ChatGPT, Claude and Copilot all come in two very different flavours: the personal one anyone can sign up to in a minute, and the business one your company sets up and pays for. They share a name and a logo, so it’s easy to assume they’re the same thing. They aren’t, and the gap matters most when the person typing is working with client information.
Same name, different product.
Each of the big three splits its range in two. The split isn’t about price. It’s about who the account belongs to.
- ChatGPT: Free, Plus and Pro are what OpenAI calls services for individuals. ChatGPT Business, Enterprise and Edu are its business services.
- Claude: Free, Pro and Max are consumer plans, covered by Anthropic’s Consumer Terms. Team, Enterprise and the API are commercial products, covered by its Commercial Terms of Service (Anthropic).
- Microsoft Copilot: used with a work account, it comes under Microsoft’s enterprise data protection, with the same contractual terms as the emails in your Exchange and the files in your SharePoint.
One thing people often miss: paying for a personal plan doesn’t turn it into a business one. ChatGPT Plus and Claude Pro are still individual plans, tied to one person’s login.
What a personal account does with your data.
On personal plans, what you type can be used to train the provider’s models, unless you switch that off.
OpenAI says that for Free, Plus and Pro, “we may use your content to train our models”. You can opt out under Settings, then Data controls. Even then, if you give a response a thumbs up or down, the entire conversation attached to that feedback may still be used for training.
Anthropic gives Free, Pro and Max users a choice about whether their data is used to improve future models.
The NCSC’s advice on public chatbots is blunt. Your query is visible to the provider, and those queries “are stored and will almost certainly be used for developing the LLM service or model at some point”. It recommends not including sensitive information in them.
Opting out helps. But it relies on every individual finding the setting, on every account, and staying opted out. That’s a thin foundation for client data.
What a business account changes.
Business versions are built around the things a company needs to be able to say yes to.
- Your data stays out of training by default. OpenAI says it doesn’t use inputs or outputs from ChatGPT Business, Enterprise, Edu or its API to improve its models by default. Anthropic says the same of its commercial products, and Microsoft says Copilot prompts and responses aren’t used to train its foundation models.
- There’s a contract. With Copilot, Microsoft acts as a data processor under its Data Protection Addendum.
- Your business gets some control. Microsoft says Copilot respects your permissions, inherits your sensitivity labels, applies your retention policies and supports auditing of interactions. Which controls you get depends on your subscription.
Why work shouldn’t run on a personal account.
Client data can end up somewhere you can’t get it back from. If the setting is on, or someone forgets to switch it off on a new device, client information goes into a model’s training pool.
No agreement covers it. When a provider handles personal data for your business, the ICO says you need a written contract with them. A personal sign-up is an agreement between one employee and the provider. Your business isn’t a party to it.
You can’t see it or switch it off. There’s no admin who can tell which accounts are in use, what’s gone into them, or turn one off. With a business version there usually is.
The work leaves with the person. The chats, uploaded files and custom assistants live in someone’s personal login. When they leave, or lose access, so does the business.
It sits outside your security. A work account is covered by your own sign-in rules, such as multi-factor authentication. A personal account is a password on someone’s phone.
What to do instead.
You don’t need to ban AI. Most of the people using personal accounts at work are trying to do their jobs well. The aim is to give them something safe to reach for.
- Find out what’s already in use. Ask the team which tools and which accounts they use. Our guide to shadow AI explains why most businesses are surprised by the answer.
- Choose an approved business tool and licence it. Our comparison of Claude and Microsoft Copilot can help you decide, and how to use Microsoft Copilot at work covers getting started.
- Write a one-page rule. Which tools are approved, and what never goes into any AI tool: client names, financial details, passwords, anything covered by an NDA.
- Move people across. Make the approved tool the easy option, and agree a date after which work stops running on personal accounts.
- Check again every few months. New tools turn up constantly.
Every figure and claim above links to where it came from.
