Quick answer
It can be, if you set it up properly. New Zealand's Privacy Act 2020 applies to AI tools just like any other software. Use a business account that doesn't use your data to train the AI, only put in what's needed, have a person check what comes out, and tell your customers you use AI. The Privacy Commissioner has published guidance on exactly this.
Does the Privacy Act apply to AI?
Yes. The Privacy Act 2020 is "technology-neutral". It doesn't care whether you use a filing cabinet, a spreadsheet or ChatGPT. If you put information about a person into an AI tool, the same rules apply: collect only what you need, keep it safe, keep it accurate, and be upfront about how you use it.
What the Privacy Commissioner expects
The Office of the Privacy Commissioner (OPC) has published guidance for organisations using generative AI tools like ChatGPT. In plain English, it expects you to:
- Have the boss sign off. Someone senior should look at the risks and approve using the tool.
- Check you actually need it. Is AI the right tool for this job, or would something simpler do?
- Think through the privacy risks first. The OPC calls this a privacy impact assessment. For a small business, it can be a short written check of what information goes in, where it goes and what could go wrong.
- Be open about it. Tell customers how and why you use AI with their information, in plain language.
- Check accuracy. AI can be wrong. Make sure information is right before you use or share it, and be ready to let people see and correct what you hold about them.
- Keep a person in the loop. Have someone review what the AI produces before acting on it.
- Don't put in personal or confidential information unless the AI company confirms it won't keep or share it. Otherwise, remove names and details first.
The guidance also asks organisations to think about the impact on Māori and to talk with affected communities where that's relevant.
Free and personal AI accounts vs business accounts
This is the big one for small businesses.
- Free and personal plans may use what you type to improve their AI, unless you switch that setting off. That's not where client information belongs.
- Business plans, like ChatGPT Business, Claude Team, Microsoft 365 Copilot and Gemini in Google Workspace, are designed for work and generally don't train on your business data. Always check the settings when you sign up.
Business plans usually cost about US$7 to US$30 per person per month. See what AI costs a small NZ business.
Your information will probably go overseas
Most AI companies process information overseas, often in the United States. That isn't automatically a problem, but you should know where it goes, choose reputable providers with strong security, and say so in your privacy policy.
A simple checklist for small businesses
- Use a business AI account in your business's name, not a staff member's personal free account.
- Check the data settings: training on your data should be off.
- Never put in passwords, bank or card details, IRD numbers or health information.
- Leave out names and contact details when the job doesn't need them.
- Have a person check anything that goes to a customer.
- Add a line to your privacy policy saying you use AI tools, what for and where the information goes.
- Know how to find and delete someone's information if they ask.
- Write a one-page "how we use AI" rule for your team.
How we set things up for clients
We use business accounts in your name, keep a person approving anything important, never connect AI to bank logins, payments, payroll or health records, and tell you exactly which AI company is used and where your information goes. More on our safety promise.
This guide is general information, not legal advice. For advice on your situation, talk to a lawyer or the Office of the Privacy Commissioner.