Using ChatGPT and AI tools safely in a small business

Yes, ChatGPT and similar AI tools can be used safely in a small business, as long as you keep client and staff personal information out of public versions, check the data settings on the plan you use, and give staff simple written rules. Australia’s privacy regulator, the OAIC, recommends as best practice that businesses don’t enter personal information, and particularly sensitive information, into publicly available generative AI tools. Most of the everyday value, like drafting, summarising public material and planning, doesn’t need personal information at all.

This guide puts the OAIC guidance in plain English, explains when the Privacy Act applies to you, and gives you a one-page staff policy and some safe places to start. It’s general information, not legal advice.

The short answer

• Don’t paste personal or confidential information into free or personal AI accounts.
• Use a business plan where your inputs aren’t used to train the vendor’s models by default, and check the settings yourself.
• Check every output before it goes to a client. AI tools get things wrong with confidence.
• Write it down. A one-page policy tells staff what’s allowed, so they don’t have to guess.
• Be open about it. If AI touches customer information, say so in your privacy policy.

What the OAIC guidance says, in plain English

In October 2024 the Office of the Australian Information Commissioner published guidance on privacy and the use of commercially available AI products. It’s written for organisations covered by the Privacy Act. The main points:

• Privacy law applies to what goes in and what comes out. Personal information you type into an AI tool, and personal information it produces, are both covered.
• Do your homework before you adopt a tool. Understand what it’s for, its limits, its security, and who can see your inputs and outputs. The OAIC says this shouldn’t be “set and forget”.
• Be transparent. Update your privacy policy and notices to explain how you use AI, and make it clear to people when they’re dealing with an AI tool, such as a chatbot, rather than a person.
• Stick to the original purpose. If you collected information to do someone’s tax return, feeding it into an AI tool for an unrelated purpose may need their consent.
• AI-generated information counts. If a tool produces or infers information about an identifiable person, that’s treated as collecting personal information.
• Accuracy is your job. The OAIC notes that AI systems are known to produce inaccurate or false results, so you need human checks.
• Keep personal information out of public tools. As a matter of best practice, the OAIC recommends not entering personal information, and particularly sensitive information, into publicly available generative AI tools, because of the privacy risks involved.

Does the Privacy Act apply to my business?

According to the OAIC’s small business page, a business with annual turnover of $3 million or less is generally exempt. Turnover here includes all income from all sources. But the exemption has exceptions. Regardless of turnover, the Act covers businesses that include:

• health service providers, which takes in allied health, gyms and childcare in many cases
• businesses that trade in personal information
• contractors providing services under a Commonwealth contract
• credit reporting bodies and residential tenancy database operators
• reporting entities under anti-money laundering law
• businesses related to a business the Act covers
• businesses that have opted in

The OAIC page lists a few more categories, so check it for your situation. Even if you’re exempt, the OAIC guidance is a sensible standard to follow. Your clients don’t know your turnover, and a leak of their details hurts your reputation either way. Rules in this area can change, so check the OAIC site before relying on an exemption.

What not to paste into a public AI tool

“Public” here means a free or personal account, or any tool where you haven’t checked how your data is used. Keep these out:

• names with contact details, dates of birth or addresses
• health, financial, tax or legal information about a person
• tax file numbers, licence numbers, Medicare numbers, bank details
• client files, emails and complaints that identify someone
• staff records, performance notes or payroll
• passwords, API keys and system access details
• confidential business information: unsigned quotes, pricing models, contracts, unreleased plans

Removing the name isn’t always enough. A message that mentions “our client, the only orthodontist in Mudgee” identifies someone without naming them.

Settings and plans to check

AI vendors treat business and personal accounts differently. Before you approve a tool, check:

• Training on your data. OpenAI’s data controls help page says personal ChatGPT plans share data for model training by default, which you can turn off under Settings, Data controls, “Improve the model for everyone”. It says business plans such as ChatGPT Business and Enterprise don’t use your inputs and outputs for training by default. Other vendors have their own equivalents, so read their documentation.
• Who owns the account. Staff using personal logins for work means the business can’t see, control or delete what was shared. A business workspace fixes that.
• Retention and deletion. How long are chats kept, and can an admin delete them?
• Connected apps. Many tools can now connect to your email, files or calendar. Each connection widens what the tool can see.
• Where data is stored and whether the vendor offers a data processing agreement.

A one-page AI policy for staff

Your policy doesn’t need to be long. Cover these headings in plain language:

1. Approved tools: which tools and which accounts. Business accounts only for work.
2. Never enter: the list from the section above.
3. Allowed uses: drafting, summarising public information, brainstorming, formatting, internal how-to questions.
4. Needs approval: anything involving client information, even in an approved tool, and any new tool or plugin.
5. Human check: a person reviews every AI output before it reaches a client, and the person who sends it is responsible for it.
6. No AI-only decisions about people, such as hiring, credit or pricing for an individual.
7. Report mistakes: if someone pastes something they shouldn’t have, they tell the owner straight away, without blame.
8. Review date: look at the policy again every six months.

The Australian Government’s Guidance for AI Adoption, released by the National AI Centre in October 2025, sets out six practices for using AI responsibly, with a Foundations version for businesses new to AI and an AI policy template you can adapt.

Safe, useful places to start

Plenty of high-value work involves no personal information at all:

• drafting website pages, job ads, service descriptions and standard email templates
• turning rough notes into a clear procedure or checklist for staff
• summarising public documents such as standards, regulator guidance or tender documents
• brainstorming ideas for a newsletter, campaign or workshop
• rewriting a document in plainer English
• help with spreadsheet formulas or software settings

Once those habits are in place, you can look at AI that handles customer conversations, like AI receptionists or AI chatbots on your website. Those need more care: a privacy policy update, a clear disclosure that people are talking to AI, and a handover to a person.

Firms in professional services, like accountants, lawyers and advisers, hold more sensitive client information than most, so the policy and the business-plan check matter even more there.

Where to start

1. Ask your team which AI tools they already use and on which accounts.
2. Pick one or two approved tools and move work onto business accounts.
3. Check the training, retention and connected-app settings on each.
4. Write and share your one-page policy.
5. Update your privacy policy if any personal information will go into AI tools.
6. Choose two or three safe uses from the list above and try them for a month.

If you’d like help choosing tools, setting them up properly or building AI into your systems with the right guardrails, that’s what our AI for business work covers.