Can you paste client information into ChatGPT? A plain-English guide for small Australian firms
What happens to what your staff type into AI tools, which professional rules apply to accountants, mortgage brokers and migration agents, and a five-step setup to use AI safely.
Highly Distinguish · Published 5 October 2026 · 4 min read
The short answer: not into a free or personal ChatGPT account on default settings. Use a business-grade plan that doesn't train on your data by default, write down what may and may not be shared, and keep a person reviewing anything that goes to a client.
Most small firms we talk to have the same story. Nobody decided to "adopt AI". Someone on the team started using ChatGPT to tidy up an email, it worked, and now it's part of how the office runs. That's fine — until the email contains a client's tax file number, a bank statement or a passport scan.
This guide explains what actually happens to that information, which rules apply to your industry, and how to set things up properly. It's general information, not legal advice.
What happens to what you type
It depends on the plan and the settings, not on whether the tool is "AI":
- ChatGPT Free, Plus and Pro. By default, your conversations can be used to improve OpenAI's models. Each user can switch this off under Settings → Data controls → "Improve the model for everyone". It's a per-person setting, so in a five-person office you need five people to have done it — and to keep it that way.
- ChatGPT Business and Enterprise. OpenAI states that business data is not used for training by default, and the plans come with admin controls and business terms.
- Other business tools (for example, AI built into Microsoft 365 or Google Workspace) have their own data-use terms. They're often a good fit for small firms because your data stays inside the system you already use — but read the vendor's terms for the plan you're on.
Even with training switched off, the information is still sent to and stored by a third-party provider, often overseas. That's the part your professional rules care about.
Which rules apply to you
| If you are… | Rules to know about |
|---|---|
| A tax or BAS agent | The Tax Practitioners Board's Code of Professional Conduct requires you to keep client information confidential. |
| An accountant providing certain designated services | Since 1 July 2026, AML/CTF obligations apply — and personal information handled for AML/CTF purposes must be managed under the Australian Privacy Principles, even if your firm would otherwise be exempt. |
| A mortgage or finance broker | Your best interests duty and record-keeping obligations, information from credit reports (which has extra legal restrictions), and your licensee's or aggregator's own policies. |
| A registered migration agent | The Code of Conduct's confidentiality obligations, and the Department of Home Affairs' requirements for translated documents. |
| Any business covered by the Privacy Act | The Australian Privacy Principles, including rules on sending personal information overseas. |
"But my firm turns over less than $3 million"
Many small businesses are exempt from the Privacy Act. Three reasons not to stop reading:
- Your professional code applies regardless of size. A confidentiality duty doesn't depend on turnover.
- The exemption has exceptions — and AML/CTF reporting entities are now one of them, for information handled for AML/CTF purposes.
- It may not last. The government has confirmed further privacy reforms are being progressed, and removing the small business exemption is one of the items under discussion.
Ask your professional body or a lawyer where you stand. Either way, the practical steps below are the same.
Five steps to use AI safely
1. Find out what's already happening. Ask your team which AI tools they use and for what. Make it a no-blame conversation — you want the real answer.
2. Move work onto a business-grade tool. Choose one approved tool on a plan that doesn't train on your data by default, and set it up under the business's control rather than personal accounts.
3. Write a one-page AI use policy. Keep it short enough that people will read it:
- Which tools are approved.
- What must never be entered — for example tax file numbers, identity documents, bank statements and health information.
- When to remove names and identifying details first.
- That a person reviews anything sent to a client, lender or government agency.
4. Train the team with real examples. Show the tasks where AI helps, and the ones where it doesn't. Thirty minutes with your own templates beats any generic course.
5. Keep people accountable. AI drafts; people decide and sign off. And never take numbers from a chatbot's text — calculations belong in your accounting software or another deterministic tool. In our own testing, even a well-engineered AI got roughly one in five multi-step financial questions wrong.
Safe quick wins (no client data needed)
You can get value from AI this week without touching client information:
- Rewrite your standard emails and engagement explanations in plainer language.
- Draft a client newsletter or a blog post.
- Turn your own process notes into a checklist or a training guide.
- Summarise publicly available updates from your regulator.
Where to go from here
If you'd like a second pair of eyes, we offer a free 30-minute AI safety check for small accounting, broking and migration practices across Australia. You'll get a one-page summary of what to fix and what to try — whether or not you work with us.
Sources