Protecting customer information when using AI.

Every time someone pastes a customer email into an AI tool, the Privacy Act 2020 comes with it. This lesson gives front desk staff, practice managers, accounts teams and owners a habit they can apply in under a minute: classify the information, keep the dangerous parts out, de-identify the rest, and check the tool before pasting. Allow 30 minutes. This is general information, not legal advice.

What the Privacy Act 2020 means for AI tools

The Privacy Commissioner’s starting point is that “the Privacy Act applies to everyone using AI tools in New Zealand” (OPC). Personal information is broad: if you can say who information is about, it is personal information, including inaccurate or AI-generated information about a person (OPC guidance).

The principles that matter most for everyday prompting:

The Commissioner expects organisations using generative AI to get senior leadership approval, do a privacy impact assessment, be transparent with customers, have a person review outputs before acting, and not enter personal or confidential information unless the provider has confirmed it is not retained or disclosed (OPC expectations). Customers care: in OPC’s 2026 survey, 67% were concerned about businesses and agencies using AI to make decisions about people, and 66% would consider changing providers over poor privacy practices (OPC).

A traffic-light rule for what goes in

This is Levy Street’s working rule for small teams, not a legal test. It errs on the cautious side, as the Commissioner does: “If in doubt, we recommend you do not use AI tools to handle personal information.”

Check the tool before you paste

Plans differ on training and retention, and settings change, so check on the day. As listed on 19 October 2026: ChatGPT Business offers “no training on your business data by default”, while individual plans offer an opt-out (OpenAI); Anthropic does not train on inputs from commercial products such as Claude for Work by default, but feedback submitted with the thumbs buttons stores the whole conversation and may be used for training (Anthropic); Google says Workspace content is not used to train generative AI models outside your domain without permission (Google); and Microsoft says Copilot Chat prompts and responses, as used by organisations, are not used to train foundation models (Microsoft). Also check memory settings and who in your workspace can see shared chats.

Exercise: de-identify a client email

1. Copy a real email into a plain document. Not into the AI tool. Use a routine client or customer message you need to answer.
2. Delete every red item. Remove them entirely rather than swapping in fake numbers.
3. Replace amber items with placeholders. Use [CLIENT], [PARTNER], [BUSINESS] and so on.
4. Remove indirect identifiers. A rare job, a small town and a date together can identify someone. Generalise them.
5. Check the tool. Approved business account, training off, memory understood, no feedback buttons on this chat.
6. Draft, then re-personalise outside the tool. Put real names back in your email program, then read the whole reply before sending.

Worked example: an accounting practice’s client email

Illustrative example: an administrator at a Hamilton accounting practice receives this (all details fictional):

BEFORE
Hi Sarah, sorry these are late. I was in Waikato Hospital for my hip in September
so everything's behind. Attached are statements for Kōwhai Landscaping Ltd,
account 12-3456-7890123-00. My IRD number is 123-456-789. Does Tom need to file
separately this year? Thanks, Jo

AFTER
Hi [ACCOUNTANT], sorry these are late. I've been unwell so everything's behind.
Attached are statements for [CLIENT BUSINESS]. Does my partner need to file
separately this year? Thanks, [CLIENT]

The hospital, condition, account number, IRD number and partner’s name are gone. “Unwell” keeps the tone without the health detail. Then the prompt:

Draft a reply from a New Zealand accounting practice to the client email below.
Thank them for the statements. Be kind about the delay without asking about their health.
Say we will check whether [PARTNER] needs to file separately and reply by [DATE].
Do not give tax advice. Under 90 words. Keep every placeholder exactly as written.

[paste the AFTER text]

Example output (illustrative and abridged):

Hi [CLIENT],
Thanks for sending the statements for [CLIENT BUSINESS], and no need to apologise.
We'll check whether [PARTNER] needs to file separately and come back to you by [DATE].

Where privacy protection goes wrong

• De-identification that is not. Context identifies people. Read the redacted text as a stranger in your town would.
• Treating a business plan as permission. No-training terms address one risk. Purpose, accuracy and transparency duties still apply.
• Connected tools. An assistant connected to your mailbox or drive can read far more than you paste. See understanding AI tool permissions.
• Researching people with AI. OPC’s guidance says asking an AI tool a question that generates information about a person is a collection of personal information, and since 1 May 2026 IPP3A adds duties to tell people when you collect their information indirectly.
• Silence after a slip. If red information reaches the wrong tool, assess it as a possible breach. Notifiable breaches must be reported to the Commissioner as soon as practicable (NotifyUs); see managing AI mistakes and escalation.

Where data is processed matters too; our guide to data residency for AI systems covers it. The AI data inventory template helps you list what information each tool touches, and our AI governance advisory supports privacy impact assessments for larger uses. Accounting firms will find sector detail in AI for accounting in New Zealand.

Check your work

• I can place any piece of information in red, amber or green within a minute.
• I de-identified a real email, including indirect identifiers.
• I checked my AI tool’s training, retention and memory settings today.
• I put real names back outside the AI tool and read the final reply in full.
• I know who to tell, and how fast, if personal information goes into the wrong tool.
• I know when our use needs a privacy impact assessment.

Next lesson: Creating a team AI use policy turns these rules into a one-page policy your whole team can follow.

Written by the Levy Street team in Wellington. Last updated 19 October 2026.