The one rule: keep customer data out of free AI tools

AI tools are brilliant for drafting, summarising and organising. But there is one rule every business should keep from day one: don't paste customers' personal details into free AI tools.

Why it matters

• You're responsible for your customers' data. Under UK GDPR, your business decides how customers' personal data is used, and you have to protect it.
• Free tools can have different terms. Depending on the product and its settings, what you type into a free consumer tool may be kept or used to improve the service. Business plans usually give you more control.
• Some data is especially sensitive. Income, bank details, ID documents and health information need extra care. Regulated firms, such as mortgage brokers, have extra obligations on top.

What to do instead

• Strip out the personal bits. "Draft a reply to a client asking about remortgage timelines" works just as well without their name, address or figures.
• Use business-grade accounts whose terms and data settings you have checked, and switch off anything you don't need.
• Keep customer records in systems you own and control, and bring AI to the data in a controlled way, rather than copying data out to it.
• Write it down. A one-paragraph AI policy for your team ("what we can and can't paste in") prevents most mistakes.

This isn't legal advice. If your business handles sensitive or regulated data, check your own obligations or ask your compliance adviser. Everything I build follows this rule by default.