Use AI with customer data safely

AI tools save time, but pasting the wrong thing into the wrong tool can put your customers’ details somewhere you didn’t intend. This guide helps you sort your information into three groups, decide which tools each group can go into, and write a one-page rule sheet so you and your team handle it the same way every time. It’s practical guidance, not legal advice. For questions about the law in your area, speak to a qualified adviser.

Before you start

• A list of the AI tools you and your team use, including any built into apps you already have.
• A rough idea of the customer information your business holds: names, contact details, orders, bookings, notes, payment details.
• Your privacy policy, if you have one.
• About 45 minutes.

Want to do it yourself?

Difficulty

6 out of 10

Estimated completion time

2–3 hours for a draft policy, plus any specialist review

Skills you’ll need: Classify business information, inspect tool privacy settings, and remove identifying details. Uncertain obligations need qualified advice.

I’ll do it myselfI’d rather get help

How this helps your brand

Clear rules for customer information help your team use AI consistently with your business’s privacy decisions. Knowing which tools handle which data supports trust when improving service and internal processes.

1. 1

   Step 1: Sort your information into three groups

   Go through what your business handles and put each kind of information into one of three groups. Write it down as a simple list.

   • Public: anything already on your website or social media, like your services, opening hours and published prices.
   • Internal: things about your business that aren’t public but aren’t about a specific person, like plans, drafts, supplier quotes and team notes.
   • Sensitive: anything about a specific person, like customer names, emails, phone numbers, addresses, order history and messages. Also anything about money, health, contracts or staff records.

   Tip: If you’re unsure which group something belongs in, put it in the more careful one.

   Illustrated exampleSort the information, not just the document

   Example · a garden maintenance business

   01Public

   “Garden tidy-ups from £60”Already published on the business website.

   02Internal

   “Draft plan: add a Saturday service”A business idea that has not been published.

   03Sensitive

   “Maya Lane · Friday booking · home address”These details belong to a specific customer.

   ↳A public service price plus a customer’s booking becomes sensitive.

2. 2

   Step 2: Check what each AI tool does with what you type

   Online AI tools differ in what they keep and whether they use your chats to improve their models. Settings often differ between free, paid and business plans. For each tool on your list, look up its official privacy or data page and note:

   • Whether your chats can be used to train its models, and whether you can switch that off.
   • How long chats are kept, and whether you can delete them.
   • Whether your plan includes a business or data-processing agreement, if you need one.

   Tip: Private AI that runs on your own computer, such as LM Studio, Ollama or AnythingLLM with a local model, keeps what you type on your machine. Check the app’s settings to confirm it isn’t connected to an online service.

3. 3

   Step 3: Match each group to the tools allowed

   Now set a simple rule for each group. A common, careful starting point:

   • Public: fine for any AI tool.
   • Internal: only tools whose data settings you’ve checked and are happy with.
   • Sensitive: only private AI on your own computer, or remove the personal details first (next step). Never paste payment card numbers, passwords or ID numbers into any AI tool.
4. 4

   Step 4: Learn to take personal details out

   Most tasks don’t need to know who the customer is. Before pasting into an online tool, swap personal details for placeholders:

   • Names become [customer] or [staff member].
   • Emails, phone numbers and addresses come out completely.
   • Order numbers and account numbers become [order number].
   • Anything about health, money or family situations is left out unless the task truly needs it.

   Tip: Add the real details back in your email or booking system, after the AI has done its part.

   Illustrated exampleKeep the task; take the customer details out

   Fictional booking note · preparing a reply

   Original in your booking system

   Maya Lane ([email protected]), booking G-1048, wants to move a garden tidy-up from Tuesday to Friday.

   Remove the name and email.
   Replace the booking reference.

   →

   Prepared for the AI task

   [customer], booking [order number], wants to move a garden tidy-up from Tuesday to Friday.

   Draft a friendly reply asking which time on Friday suits them.

   1. 1Take personal details out
   2. 2Let AI draft the wording
   3. 3Add real details back in your booking system

5. 5

   Step 5: Write it on one page and share it

   Put your three groups, the tools allowed for each, and the “take details out” rules on a single page. Share it with anyone who uses AI for your business, and keep it somewhere easy to find.

   Check it matches what your privacy policy tells customers. Review it when you start using a new AI tool, or at least once a year.

6. 6

   Step 6: Get advice on anything you’re unsure about

   Privacy and data protection rules vary by country and industry, and some businesses, such as health, finance, legal or anything involving children, have extra rules. This guide can’t tell you what the law requires for your business.

   If you handle sensitive information regularly, or you’re unsure whether a use is allowed, check your country’s official data protection guidance and speak to a qualified legal or compliance adviser.

Help me write a one-page AI data rule sheet for my small business. This isn’t a request for legal advice; please flag anything I should check with a qualified adviser.

My business: [type of business] in [country or region]
Customer information we handle: [for example, names, emails, phone numbers, booking history, notes about jobs]
AI tools we use: [for example, ChatGPT on a free plan, Gemini in Google Workspace, LM Studio on my laptop]

Please:
1. Sort the information into three groups: public, internal and sensitive.
2. Suggest which of my tools each group can go into, and explain why in plain English.
3. Give simple rules for taking personal details out before using an online tool, with an example.
4. List what I should check on each tool’s official privacy page. Don’t guess at their current settings.
5. List any questions I should take to a legal or compliance adviser.
6. Keep it to one page, in plain English, so my team will actually read it.