Home / Learn / Using AI with client data: the basics
Guide · 10 min read
Using AI with client data: the basics
What a service provider should know before putting client or customer data into AI tools. General principles, not legal advice.
Know your role
When you process data for a client, the client usually decides why and how data is used (they are the "controller") and you act on their behalf (a "processor"). Put this in a short written agreement.
Minimise what you share
Only put into AI tools the data needed for the task. Remove names, phone numbers, addresses and ID numbers whenever possible. Use business accounts with data-protection settings rather than free consumer accounts.
Be careful with sensitive data
Health, financial, children's and identity data deserve extra care. Many countries have strict rules for them. When in doubt, do not process them with general AI tools.
Check where data goes
Many AI tools are hosted in other countries. Some laws (such as the GDPR in Europe) restrict transfers. Read the tool's data processing terms and choose options that do not train on your data.
Respect people's rights
Customers can usually ask what data is held about them, ask for corrections and object to marketing. Never send promotional messages without consent, and keep data only as long as needed.
Check your local law
Rules differ by country. Read the official data protection authority's guidance where you and your clients operate, and ask a lawyer for anything you are unsure about.
