Can staff put client data into ChatGPT under New Zealand's Privacy Act?

Only with care, and never as a habit. New Zealand's Privacy Act 2020 covers businesses of every size, with no small-business exemption, so a five-person firm has the same duties as a bank. The Privacy Commissioner's expectations for generative AI say not to enter personal or confidential information into a tool unless the provider has explicitly confirmed it is not retained or disclosed, or to strip out anything that could identify a person first. Before a business adopts a tool like ChatGPT, the Commissioner expects sign-off from leadership and the privacy officer, and a privacy impact assessment.

This piece is for the owner or office manager of a New Zealand small business whose staff already use ChatGPT, Copilot or Gemini at work. It is general information, not legal advice.

Does the Privacy Act apply to a small business?

Yes. The Privacy Act 2020 applies to companies of all sizes; the main carve-out is an individual holding information for their own personal, family or household affairs. Every business that holds information about customers, staff or suppliers has to follow the information privacy principles (IPPs). Three matter most when staff use an AI tool:

• IPP 5, storage and security: reasonable safeguards against loss, misuse and unauthorised access. Pasting client details into a tool you have not checked is hard to call a reasonable safeguard.
• IPP 11, disclosure: personal information should only be disclosed for the purpose it was collected for, or another allowed reason.
• IPP 12, disclosure outside New Zealand: information can go offshore only where comparable safeguards apply. Most AI tools process data overseas.

Since 1 May 2026, IPP 3A also requires a business to tell people when it collects their personal information from someone else, which matters when an AI tool gathers or infers details about clients from other sources.

What does the Privacy Commissioner expect?

The Commissioner set out seven expectations for generative AI on 25 May 2023. For a small business they come down to this:

1. Get sign-off from senior leadership and the privacy officer before staff use a generative AI tool for work.
2. Do a privacy impact assessment first. For a small firm it can be short: what data the tool can see, where it is processed, and who checks its output.
3. Be open with customers about how and when you use generative AI.
4. Have a person review outputs before acting on them, and check accuracy before information is used or disclosed.
5. Keep personal and confidential information out of prompts unless the provider has explicitly confirmed it is not retained or disclosed.

The government's own Privacy and GenAI guidance, written for the public service and updated in February 2025, goes further: staff must not put personal information into public generative AI systems at all. Many private firms adopt the same rule because it is easy to teach.

Is a business ChatGPT plan enough?

It is a better place for work than staff's personal free accounts, because business plans come with admin controls and the vendor says business data is not used for training by default. It does not do the rest for you:

• you still need the privacy impact assessment and sign-off;
• the data is still likely processed outside New Zealand, so IPP 12 still applies;
• staff still decide what goes into a prompt, and a person still has to check what comes out.

What should a small business do this month?

1. Name a privacy officer, if you have not already, and have them sign off one approved AI tool.
2. Write a one-page staff rule: no names, contact details, IRD numbers, health information or client documents in public AI tools; remove identifying details first; a person checks every output.
3. Check your sector's rules. Lawyers have the Law Society's generative AI guidance; real estate licensees have the Real Estate Authority's November 2024 guidance; doctors have the Medical Council's March 2026 guidance on AI in patient care.
4. Train the people who use it most, on their own work. A policy nobody has practised does not change what gets pasted.

Square1 Ai trains New Zealand small business teams on this, live online in your working hours, with pages for accounting firms, law firms, real estate and ChatGPT for staff. Prices are on the small business page.