What actually happens to your business data when a staff member pastes it into ChatGPT, Copilot, Gemini or Claude.
“I just uploaded our spreadsheet into Claude and it solved the problem in minutes.” Fantastic. Or is it?
AI tools like ChatGPT, Copilot, Gemini and Claude are now part of daily work for most Tasmanian businesses, often before anyone has decided how they should be used. They don’t behave like the cloud software already running in the background. What a staff member types or uploads is sent to a data centre, often overseas, and processed by a system that can give a different answer to the same question twice in a row. Privacy law, client contracts and vendor terms still apply to all of it, even when it doesn’t feel like they do.
Every Plan Handles Your Data Differently
Not all AI tools are built the same way, and the plan your business is on matters more than the brand name. A free consumer account and a paid business tier from the same provider can have completely different rules about whether your data is used to train future versions of the model. Most businesses have never checked which one they’re on.
Picture a bookkeeper at a Tasmanian professional services firm, flat out before a reporting deadline, who pastes a client’s full financial statements into a free AI chatbot to reformat them faster. Nobody’s being careless or malicious. But that free account’s terms may allow the provider to use whatever’s typed into it to improve the model, and the client whose numbers were just pasted in was never asked or told. No breach. No attacker. The exposure came entirely from a decision nobody in the business had actually made.
The Problem Isn’t the Tools. It’s the Silence Around Them.
This isn’t a story about AI being dangerous. The tools are genuinely useful, and the businesses using them well are the ones using them knowingly, not the ones avoiding them. The risk sits in the gap: staff adopting these tools faster than owners are writing policy for them, with nobody deciding in advance what should never go into a prompt box.
When it goes wrong, the cost isn’t abstract. A breached confidentiality clause in a client contract, a notifiable data breach under the Privacy Act if personal information is exposed, or simply a client finding out their file went into a chatbot without their knowledge can cost far more in trust than the shortcut ever saved. None of that needs an attacker. It only needs nobody to have decided how the tool should be used.
What a Sensible Policy Actually Covers
A workable AI policy doesn’t need to be complicated. It should say clearly which information never goes into any AI tool, with client financial records and health information the obvious starting points. It should confirm where your approved tool processes and stores data before anyone relies on it. It should give staff an approved option, so they aren’t left to find their own workaround. And it should build in the habit of a person checking AI output before it goes near a client or a decision.
You don’t need to ban AI to use it safely. You need to know where your data goes before you send it there.
The Pritech Approach
In October, Pritech ran a session with the Tasmanian Chamber of Commerce and Industry on where your data goes when you use AI in your organisation. The conversation kept landing in the same place. Owners want to say yes to these tools. They just want to say yes with their eyes open. If you missed it, the recording is available on demand: [LINK: Webinar 2 recording].
We help Tasmanian businesses work through exactly this, using the OAIC’s and ASD’s published guidance alongside our own professional recommendation, so the decision fits your business rather than being a guess.
Get in touch with our team today to talk through an AI policy that fits your business.
