Is AI Safe for Client Information? A Privacy Act Guide for NZ Women Business Owners

Short answer: it depends on what you put in and which tool and settings you use. Is AI safe for business data in NZ? The Privacy Act 2020 applies to every New Zealand business using AI tools, whatever your size, and the Privacy Commissioner's advice is to avoid putting personal information into AI tools where you can. Plenty of work needs no client details at all, so you can use AI confidently on that today.

If you have held back from AI because you were not sure whether it was safe to paste in a client email, a staff review or a set of accounts, that caution is sensible. You do not have to stay away. You need to know where the line sits. This guide covers what the law expects, what you can safely use AI for, and a short check to run before you use any tool with personal information.

I am not a lawyer, and this is general information, not legal advice. If your business holds sensitive information such as health or financial details, get advice specific to you.

Does the Privacy Act apply to my business when I use AI?

Yes. The Office of the Privacy Commissioner (OPC) says the Privacy Act applies to businesses, government and community organisations of all sizes, and that it applies to everyone using AI tools in New Zealand. OPC does not set a size threshold.

New Zealand does not have a separate AI law. What you do with AI is covered by the same information privacy principles that already apply to how you collect, store, use and share personal information. Personal information simply means information about an identifiable person: a client's name and email, a staff member's performance notes, a customer's order history.

What does the Privacy Commissioner expect before you use an AI tool?

OPC has published guidance on AI and the information privacy principles. For an organisation using a generative AI tool, its expectations include:

• Think about whether you need it. Check the tool is necessary and proportionate for the job.
• Do a privacy impact assessment first. OPC says the best way to manage the risk is to do a privacy impact assessment before you start and update it regularly. That is a short written check of what information goes in, where it goes and what could go wrong.
• Be open about it. Tell people how, when and why you are using the tool.
• Have a human review the output. OPC says AI tools produce confident errors of fact and logic, so check before you act. It also says a human in the loop helps but may not be enough on its own.
• Make sure personal information is not retained or disclosed by the tool.

OPC's one-page summary also says that if you are in doubt, it recommends you do not use AI tools to handle personal information. I read that as a clear signal to start with the work that carries no personal information, and build up from there.

Is it safe to put client information into ChatGPT or Claude?

Treat it as not safe by default, and only go ahead once you have checked how the tool handles what you enter. The risk sits with how the provider treats your input, which varies by tool, by plan and by your settings.

OPC points to two questions to ask any provider: will the provider store the information you put in, and will it be used to train their AI systems? OPC warns that providers may not ring-fence your information from other information they hold, so personal information used for future training could later be leaked or re-identified. It suggests preferring tools where the contract stops the provider from using your input for training.

On overseas providers, OPC says using an offshore technology provider to store or process your data is not treated as a disclosure under information privacy principle 12, as long as the provider is not using that information for its own purposes. It adds that this may depend on the details of the tool, and that you remain responsible for protecting the information. In practice, that means reading the provider's current terms and data settings rather than assuming. They differ between free and paid plans and they change.

What can I use AI for without any client details?

A lot. Most of the value in AI for a small business comes from work that never touches personal information. Examples:

• Drafting a newsletter, a social post or a blog outline from your own ideas.
• Turning rough notes about a process into a clear checklist or SOP.
• Writing a template email or a job ad for a role.
• Summarising a public report or a long article you want to understand quickly.
• Planning a workshop, a meeting agenda or a launch timeline.
• Brainstorming names, offers or questions to put to a customer panel.

If you want to use AI on a real client situation, you can often describe it without identifying anyone. "A client in the hospitality sector has not paid a three-month-old invoice" gives the tool what it needs. Her name, her email and her invoice number add nothing.

What should I check before I use AI with personal information?

Run this five-step check first. It takes about half an hour the first time, and it is the practical version of the privacy impact assessment OPC recommends.

1. Write down what you want to use it for. One line, for example: "summarise client feedback forms". If you cannot say why you need personal information in the tool, leave it out.
2. List exactly what personal information would go in. Names, emails, health details, financial details, staff records. The more sensitive it is, the higher the bar.
3. Check the provider's data settings and terms. Look for whether your chats are stored, for how long, and whether they are used for training. Check for the plan you are actually on.
4. Decide who can use it and for what. Name one person responsible, and write a short note for the team on what it is for and what it is not for.
5. Plan for human review. Nothing the tool produces goes to a client or into your records until a person has read it and checked the facts.

Then check your privacy policy. If you are now using AI with personal information, your policy should tell clients how their information is handled.

What happens if client information is shared by mistake?

Under the Privacy Act, a notifiable privacy breach is one where personal information has been accessed, disclosed, altered, lost or destroyed without authorisation, and it is reasonable to believe someone has suffered serious harm, or is likely to. OPC says you must report it to the Privacy Commissioner as soon as practicable after anyone in your business identifies that these criteria are met, and that its expectation is within 72 hours. OPC's advice is that if you are not sure, you should notify.

The point of knowing this now is that you can write a one-line plan before you need it: who in your business decides, and who makes the call to OPC.

Where re:ampd fits

At re:ampd we help established New Zealand women business owners use AI with confidence and without the hype. Privacy and safety are the hesitations we hear most often, so they are built into how we teach. re:ampd is a Claude Partner and we teach Claude in our workshops, so weigh that when you read our views on tools. The privacy checks above apply to whichever tool you choose.

If you want to see how we think about safety settings and ethics in practice, read how we approach AI ethics, safety and privacy. If your question is about your accounts, see can you use Claude or ChatGPT with Xero in NZ. And if you are not sure where your business sits, our AI readiness checklist is a good place to start.

If you would rather set this up with someone beside you, the AI Masterclass series and our AI implementation support are built for exactly that.

Sources

• Office of the Privacy Commissioner, "AI and the Information Privacy Principles" (privacy.org.nz)
• Office of the Privacy Commissioner, "Artificial Intelligence & Privacy: What you need to know", one-page summary (privacy.org.nz)
• Office of the Privacy Commissioner, "What is a notifiable privacy breach?", updated November 2025 (privacy.org.nz/resources-and-learning/knowledge-base/view/536/)