How to Protect Customer Data When Using AI (Without a Legal Team)

Somebody on your team has already pasted a customer email into ChatGPT. Probably this week. They weren't being careless — they were trying to get a reply written faster, and nobody ever told them where the line was.

That's the actual shape of the risk for a small business. Not a dramatic breach, just a slow drift where customer names, invoices, contracts, and spreadsheets end up in whatever tool happened to be open. To protect customer data when using AI you don't need a compliance department. You need to know what's being sent, pick the right tier of the tools you already pay for, and write down one page of rules people will actually follow.

Here's what matters, in the order it matters.

What actually leaves your business

When someone uses a hosted AI assistant, the text they paste travels to the provider's servers, gets processed, and is stored for some period. That's true of every major assistant. The questions worth asking are narrower than "is it secure," and there are four of them.

• Is it used for training? This is the one that separates tiers. Consumer plans have historically defaulted to using conversations to improve the model, with an opt-out buried in settings. Business and enterprise tiers of the major assistants exclude your data from training by contract.
• How long is it retained? Most providers keep conversations for a defined window even after you delete them, for abuse monitoring. Business plans usually let an admin set this.
• Who inside the provider can see it? Almost always a small number of staff under limited circumstances, but it's worth knowing rather than assuming.
• Where is it stored? Relevant if you're in a regulated field or have contracts specifying where data can live. For most small businesses it isn't the deciding factor. For a Canadian clinic or a firm with government clients, it is.

You can answer all four in about fifteen minutes by reading the terms for the specific plan you pay for. Not the product — the plan. The gap between the free and paid tier of the same assistant is usually wider than the gap between two different assistants.

Send less, and most of the problem disappears

The strongest control available to a small business isn't a setting. It's sending less in the first place.

Almost every task people use AI for works fine on redacted material. Drafting a reply to an unhappy customer doesn't require their real name or account number. Summarizing a contract dispute doesn't require the counterparty's legal entity. Categorizing two hundred support requests doesn't require the email addresses attached to them.

Rewrite the customer's real details as placeholders before pasting:

[CUSTOMER NAME]  instead of the actual name
[ACCOUNT #]      instead of account or invoice numbers
[ADDRESS]        instead of anything location-specific
[AMOUNT]         when the exact figure isn't the point

Then paste the AI's draft into your own system and put the
real details back in there.

Two minutes of substitution removes most of the exposure and costs you nothing in output quality. Where you're doing this repeatedly for the same job, build it into the prompt you save rather than relying on memory — that's what turns it from a good intention into an actual control. Our inbox triage system is written this way for exactly this reason.

There is a hard line underneath the redaction habit. Payment card details, government IDs, health records, and login credentials shouldn't go into a general-purpose assistant at all, business tier or not. Not because the provider is untrustworthy, but because the moment they're in a chat log they're in a system you don't control and can't audit.

Pay for the business tier if you handle real customer data

For most small businesses this is the single highest-value decision on the page, and it's usually twenty to thirty dollars a user per month.

The business tiers of ChatGPT, Claude, Gemini, and Copilot buy you three things that matter: your data is excluded from training by default, an admin can set retention, and you get per-user accounts instead of a shared login. That third one sounds administrative and turns out to be the important one, because it means you can see who used what and remove access when somebody leaves.

If you're weighing the cost against the free tier, the honest comparison isn't features. It's what it would cost you to explain to a client that their contract went into a free consumer account. We wrote up the wider cost picture in what AI actually costs a small business.

The one-page policy people will actually follow

Long policies don't get read. What works in a business of five to fifty people is a single page with three lists.

1. Approved tools. Name the exact tools and plans staff may use for work. Anything not on the list needs a quick ask first.
2. Never paste this. Payment details, government IDs, health information, credentials, and full customer lists or exports. Be specific, because "sensitive data" means nothing to someone in a hurry.
3. Ask when unsure. Name one person. If people don't know who to ask, they guess, and they guess in the direction that gets their work done.

Put it where people already look, mention it once in a team meeting, and revisit it when you add a tool. That's a genuinely proportionate control for a small business, and it beats a twelve-page document nobody opens.

Worth documenting alongside it: which AI-assisted steps exist in your recurring processes at all. If you can't list them, you can't govern them. The SOP writer is a reasonable way to get that written down while you're documenting the process anyway.

Where this breaks

Nothing here makes you compliant with anything.

If you're in health, finance, law, or you handle EU residents' data, you have specific obligations — GDPR, PIPEDA, HIPAA, or your regulator's rules — and they can require data processing agreements, records, and assessments that no article can substitute for. This page reduces everyday exposure. It doesn't discharge a legal duty, and if you're in one of those fields, a couple of hours with someone qualified is the right next step.

The other limit is that these terms change. Providers revise privacy and training defaults regularly, and a setting you checked eighteen months ago may not be the setting you have now. Put a calendar reminder to re-read the terms for your plan twice a year. It takes fifteen minutes and it's the only maintenance this needs.

Start here

Do three things this week: check which plan tier your team is actually on, write the one-page list, and pick your placeholder convention so redaction becomes a habit rather than a decision.

If you're weighing whether a workflow should run on a hosted assistant at all or needs something you control, that judgment is what prompts vs. skills vs. custom AI systems walks through, and the automation opportunity audit will help you map which of your processes touch customer data before you automate them.