Learn · 5 min read

Keeping client data safe when your team uses AI

AI tools are easy to start using, which is exactly why it's worth agreeing a few simple habits before your team gets going.

Know which tools you're using

There's a big difference between a free personal account and a business version of the same tool. Business versions often come with stronger commitments about how your information is handled. Check the terms of any tool your team uses for work, and prefer the business version where one is available.

Check the settings

Some tools let you choose whether your conversations can be used to improve the service. Look for these settings and choose the option that keeps your information private, especially on any account used for work.

Keep identifying details out

Most of the time AI doesn't need to know who someone is to help. Replace names, account numbers and contact details with placeholders, such as "Client A", before asking for help with a document or email.

Why this matters more than it might seem

In UK and Munir [2026] UKUT 81, a UK tribunal warned lawyers about putting confidential documents into open AI tools such as ChatGPT, and said this should be referred to the Information Commissioner's Office. You may not be a law firm, but your clients still trust you with their information.

Your team may already be using AI

In a 2026 Personio survey, 26% of UK employees who use AI at work said they do so without their employer knowing. If that's happening in your business, I wouldn't start with blame. It often means someone is trying to do their job better and nobody has said what's allowed.

Ask openly what people are using and what for. You'll learn more that way, and you can then give them a safer way of doing it.

Write down a simple policy

It doesn't need to be long. A one-page note covering which tools are approved, what information must never be shared with them, and who to ask if you're unsure will prevent most problems.

Remember your existing duties

If you handle personal information, data protection rules still apply when AI is involved. The Information Commissioner's Office publishes guidance for organisations, and it's worth a look if you're unsure.

Last reviewed November 2026