You’re right to worry.
In Xero’s survey of NZ small businesses, 40% named privacy and security as a barrier to AI (Xero, May 2026). Most staff learn AI tools on their own, so the risk is usually a well-meaning person pasting a client list into a free chatbot.
Four questions before anyone pastes anything.
- Is it kept? Does the tool store what you type, and for how long?
- Is it used for training? Can you switch that off, and is it off by default on business plans?
- Where does it go? Which country and which company processes it?
- Who can see it? Your team, the provider’s staff, other customers?
What NZ privacy law expects.
The Privacy Act 2020 applies to personal information you put into any tool: collect only what you need, keep it secure, and be careful sending it overseas (Information Privacy Principle 12). The Privacy Commissioner has published guidance on generative AI for organisations. This is general information, not legal advice.
A simple rule for your team.
No client names, staff details, health information or financials go into a free AI tool. Use business plans with training switched off for anything sensitive, or keep that work inside a system you own, where the data never leaves your control.