Please note: this is general information to help you use AI sensibly. It isn't legal advice. If you're unsure how privacy law applies to your business, talk to a privacy adviser or check the OAIC website (links at the bottom).
Section 1 of 6
The one rule
Before you paste anything into ChatGPT, ask yourself one question: could this identify a real person? If the answer is yes, take that part out or swap it for a label.
Why it mattersYour customers trusted you, not the app
Australia's privacy regulator, the OAIC, recommends that businesses don't enter personal information into publicly available AI tools, because of the privacy risks. ChatGPT works just as well with "the customer" as it does with a full name, so this costs you nothing.
How to do itThe swap
Names, phone numbers, emails, addresses, order numbers and birthdays all get swapped. Do the swap yourself before you paste. Pasting the full version and asking ChatGPT to remove the details defeats the purpose.
You learned the habit that covers most of the risk. Everything else in this guide builds on it.
Section 2 of 6
The traffic lights
Not everything needs the same care. Use these three lights to decide in a second.
Green: go ahead
- Your own marketing, website copy and posts
- Product and service descriptions, prices
- General business questions
- Enquiries and emails after the swap
Amber: edit first
- Customer emails and complaints
- Google reviews you want to reply to
- Notes or to-do lists that mention clients
- Spreadsheets of sales or bookings
Red: never paste
- Passwords, bank or card details
- Tax file, Medicare or licence numbers
- Health information about clients
- Details about children
- Anything told to you in confidence
- Staff performance or HR matters
Most of your everyday AI work is green. Amber just means a minute of editing. Red stays with you, always.
Section 3 of 6
Change four settings today
Five minutes in your ChatGPT settings makes everything you do from now on safer.
- 1. Stop your chats training the modelGo to Settings › Data Controls and turn off Improve the model for everyone. It applies to your whole account, on every device.
- 2. Use Temporary Chat for anything amberTemporary Chats aren't used for training, don't appear in your history, and are deleted from OpenAI's systems within 30 days. Start one from the chat menu at the top of the screen.
- 3. Check what ChatGPT remembersChatGPT can remember details across chats. In Settings, open the Memory section, read what's saved, and delete anything about customers.
- 4. Protect the account itselfTurn on multi-factor authentication in your Settings under Security, and don't share one login between staff. If several people use ChatGPT for your business, look at OpenAI's business plans, which give you more control over your data.
Your settings now match your habits. Menus do move around as apps update, so if something isn't where this guide says, search the ChatGPT help centre for the setting's name.
Section 4 of 6
Real situations, safe prompts
Here are five things small business owners actually want AI's help with, and how to do each one safely.
A customer has complained and you're upset
Swap the details out first, then let ChatGPT help you stay calm and fair.
A customer sent me this complaint about my [type of business]: [paste the complaint with names, contact details and order numbers removed]. I feel [how you feel]. Help me write a calm, professional reply that acknowledges the problem, explains what I'll do, and doesn't over-apologise.
You want to spot trends in your sales
Before you upload a spreadsheet, delete the name, email, phone and address columns. Keep only what you need, like the date, product, amount and suburb.
I've attached a spreadsheet of my sales with customer details removed. The columns are [list the columns]. Tell me which products sell best, which months are busiest, and two ideas to grow sales in the quiet months.
You've finished a client session and want tidy notes
If you're a coach, therapist or health practitioner, client notes are red. Don't paste them. Instead, use AI to build a template you fill in yourself.
I'm a [your profession]. Create a simple session notes template I can fill in myself after each appointment. Include sections for [what you need to record], and keep it to one page.
You want to reply to a Google review
Reviews are public, but you still don't need the reviewer's name to write a good reply. Paste the review text only.
Here's a [positive / negative] Google review of my business: [paste the review text without the name]. Write a short, warm reply in Australian English that thanks them and [invites them back / offers to fix the problem offline].
ChatGPT told you something you're about to rely on
AI can sound confident and still be wrong, especially on prices, laws and dates. Ask it to show its working, then check the important parts yourself.
You just told me [the claim]. How sure are you? What would I need to check, and where, to confirm this is correct for a small business in Australia?
Every one of these jobs still got done. Safe use isn't about using AI less. It's about giving it only what it needs.
Section 5 of 6
Does the Privacy Act apply to me?
The short answer for most small businesses is "maybe not, but act as if it does."
The general ruleThe $3 million threshold
Most businesses with an annual turnover of $3 million or less are exempt from the main Australian Privacy Principles. As of October 2026 that exemption is still in place, although the privacy regulator has argued for removing it.
The exceptionsSome small businesses are covered anyway
These include health service providers that hold health information (so many practitioners, therapists and some coaches), businesses that buy or sell personal information, and businesses with government contracts. If you're one of these, the OAIC's AI guidance applies to you directly.
What's changingFrom 10 December 2026
Businesses covered by the Privacy Act must explain in their privacy policy when computer programs, including AI, make or help make certain decisions that significantly affect people.
Even if you're exempt, your customers expect you to look after their details. A short line in your privacy policy saying you use AI tools, and never paste customer details into them, builds trust and costs nothing.
Section 6 of 6
Write your own AI rules
Put it in writing, even if you're a team of one. Copy these rules, change anything that doesn't fit, and stick them somewhere you'll see them. If you have staff or contractors, give them a copy.
Step 1Start from this
MY BUSINESS AI RULES 1. Before I paste anything, I ask: could this identify a real person? If yes, I swap it out. 2. I never paste passwords, bank or card details, ID numbers, health information, details about children, or anything told to me in confidence. 3. I remove customer columns from spreadsheets before I upload them. 4. I use Temporary Chat for anything that needs care. 5. "Improve the model for everyone" stays turned off. 6. I check anything important AI tells me before I rely on it. 7. A person (me) reads everything before it goes to a customer. 8. My privacy policy says I use AI tools and how I protect customer details.
Step 2Make them yours
Here are my business AI rules: [paste the rules above]. I run [what you do] with [number] staff or contractors. Adjust these rules to suit my business, add anything I've missed for my industry, and keep it to one page.
You now have a written policy, which is more than most small businesses. Clear rules mean you can stop second-guessing every chat and get on with the work.
Tired of copying and pasting?
These prompts are a great start. But if you'd rather these jobs happened on their own, without opening ChatGPT and pasting a prompt every time, I can set that up for you. And I’ll set it up safely, so customer details stay protected.
- Enquiry replies drafted for you as soon as they arrive
- A month of social posts planned and scheduled in one go
- Follow-ups and reminders that send themselves
You did it
You can use AI with a clear conscience.
- The one rule. If it could identify someone, swap it out.
- Traffic lights. Green goes, amber gets edited, red stays with you.
- Settings changed. Training off, Temporary Chat on hand, memory checked.
- Check before you trust. AI drafts, you decide.
- Rules in writing. One page, for you and anyone who helps you.
Stay regulated and get things done. Amanda
Sources (checked October 2026)