If you’re using Claude at work — for client emails, drafting, or research — the question worth answering before it becomes a habit isn’t “is it useful,” it’s “what happens to what I type into it.” The honest answer depends entirely on which Claude plan you’re using, and the difference matters a lot more once real client or business data is involved. Here’s how it actually works for UK businesses.
The Short Version
Anthropic (the company behind Claude) offers different data handling depending on plan. On the free and Pro consumer tiers, conversations may be used to help improve Claude unless you actively opt out in your settings. On Team and Enterprise plans, conversation data is not used for model training by default, and you get proper admin controls — user management, data retention settings, and audit visibility. For a UK business handling client data regularly, that difference isn’t a minor detail — it’s the whole decision.
What Anthropic Actually Does With Your Data
Anthropic’s published policy is that Claude conversations are retained to operate the service (answering your requests, maintaining conversation history) and, for consumer plans, may additionally be used to train future models unless you turn that off. You can opt out of training use in your account settings even on the free tier — but it’s off by default in the sense that you have to go and turn it off, not the reverse. Team and Enterprise customers get training-data exclusion by default as part of the plan, along with a data processing agreement, which is the paperwork that matters if you’re ever asked to demonstrate compliance.
Where Data Is Processed
Anthropic is a US company, and Claude’s infrastructure runs primarily on US-based cloud providers. For most UK small businesses this is manageable under UK GDPR via the same international-transfer mechanisms that apply to virtually every major cloud and SaaS tool already in use — Microsoft 365, Google Workspace, and most CRM and accounting platforms all involve similar transfers. It’s not a reason to avoid Claude specifically, but it is something to have an answer for if a client or auditor asks, particularly under ISO 27001 or Cyber Essentials Plus, where supplier data handling is explicitly in scope.
Practical Recommendations for UK Businesses
- Testing and personal use: the free tier is fine — just turn off training-data use in settings if you’re ever pasting in anything remotely business-related, even hypothetically.
- Regular use with real client or business data: move to a Team or Enterprise plan. The training-data exclusion and admin controls aren’t a nice-to-have at this point, they’re the baseline.
- Never paste in: full financial records, health information, or anything covered by a specific client confidentiality agreement — not because Claude is unusually risky, but because no general-purpose AI tool should be the first place sensitive personal data lands, on principle.
- Document the decision. If you’re ISO 27001 certified or working towards Cyber Essentials Plus, add Claude (and any AI tool in regular use) to your supplier/asset register with a note on which plan you use and why. Auditors ask about AI tool usage now, and “we haven’t thought about it” is the answer that causes problems.
How This Compares to Other AI Tools
Claude’s approach — opt-out training on consumer tiers, opt-in exclusion by default on business tiers — is broadly in line with ChatGPT and Gemini’s business offerings. None of the major AI assistants are meaningfully worse or better here in 2026; the risk isn’t the specific tool, it’s using any consumer-tier AI product for regulated or sensitive data without checking which tier you’re actually on. The fix is the same regardless of which assistant your team prefers: know what plan you’re on, and match the plan to what you’re actually putting into it.
Next Steps
If Claude is already part of your team’s workflow, the first step is simply checking which plan everyone is actually using — it’s common for a business to have started on the free tier during testing and never moved off it once real work started going through it. If that’s the case here, upgrading to Team is a five-minute change with a real compliance benefit attached.
More Guides
- What is Claude AI? Everything You Need to Know
- Claude AI Free vs Paid: Which Plan Do You Actually Need?
- What is ISO 27001? A Plain English Guide for UK Businesses
- Cyber Essentials and UK GDPR: How They Work Together
