Someone in your business pasted a client's details into an AI tool this month and didn't mention it. They weren't being reckless but they had a quote to get out so they pasted the lot into ChatGPT and asked for help. It took nine seconds and did a decent job.

That's the problem. Nothing went wrong so nobody said anything and then it happened again the next day.

What matters most is the account, not the tool

On ChatGPT's personal plans (Free, Plus, Pro) your conversations help train future models by default. It's a setting that stays on until somebody turns it off: Profile, then Settings, then Data Controls, then "Improve the model for everyone". Thirty seconds, no downside.

On the business tiers (Business, Enterprise, Edu) and the API your data is excluded from training by default and that's contractual rather than a toggle someone can forget. Microsoft 365 Copilot works the same way.

What not to paste

If you are using a personal account you should never post:

• Client names attached to details (address, phone, date of birth, account history)
• Tax file numbers, bank details, payment records
• Health information
• Licences, passports, ID documents
• Passwords and API keys
• Employee files
• Contracts under a confidentiality clause

The legal bit, briefly

The privacy regulator is blunt about this: as best practice. Don't enter personal information and especially sensitive information into publicly available AI tools. Your obligations cover what goes in as well as what comes out.

If you turn over under $3 million you're generally outside the Privacy Act with one exception that started this month. From 1 July 2026 anti-money laundering obligations extended to real estate professionals, dealers in precious stones and metals and to lawyers, conveyancers, accountants and trust and company service providers. If that's you, the Privacy Act now covers the personal information you handle for those obligations no matter your turnover.

General information, not legal advice.

Four things to do this week

1. Ask your team which AI tools they're using. You'll hear about one you didn't know existed.
2. Check whether those accounts are personal. If they are switch the training setting off today.
3. Create an AI Acceptable Use Policy (if you do not have one, reach out to our team and we can help)
4. If AI has become part of the job you should move it onto a business tier. Roughly the same money per head and the protection stops depending on somebody's memory.

None of this is hard. It's just never anybody's job so it doesn't get done and then one day you're on the phone to a client explaining where their information went.

If you're on a managed plan with us we can find the tools, fix the accounts and help you word the policy.

Sources: OAIC guidance on privacy and the use of commercially available AI products · OAIC privacy guidance for AML/CTF reporting entities · OpenAI Help Centre on data controls

‍