AI and Data Privacy: What Businesses Should Know Before They Adopt AI
Where your data goes when employees use AI tools, which provider terms to check, and the practical controls that keep client information protected.
Before adopting AI, a business should know three things: what data employees will send to AI tools, what the provider does with that data under its terms, and which controls limit who can access it. The privacy risk with AI is rarely the technology itself. It usually comes from sensitive information being entered into tools that were never approved for it, or from systems connected to more data than they need. This article explains the key questions in practical terms. It is not legal advice; consult your attorney about your specific obligations.
Where your data goes when someone uses AI
When an employee types or uploads something into an AI tool, that content is sent to the provider's servers to be processed. What happens next depends on the provider and the type of account:
- Retention. How long are inputs and outputs stored, and can you control it?
- Training. Is your content used to improve the provider's models? Terms often differ between consumer and business plans, and between chat products and APIs.
- Access. Who at the provider can view your data, and under what circumstances?
- Location. Where is the data processed and stored?
- Subprocessors. Which other companies are involved in delivering the service?
These answers are found in the provider's terms of service, privacy policy and, for business plans, data processing agreements. They change over time, so review them periodically.
Consumer accounts versus business accounts
One of the most common risks is employees using personal or free accounts for work. Business and enterprise plans generally offer stronger contractual commitments and administrative controls, such as centralized user management, retention settings and audit logs. Check the specific terms of each provider rather than assuming.
Know which data is sensitive
Not every piece of information carries the same risk. A simple classification helps employees make good decisions:
| Type of data | Examples | General approach |
|---|---|---|
| Public | Marketing copy, published prices | Low risk with approved tools |
| Internal | Procedures, internal notes | Business accounts with appropriate terms |
| Confidential | Client files, contracts, financials | Only in systems specifically approved for it |
| Regulated | Health records, payment card data, Social Security numbers | Only in systems designed and approved for that data, with your compliance advisor involved |
If your business is subject to rules such as HIPAA, or has contractual confidentiality obligations to clients, those requirements apply to AI tools just as they apply to email or file storage.
Practical controls that protect data
Policy and training
Write down which tools are approved and what data may be used with each. Then train people on it with real examples. Our AI training includes a safe-use module for exactly this reason.
Account management
Use company-managed accounts with single sign-on and multi-factor authentication. When an employee leaves, their access to AI tools should end along with everything else.
Least-privilege connections
When an AI assistant or agent is connected to company systems, give it access only to the folders, mailboxes or databases its task requires. An assistant that answers HR policy questions does not need access to payroll files.
Data minimization
Send the AI only what it needs. Custom applications can remove or mask personal identifiers before content is processed, where the task allows it.
Logging and review
Keep records of what AI systems access and do, so you can investigate questions or incidents.
How custom AI applications can help with privacy
A custom application gives you more control over data flow than a general-purpose tool. It can restrict which documents are used, enforce permissions, mask sensitive fields, log every request and run on hosting you choose. We build these with Claude Code, Anthropic's agentic coding tool, which helps us deliver tested code efficiently, and our founder Max holds CompTIA Security+, so security is designed in from the start. You also own the source code, which makes independent review possible.
For a review of your current exposure, see our cybersecurity services.
Questions to ask any AI vendor
- Is our data used to train your models, and can we opt out?
- How long is our data retained, and can we delete it?
- Do you offer a data processing agreement or similar contractual terms?
- What administrative and audit controls are available?
- Where is the data processed and stored?
- How do you notify customers of security incidents?
FAQ
Is it safe to use AI with client information?
It can be, with the right tool, account type, configuration and policy. The safe approach is to decide in advance which systems are approved for which data, rather than leaving it to individual judgment.
Do free AI tools use what we type to train their models?
Some do, depending on the provider and settings. Review each tool's current terms, and prefer business accounts with clear commitments for work use.
What should we do if someone shares sensitive data by mistake?
Report it internally right away, review the provider's deletion options and consult your legal advisor about any notification obligations. A clear, non-punitive reporting process helps these situations surface quickly.
Review your AI privacy posture
If your team is already using AI, or you are planning to, a short review can show where data is going and which controls are missing. Request a free IT assessment and we will help you put practical safeguards in place.
