Most small business owners we talk to are not worried about AI taking over the world. They are worried about something much more practical: "If I connect this thing to my inbox, where does my clients' information actually go?"
It is the right question. And you do not need a lawyer or an IT department to start answering it. You need about an hour, a coffee, and the checklist below.
Why this matters even for a small business
Australian privacy law is not one-size-fits-all. Depending on your turnover and your industry, the Privacy Act and the Australian Privacy Principles may apply to you directly, and there are plenty of exceptions to the small business exemption (health services, for example). Reform is also moving, so the bar is rising rather than falling.
But here is the honest version: even where the law is unclear, your customers are not. A tenant's rental application, a homeowner's address and alarm code, a patient's booking notes. People hand you that information because they trust you. If an AI tool leaks it, "the app did it" will not win that trust back.
The Office of the Australian Information Commissioner publishes plain guidance on using commercially available AI products. The short version lines up with common sense: be careful what personal information goes in, and know what the tool does with it.
The 10-question checklist
Run every AI tool you use, or plan to use, through these questions. If you cannot answer one, that is your first job.
- What customer data does it touch? Names and emails are different from licence numbers, health details or financial records. List the real fields.
- Where is it stored and processed? Onshore, offshore, or "somewhere in the cloud"? The terms or the vendor's security page should say.
- Is it used to train their models? Many tools have a setting for this. Business plans often default to off; free plans often do not.
- Who on your team can see it? One shared login for everyone is a red flag. Each person should have their own account.
- How long is it kept? If the tool keeps every conversation forever, ask whether it needs to.
- Can you delete it on request? If a customer asks you to remove their details, can you actually do it?
- What happens if you cancel? Can you export your data, and is it deleted on their side?
- Does the AI make decisions about people, or just drafts? Drafting a reply is low risk. Deciding who gets a rental, a refund or a job is not. Keep a human on those.
- Do customers know they are talking to automation? Being upfront costs nothing and avoids a lot of awkward conversations.
- Who notices if something goes wrong? Someone should own the tool, check it weekly, and know how to switch it off.
Three habits that cover most of the risk
- Minimise first. Only send the AI what it needs to do the job. A follow-up draft rarely needs a date of birth.
- Draft, then approve. Anything with a price, a promise, legal wording or a decision about a person goes past a human before it goes out.
- Write it down. A one-page note covering which tools you use, what data they touch and who owns them puts you ahead of most businesses your size.
What this looks like in practice
Take a small property management office on the Gold Coast using AI to sort maintenance requests. Sensible setup: the tool reads the request, suggests urgency and a trade, and drafts a reply. It never sees bank details. It never approves spend. A property manager checks the queue each morning and signs off anything non-routine. That is the same shape we describe in AI maintenance triage for property managers.
Compare that with a weekend DIY build that forwards the entire inbox, attachments and all, into a free chatbot. Same goal, very different risk. We cover more of that in the hidden risks of DIY AI.
Not legal advice, but a good start
This checklist will not replace advice from a privacy professional if you handle sensitive data at scale. It will help you spot the obvious gaps, ask vendors better questions, and decide where a human must stay in the loop.
At Cloud Inn we build practical AI for Gold Coast and Brisbane businesses without an IT department, with Australian privacy and human sign-off designed in from day one. If you would like a second pair of eyes on the tools you already use, book a 30-minute call and we will walk through this checklist with you.