customer export to draft one email is a minimisation failure even if the vendor is impeccable. Second, transparency and lawful basis: if AI processing makes a meaningful difference to how you handle someone’s personal data, your privacy notice should reflect it, and you need a lawful basis for that processing. For higher-risk uses — large-scale profiling, sensitive categories of data — a Data Protection Impact Assessment may be required before you start.

How do you switch off training and minimise access?

The strongest privacy posture comes from combining three moves: choose the right tier, turn off training where it defaults on, and reduce what the tool can see in the first place. Configuration does most of the work, and most of it is free.

Turn off training on consumer tiers. If you must use a consumer plan, the toggle is usually under a “Data Controls” or “Privacy” section. In ChatGPT it is Settings → Data Controls → Improve the model for everyone → off. Do this on every account in the business, not just your own — colleagues using personal logins are the most common leak.

Use temporary or no-history modes for sensitive sessions. Several tools offer an ephemeral mode where the conversation is not saved to history and is excluded from training entirely. OpenAI’s Temporary Chat, for example, is deleted after 30 days and is never used for training even when the main toggle is on. For one-off sensitive questions this is often cleaner than relying on settings alone.

Apply least-privilege access — the “restricted mode” mindset. This is the step small businesses skip and regret. When an AI assistant connects to your email, files, or CRM, scope that connection as narrowly as the task allows. Give it access to one folder, not the whole drive; a read-only role, not write; a single mailbox, not the organisation. The less the tool can reach, the smaller the blast radius if anything goes wrong — with the vendor, with a misconfiguration, or with a compromised account on your side.

Strip what the model does not need. Pseudonymise or redact before you paste. The model can usually do the job with “the customer” instead of a full name, address, and account number. What never enters the tool can never be stored, trained on, or leaked.

What should you look for in a vendor’s contract?

Before you route business data through any AI tool, read for these specific commitments — and treat their absence as a finding, not a formality:

• A signed DPA that meets GDPR Article 28: documented instructions, confidentiality, deletion or return of data on termination, and audit rights.
• An explicit no-training statement for your tier, in writing in the terms or DPA — not just a marketing line on the homepage.
• Data retention periods stated in days or hours, with a zero-retention option for sensitive workloads if you need one.
• Sub-processor transparency: a published list of sub-processors, advance notice of changes, and a right to object. The vendor stays liable for its sub-processors’ failures, but you only get to act on changes if you are told about them.
• Data location and transfer mechanism: where processing happens, whether EU residency is available, and the legal basis for any transfer outside the EEA. Check whether specific models or features are carved out of the residency commitment.
• Security certifications such as ISO 27001 or SOC 2, as evidence the technical and organisational measures are real and externally checked.
• Clear breach-notification terms: how quickly the vendor tells you about an incident, so you can meet your own 72-hour GDPR notification clock.

A vendor that publishes all of this and writes honestly about its limits is usually a safer partner than one that promises everything and documents nothing. The goal is not to find a tool with zero risk — it does not exist — but to choose one whose handling of your data you can describe in a sentence and defend in an audit.

The bottom line for SMEs

AI data security for a small business is not a product you buy; it is a set of decisions you make once and then enforce. Pick business tiers over personal logins. Confirm in writing that your tier does not train on your data, and turn off training where it defaults on. Sign the DPA. Minimise what you put in and scope tightly what the tool can reach. Read the contract for retention, sub-processors, location, and breach terms before the data flows, not after.

Done in that order, adopting AI becomes a controlled, documentable risk rather than a quiet liability sitting inside someone’s personal chat history. That is the difference between using AI responsibly and hoping nobody asks where the data went.

Educational material, not legal advice. As of 2026 — interpretation of the EU AI Act may change.