Staff leak business data into AI when they paste contracts, customer lists or financial records into consumer tools such as free ChatGPT, where inputs may be retained, reviewed and used to improve models. For Australian organisations this raises Privacy Act exposure under APP 6, APP 8 and APP 11. The fix is data classification, an approved enterprise tool, a one-page policy and staff training.
Key takeaways
- Most leakage comes from staff using the wrong tier of tool for work data, with no attack involved.
- Pasting personal information into an offshore AI service can be a cross-border disclosure under APP 8.
- Enterprise tiers commit not to train on your data, but many still process it outside Australia by default.
- Blocking tools without offering an approved alternative pushes use onto personal devices.
- Classify your data first, then match each class to an approved tool.
How do staff leak business data into AI tools?
Somewhere in your organisation, a well-meaning staff member is pasting something sensitive into a free AI tool: a draft contract, a spreadsheet of customer emails, a supplier price list, a board paper. They are trying to work faster.
On the default settings of many consumer AI tools, that input may be retained, reviewed by people for quality checks, and in some cases used to improve future models. For an Australian organisation that is a data governance, contractual and Privacy Act question.
- Staff has a taskSummarise a contract, draft an email, clean up a spreadsheet
- Pastes into a free toolConsumer tiers of ChatGPT, Gemini or Copilot
- Input is retainedDefault settings keep conversations, often offshore
- Model improvementDepending on tier and settings, content may be used for training
- Control is lostYou cannot pull it back, and may not know it left
In 2023 Samsung confirmed that engineers had pasted sensitive source code and internal meeting notes into ChatGPT, as reported by Bloomberg, and restricted generative AI use on company devices. OpenAI was not breached. It was a policy failure: staff used a consumer tool for confidential work. The same pattern happens quietly in Australian organisations every week, mostly undetected.
What does the Australian Privacy Act say about staff using AI tools?
Under the Privacy Act 1988 and the Australian Privacy Principles, organisations handling personal information have obligations on how it is used, secured and sent overseas. The OAIC published guidance on privacy and generative AI in October 2024.
Pasting personal information into an offshore AI service can be a cross-border disclosure under APP 8. If the service can use it for training, APP 6 (use and disclosure) and APP 11 (security) are also in play. An eligible data breach likely to cause serious harm must be notified under the Notifiable Data Breaches scheme. Penalties for serious interference with privacy can reach the greater of $50 million, three times the benefit obtained, or 30 per cent of adjusted turnover.
"We didn't know the tool kept the data" is not a defence.
| Privacy principle | Typical AI tool risk |
|---|---|
| APP 6 (use and disclosure) | Data pasted into AI may be used beyond its original purpose |
| APP 8 (cross-border disclosure) | Most consumer AI tools process data outside Australia |
| APP 11 (security) | Retention on third-party servers outside your control |
| NDB scheme | Eligible breaches must be notified to the OAIC and affected individuals |
What is the difference between consumer and enterprise AI tiers?
Organisations tend to assume either that all AI tools are dangerous or that paying fixes everything. Neither is right. Major vendors publish separate consumer and enterprise data handling commitments.
| Consumer tier (free / personal) | Enterprise tier (business / work) | Impact | |
|---|---|---|---|
| Training use | May be used for training (opt-out available) | Not used for training by default | Contractual |
| Retention | Kept in the account until deleted | Configurable retention | Controllable |
| Admin controls | Per-user settings only | Central admin, single sign-on, audit logs | Governable |
| Data residency | Usually processed overseas, no choice | Regional options on some plans | Selectable |
| Contract | Consumer terms only | Data processing terms, security reports | Enforceable |
Enterprise offerings such as ChatGPT Enterprise and Team, Microsoft 365 Copilot, Gemini for Google Workspace and Claude for Work publish commitments that business inputs and outputs are not used to train their models by default. That is a real contractual difference.
It does not solve residency. Many enterprise tiers process data in the US or elsewhere by default. For organisations serving government, health, defence or critical infrastructure clients, offshore processing can still be a problem.
Which AI approach suits which type of data?
What type of data will the AI process?
- Public or marketing content, no personal informationAn approved enterprise AI tool is fine
- Customer personal information or financial data at scaleCloud AI deployed in an Australian region under your own account
- Regulated data (health, government, defence, core IP)Models running on your own servers or private cloud in Australia
- You do not know yetRun a data classification exercise first
Option 1: Enterprise cloud AI with offshore processing. Fast to deploy. Suits general productivity work with low-sensitivity data.
Option 2: Cloud AI in an Australian region. Microsoft offers Azure OpenAI in Australia East, AWS offers models through Bedrock in Sydney, and Google offers Vertex AI in Sydney. Check model availability and deployment type, because not every option keeps processing in Australia.
Option 3: Models on your own infrastructure. Open-weight models (Llama, Mistral, Qwen) run with tools such as Ollama or vLLM on your servers or private cloud. Nothing leaves your environment. The trade-off is lower capability on the hardest tasks plus infrastructure upkeep.
See OpenAI vs Claude vs Ollama and our data sovereignty guide. Across our consultants' careers in BHP, Rio Tinto and Senex Energy environments, the governance pattern has been constant: classify the data, then pick the tool. Generative AI makes it urgent because the tools are in every browser.
What control framework stops AI data leakage?
- Week 1Shadow AI auditSurvey staff, check DNS or proxy logs, find which AI tools are in use
- Week 2Data classificationAgree what is public, internal, confidential and restricted
- Week 3Acceptable use policyA clear one-page policy tied to the classifications
- Weeks 4-5Provision approved toolsLicensed enterprise AI so staff have an approved path
- Week 6Network and endpoint controlsBlock consumer tiers where appropriate, enable logging
- Weeks 7-8Staff trainingWhat staff can and cannot paste, and where
1. Run a shadow AI audit. Leaders usually underestimate current use. Survey staff anonymously, check DNS or proxy logs for traffic to AI domains, and review browser extensions on company devices. Our shadow AI inventory guide covers this in detail.
2. Classify your data. Four buckets usually suffice:
- Public: marketing content, published reports.
- Internal: awkward but not damaging if leaked.
- Confidential: customer data, financials, contracts, personal information.
- Restricted: regulated data and core IP.
3. Publish a one-page acceptable use policy. Public and internal data can go into approved enterprise tools. Confidential data goes only into approved tools with contractual no-training commitments. Restricted data goes only into AI on your own infrastructure. Longer than a page and staff will not read it.
4. Provide an approved path. Blocking without an alternative pushes use onto personal devices, which is worse.
5. Add network and endpoint controls. Once the approved path exists, secure web gateways can block consumer AI domains and unapproved browser extensions.
6. Train staff. A short session showing exactly what can be pasted where is the highest-return control. Most staff simply do not know where the lines are.
What does fixing AI data leakage look like in practice?
For example, a hypothetical 180-person professional services firm finds widespread use of free ChatGPT, some client data pasted in, and no policy. A typical remediation runs six to eight weeks: audit, classify, write the policy, roll out Microsoft 365 Copilot for general work, deploy Azure OpenAI in Australia East for workloads touching client personal information, block consumer tiers and train staff. Licences and setup cost money, but the exposure already exists.
How Solve8 can help
Our consultants audit current AI use, classify data and set up approved tools through our AI strategy service, and our engineers deploy private AI infrastructure that runs on your infrastructure in Australia. Where copy-and-paste habits hide a process problem, our process automation team builds the proper workflow. Talk to us about your AI exposure.
Sources: OAIC guidance on privacy and generative AI (October 2024); Privacy Act 1988 and 2022 penalty amendments; published enterprise data handling commitments from OpenAI, Microsoft, Google and Anthropic; Samsung ChatGPT incident (Bloomberg, 2023).
