Can Employees Use AI Tools With Customer Data?

Staff using AI tools at work can feel both exciting and a bit uncomfortable. Maybe your team is using ChatGPT to draft customer emails, summarise support tickets, analyse sales notes or clean up meeting transcripts.

The question is simple: can employees use AI tools with customer data? The answer is usually only if you have the right controls in place.

Customer data can include personal information, confidential information and information you promised a client you would protect. If that data is pasted into the wrong AI tool, you may lose control of where it goes, how long it's kept and whether it's used to train the tool.

This doesn't mean you need to ban AI altogether. It means you need clear acceptable use rules for what your team can use, what they can't use and when they need approval.

Can Employees Legally Use AI Tools With Customer Data?

Yes, employees can use AI tools with customer data in some cases, but only if the use is lawful, secure and allowed under your privacy notices, contracts and internal policies.

For Australian businesses, the first question is whether the data includes personal information. Under the Privacy Act 1988, personal information is information or an opinion about an identified individual, or someone who is reasonably identifiable. That can include names, phone numbers, email addresses, customer notes, order history, support tickets, health details, photos and call recordings.

If your business is covered by the Privacy Act, the Australian Privacy Principles apply. Many private sector businesses are covered if they have annual turnover of more than $3 million. Some smaller businesses are also covered, including some health service providers, credit reporting bodies, businesses that trade in personal information and contracted service providers to Commonwealth agencies.

Even if the Privacy Act doesn't apply to your business, you still need to think about:

• Confidentiality obligations in client, supplier and contractor agreements.
• Employment obligations and whether staff are following lawful and reasonable directions.
• Consumer law risks if AI-generated material is inaccurate or misleading.
• Commercial trust, especially if customers expect their information to stay inside your systems.

A common mistake is assuming that because an employee is doing the task for work, any AI use is automatically okay. That's not how it works. If the AI provider stores prompts, reviews inputs or uses data to train models, you may be disclosing customer information to a third party without meaning to.

What Privacy Risks Come Up When Staff Use AI At Work?

The main privacy risk is losing control over personal information once it's entered into an AI tool.

Some AI tools are designed for personal or casual use. They may not give you the settings, contract terms or security features a business needs. Others offer enterprise settings that can restrict training, limit data retention and give your business more control.

When staff use AI with customer data, the practical risks include:

• Unapproved disclosure: customer details may be sent to an AI provider, including an overseas provider.
• Training use: prompts or uploaded files may be used to improve the AI model, depending on the tool and settings.
• Security gaps: staff may upload spreadsheets, call recordings or client files into tools that haven't been reviewed.
• Inaccurate outputs: AI may produce wrong summaries, false assumptions or invented details.
• Over-collection: employees may upload more information than the task actually needs.
• Hard-to-track records: you may not know what data was entered, by whom or when.

Under the Australian Privacy Principles, you generally need to collect, use and disclose personal information for proper purposes that fit your privacy policy and customer expectations. If personal information is disclosed overseas, APP 8 can require you to take reasonable steps to make sure the overseas recipient doesn't breach the APPs, unless an exception applies.

There's also a data breach angle. If customer information is exposed through an AI tool and serious harm is likely, the Notifiable Data Breaches scheme may require you to notify affected individuals and the Office of the Australian Information Commissioner. If you need to assess a suspected eligible data breach, the Privacy Act gives you up to 30 days to carry out a reasonable and expeditious assessment.

Can Staff Put Customer Names, Emails Or Files Into ChatGPT?

It depends on the tool, settings, data type and purpose, but as a default rule, staff shouldn't put identifiable customer information into public AI tools without approval.

Customer names, email addresses and files are often personal information. They may also be confidential information under your client contracts. If an employee pastes a client spreadsheet into an AI tool to create a marketing segment, that may be a disclosure of personal information to the AI provider.

A safer approach is to separate AI uses into risk levels.

Lower-Risk Uses

These are usually easier to approve if your team follows basic rules:

• Drafting a generic email where no real customer details are included.
• Creating a checklist based on a fictional scenario.
• Summarising publicly available information.
• Rewriting website copy without uploading customer records.

Higher-Risk Uses

These should usually need manager or legal approval first:

• Uploading customer lists, CRM exports or support ticket data.
• Using AI to analyse call recordings or meeting transcripts.
• Entering sensitive information, such as health information, genetic information, some biometric information, criminal record information, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership or sexual orientation information, or other high-risk personal information such as financial hardship details or children's information.
• Using AI to make or recommend decisions that affect customers, such as eligibility, pricing, access to a service or complaint outcomes.

Say you run a cafe group in Brisbane with 4 venues and 18,000 loyalty program members. Your marketing coordinator wants to upload a CSV file with customer names, emails, birthdays, purchase history and postcode data into a free AI tool to create customer segments. Even if the goal is harmless, the file contains personal information. If the tool stores the file or uses it for training, you may have disclosed that information without telling customers or checking the provider's terms.

A better option might be to remove names and emails, use internal analytics where possible, or use an approved enterprise AI tool with training turned off and a written provider agreement.

What Should An Employee AI Use Policy Say?

Your employee AI use policy should clearly tell staff what AI tools they can use, what data they can enter and when they need approval.

This is different from a broad innovation policy. Your team needs practical rules they can follow during a busy workday. If the policy is vague, staff will make their own judgment calls, and those calls may not match your legal obligations or client promises.

Here is a useful outline you can tailor for your business. A lawyer should review it before you use it, because your policy needs to match your tools, contracts, privacy position and industry risks.

1. Purpose: Explain why your business allows AI and what the policy is trying to protect.
2. Approved Tools: List the AI tools staff may use and any required settings, such as enterprise accounts or training opt-outs.
3. Prohibited Tools: List tools or categories that staff must not use for work data.
4. Data Rules: Set out what data can never be entered, what data needs approval and when de-identified data may be used.
5. Customer And Client Information: Explain how personal information and confidential information must be handled.
6. Sensitive Information: State that sensitive information needs extra approval and may require consent or a privacy review.
7. Human Review: Require staff to check AI outputs before using them with customers, clients or the public.
8. Record Keeping: Tell staff when they need to keep a record of the tool used, input data, output and approval.
9. Security: Cover passwords, access controls, shared accounts, uploading files and information security rules.
10. Incidents: Explain what staff must do if they accidentally enter restricted data into an AI tool.
11. Consequences: Explain that breaches may lead to disciplinary action where appropriate.

The policy should also connect with your employment contracts, confidentiality obligations and workplace technology policies. If your staff work with valuable client data, trade secrets or regulated information, don't rely on a generic AI policy pulled from the internet. Templates often miss the details that matter most.

Do You Need To Update Your Privacy Policy Or Client Contracts?

Often, yes. If your business uses AI tools to handle customer information, you may need to update your privacy policy, collection notices and client contracts so they match what is actually happening.

Your privacy policy should describe how your business collects, uses and discloses personal information. If you're sending personal information to AI providers, analytics providers or cloud software providers, your policy may need to explain that in plain English.

From 10 December 2026, Privacy Act changes will require many privacy policies to include more information about substantially automated decisions that could significantly affect individuals' rights or interests. If your business uses AI to make or substantially assist these decisions, you should start preparing now rather than waiting until the deadline.

Your client contracts also matter. Many service agreements include confidentiality clauses, data handling clauses and restrictions on subcontracting. If you use an AI provider to help deliver services, a client may treat that as sharing information with a third party or subcontractor. If your contract doesn't allow that, you could be in breach even if the AI tool is secure.

Check whether your client terms cover:

• whether you can use third-party software providers to deliver the services;
• whether customer or client data can be processed overseas;
• security standards you must meet;
• whether you need client consent before using AI tools;
• ownership of outputs and deliverables;
• confidentiality carve-outs for approved service providers; and
• what happens if there's a data incident.

Also think about the Australian Consumer Law. If your team uses AI to generate customer-facing claims, product descriptions, advice-style content or advertising, you still need to make sure the final material is accurate and not misleading. AI doesn't take responsibility for the statement. Your business does.

How Do You Set Up Safe AI Use With Customer Data?

You can set up safe AI use with an AI governance policy that combines clear rules, approved tools, privacy checks and contract controls.

A good system doesn't need to be complicated. The aim is to make the safe path the easy path, so staff don't feel they need to sneak around the rules to get their work done.

Step 1: Map The AI Tools Your Team Is Already Using

Ask each team to list the AI tools they use, the tasks they use them for and the data they enter. You may find tools being used in marketing, customer support, sales, HR, product development and admin.

Step 2: Sort Data Into Clear Categories

Create simple labels such as:

• Green: public or fictional information.
• Amber: internal business information that isn't confidential or personal.
• Red: customer personal information, client confidential information, sensitive information, employee data and trade secrets.

Then tell staff what each category means. For example, red data might be banned from unapproved AI tools and allowed only in approved tools after a privacy review.

Step 3: Review The AI Provider's Terms And Settings

Check whether the provider uses prompts or uploaded files for training, where data is stored, its data retention settings, who can access it and what security commitments are given. If the provider offers enterprise settings, make sure someone is responsible for turning on the right controls.

Step 4: Run A Privacy Review Before High-Risk Uses

For higher-risk projects, document the purpose, data types, legal basis, consent position, security measures and alternatives. If sensitive information is involved, the Privacy Act generally requires a higher level of care, and consent may be needed unless an exception applies.

Step 5: Train Staff With Real Examples

A policy is much easier to follow when staff can see examples. Show them what is okay, what isn't okay and who to ask if they're unsure.

What Should You Do If Customer Data Was Already Entered Into An AI Tool?

Act quickly, but don't panic. The right first step is to work out exactly what happened and contain any further exposure.

Start with these steps:

1. Stop Further Use: Ask staff not to enter more customer data into that tool until it has been reviewed.
2. Identify The Data: Record what was entered, including names, contact details, files, sensitive information and dates.
3. Check The Tool: Review the provider's terms, account settings, retention settings and whether data may be used for training.
4. Ask For Deletion: If possible, request deletion of prompts, files and outputs from the provider.
5. Assess Harm: Consider whether the disclosure is likely to result in serious harm to any individual.
6. Keep Records: Keep a written record of your assessment, decisions and steps taken, and follow your data retention policy.
7. Get Help Early: If sensitive information, large datasets or important client contracts are involved, get advice before contacting customers or clients.

If the incident may be an eligible data breach under the Notifiable Data Breaches scheme, you need to move promptly. You may need to notify the OAIC and affected individuals, but the exact position depends on the data, the tool, the likelihood of serious harm and what remedial steps are available.

For example, if one staff member pasted 20 customer names and order notes into an approved enterprise tool with training disabled, the risk may be manageable. If someone uploaded a spreadsheet of 12,000 customers with emails, birthdates and complaint notes into a free tool with unclear retention terms, you would treat that much more seriously.

Key Takeaways

• Employees can use AI tools with customer data only if the use is lawful, secure and allowed under your policies, privacy documents and contracts.
• Customer data may be personal information, confidential information or both, so privacy and contract obligations often overlap.
• Public AI tools should generally be off-limits for identifiable customer information unless your business has reviewed and approved the tool.
• An AI governance policy should explain approved tools, prohibited data, approval steps, human review and incident reporting.
• Your privacy policy, client contracts and collection notices may need updates if AI providers handle customer information.
• If data has already been entered into an AI tool, record what happened, contain the issue and assess whether notification is required.

If you'd like help with your AI governance policy, privacy review, client contract updates or staff rules for using customer data, you can reach us at 1800 730 617 or team@sprintlaw.com.au for a free, no-obligations chat.