AI tools make it easy to paste customer information into a box. Privacy law in Australia, New Zealand and the UK treats that information seriously, and so do customers. Here is the boundary we set before any AI work begins.
Know which rules apply to you
In the UK, UK GDPR and the Data Protection Act 2018 apply to almost every business that handles personal information, whatever its size. In New Zealand, the Privacy Act 2020 applies to businesses of all sizes. In Australia, the Privacy Act generally applies to businesses with annual turnover above $3 million, with exceptions such as health service providers and businesses that trade in personal information. Reform of the small business exemption has been under discussion, so check the current position.
Even where a law does not strictly apply, customers assume their details are handled with care. A privacy surprise costs more trust than almost any other mistake.
The Studio data boundary
Before we use AI on any task, we classify what goes in. Public information can usually be used freely. Business information needs an approved tool with clear terms on storage and training. Personal and sensitive customer information needs a strong reason, an approved tool and often a different approach entirely.
We often find a better option. Remove names before analysis. Summarise themes from feedback rather than pasting raw messages. Use AI on the template, not the customer record. The work still gets faster, and nobody's details leave the building.
| Information | Typical approach |
|---|---|
| Public content | Use freely with any reputable tool |
| Internal business information | Approved tool with clear storage and training terms |
| Customer personal information | Remove identifiers first or keep out of AI tools |
| Sensitive information such as health | Avoid, unless there is a strong reason and specialist advice |
Put it to work
A practical next step
List the AI tools your team actually uses, including free ones. For each, write down what kind of information goes into it. Agree one simple rule for customer information this week.
Explore the toolsSources and method
- OAIC guidance on privacy and commercially available AI products
Australian privacy guidance for businesses using AI tools.
- ICO guidance on AI and data protection
UK guidance for organisations using AI with personal data.
- Office of the Privacy Commissioner New Zealand
Guidance on the Privacy Act 2020, including AI use.
The methods in this article are Maurice Studio recommendations. External sources inform the underlying principles and rules referred to. They do not validate the Studio approach or guarantee commercial results. Rules change, so check the current position for your business and get specialist advice where it matters.