How do you keep client data private when you use AI at work?

AI assistants are useful for exactly the kind of work that involves clients: drafting replies, summarizing files, preparing proposals. That is also why they raise a privacy question. Anything you type into a chatbot leaves your computer and is stored, at least for a while, by the company that runs it. Depending on the service and your settings, it may also be read by human reviewers or used to improve future models.

The good news is that most of the protection comes from habits you control, before any setting comes into play. A useful principle from privacy law is data minimisation: collect and share only the personal information a task actually needs. Applied to AI, that means the model rarely needs to know who your client is to help you write to them.

Step 1: Ask whether the AI needs the real data at all

Many tasks need the structure of a document, not its identifying details. A model can improve the tone of a letter to "the client" as well as one to a named person. Before pasting, sort the information into three groups:

If a task truly depends on sensitive details, such as a medical history, a general-purpose chatbot is the wrong tool unless your organization has approved one for that use.

Step 2: Use placeholders, and do the replacing yourself

Swap identifiers for neutral labels in your own copy before it goes anywhere near the AI. Don't paste the original into a chatbot and ask it to anonymize the text: by then, the data has already been shared.

Here is a worked example. The original email from a client reads: "Hi, this is Marie Tremblay from Boulangerie Tremblay, 214 rue Principale. Our invoice 4471 is wrong and we were charged twice." Your redacted version, made in a text editor, becomes:

I work at an accounting firm. Below is a client email with names and numbers replaced by placeholders. Write a short, courteous reply that apologizes for the double charge, confirms we will issue a refund within five business days, and asks the client to confirm their preferred refund method. Keep every placeholder exactly as written so I can replace them later.

Client email:
"Hi, this is [CLIENT NAME] from [BUSINESS NAME], [ADDRESS]. Our invoice [INVOICE NUMBER] is wrong and we were charged twice."

The reply comes back with the placeholders intact, and you put the real details back in your email program. The AI did the writing; it never saw who the client was.

For tasks you repeat, go one step further and ask for a template instead of a single answer, such as "Write a reusable reply template for double-billing complaints, with placeholders." You then never paste client text at all.

Step 3: Know your obligations

In Canada, privacy laws such as the federal PIPEDA and Québec's Law 25 make organizations responsible for the personal information they hold, including when they hand it to an outside service. In general terms, that means using client data only for the purposes the client expects, protecting it with suitable safeguards and being able to explain where it went. Sending it to an AI service is a disclosure to a third party, so it belongs in your privacy policy, your internal rules and, where needed, a privacy impact assessment. Your contracts with clients may add confidentiality duties of their own. This is general information, not legal advice; your privacy officer or a lawyer can tell you what applies to your situation.

Which settings and plans keep data out of training?

Each service handles this differently, and the defaults are not the same. As of this month, here is what each company says, with the settings to check:

Two points stand out. First, a setting that stops training does not stop storage: your text still sits on the company's servers for some period, so placeholders remain your best protection. Second, business plans are the cleanest option for regular client work, because training is excluded for the whole workspace and an administrator, not each employee, controls the settings. If your team uses AI every day, a business plan with clear internal rules about what may be pasted is worth more than any individual toggle.