It is 8:40pm on a Tuesday. The salon inbox is open on the laptop, a chatbot in the next tab, and a client has asked something new. Steph screenshots the thread so the reply has the full picture.
The image is in the box. The cursor is blinking.
In the second before she sends it, she looks at what is in the picture. The client's full name, her mobile number from her bio, her street three messages up. Her dog's medication, two messages down.
She deletes it and types two sentences instead. The answer is just as useful.
The short answer on AI privacy for a small business in Australia. Never paste a client's identity into a public AI chatbot: their name together with their contact details or address, card or bank details, your logins, veterinary or medication details, photos of other people, or anything under a confidentiality term you have signed. Australia's privacy regulator recommends against entering personal information into publicly available generative AI tools at all, because once it is in you cannot reliably get it back out. Most Australian pet businesses are exempt from the Privacy Act on turnover, and exempt is not the same as safe.
This is guidance, not legal advice. If you are near the line, an hour of a real lawyer's time is the right purchase. Steph is a two-groomer salon in Sydney's Inner West, a worked example we follow through this series, not a real client's books.
The never list, in full
Six things not to paste, two things never to let it do.
Never paste into an AI chat:
And never let it:
Why each line is on the list
A client's name together with their contact details or address
The Privacy Act defines personal information as information about an identified individual, or one reasonably identifiable. OAIC's examples: a name, an email address, and images where a person is identifiable.
The word doing the work is together. A first name alone is useless. But OAIC says a person can be identified where information can be linked with other information, so a suburb, a dog's name, and a standing Tuesday 2pm is a household. And OAIC calls pasting it a disclosure to the owners of that chatbot.
Card numbers, bank details, or anything from a bank statement
Not a privacy question. Card data sits under PCI DSS, and the control is v4.0 requirement 4.2.2: the card number must be secured with strong cryptography whenever it is sent via end-user messaging technologies. A chat box is not that.
Two lines in the applicability notes matter more. It applies even where the client asked you to send it that way, so "she asked me to" is not a defence. And where card data arrives unasked, you either secure that channel properly or delete the data and stop it being used for card numbers.
Bank details are not "sensitive information" as the Act defines it; that list is closed.
Logins or passwords, including your Xero and your bank
Google's Gemini help centre asks users not to enter confidential information they would not want a reviewer to see, because a subset of chats are reviewed by human reviewers, and human-reviewed chats are kept for up to three years even after the original activity is deleted.
That is a vendor saying, in writing, that a person may read this. A password in a chat is a password in a log, and no chatbot needs your Xero login to chase an invoice.
Veterinary records, medication details, or an incident report
Split these. A human medical record is health information under the Act, and therefore sensitive information. An animal's vet record is a different thing legally, and that reasoning is below.
The practical rule does not change, because a pet record almost always identifies its owner. Incident reports can end up in a claim, and where AI must never go in pet care covers that ground. You can also hold human health information incidentally, such as a note about a condition affecting handover, which OAIC says generally requires consent.
Photos of other people, or of someone's home
OAIC says many photographs or recordings of individuals, including artificially generated ones, contain sensitive information, and so may not be usable as AI input without that individual's consent.
Read that against a normal before-and-after. The dog is not the problem. The person holding the lead is, and so is the house number behind them.
Anything covered by a confidentiality term you have signed
This exposure is contractual, not statutory. A confidentiality clause in a supplier or franchise agreement, an employment contract, or an NDA is enforced as a contract, and no Privacy Act analysis changes that.
Staff files sit near the same line. Fair Work's position, paraphrased, is that employment records are confidential and that only a narrow set of people may see them. A chatbot is not on that list.
And two things never to let it do
Send something you have not read
Anything a tool sends, charges, or posts on your behalf leaves your control the moment it goes. A change to a file can be rewound. An email cannot. So read it out loud first, because reading aloud catches the confident invention that scanning misses: why it gets things wrong, and the check for it.
Delete something you have not backed up
Tools that work on your files usually let you rewind a change. Actions with side effects outside your machine cannot be rewound the same way, so duplicate the folder and let it work on the duplicate. What a tool may touch without asking is a setting, and what to allow and what never to explains them.
AI privacy for a small business in Australia: what the law actually says
The exemption is real, and it probably covers you
The Act's obligations bind "APP entities", and it expressly excludes a small business operator from the definition of an organisation. The test at s 6D(1) is turnover-based and backward-looking: annual turnover of $3,000,000 or less for the previous financial year, unchanged in the compilation in force from 4 June 2026. Most Australian pet businesses sit under that, and so outside the Australian Privacy Principles.
OAIC says annual turnover here includes all income from all sources, broader than the figure on your BAS, and under s 6D(3) one larger business in the group defeats the exemption for the operator as a whole. Removing it has been proposed and the regulator supports removal, but it is not legislated and no commencement date exists.
Six things pull you back in, and the regulator's list is longer than the section
The section lists six. Under s 6D(4) you are not a small business operator if you:
- carry on a business whose annual turnover exceeded $3,000,000 in a completed financial year;
- provide a health service to another individual and hold health information other than in an "employee record";
- disclose personal information about another individual for a benefit, service, or advantage;
- provide a benefit, service, or advantage to collect personal information about someone from a third party;
- are a contracted service provider for a Commonwealth contract; or
- are a credit reporting body.
OAIC publishes a wider list, and it is the regulator's rather than the section's: anti-money-laundering reporting entities, tenancy database operators, Consumer Data Right businesses, and others. Keep them apart.
For a pet business the route back in is rarely the health-service limb. It is turnover, or trading in client data: swapping a mailing list, taking a benefit for client details, or selling the database on exit. The Act carves out disclosure made with consent or under legal authority at s 6D(7), and collection on the same terms at s 6D(8).
A pet is not a person, and that is the part everyone gets wrong
Every limb of the Act's definition of a "health service" at s 6FB is anchored to an activity performed in relation to "an individual". Every limb of "health information" at s 6FA is anchored to an individual too. And s 6(1) defines "individual" as a natural person.
Two things fall out. A dog's vet record or grooming note is not "health information" under the Act. And caring for an animal does not make you a health service provider, which matters because that disqualifier needs both limbs at once.
Now the part that decides how you behave. Personal information includes information about an individual who is reasonably identifiable, and OAIC says information can be personal where it can be linked with other information. A pet record keyed to a named owner with a phone number and a booking history is personal information about that owner.
The animal's data is not the sensitive category. The owner's identity attached to it is. So treat your pet records as client records.
One caveat: OAIC has published nothing about animals or veterinary records. The above is what the Act's definitions say, read in order, not a ruling.
Being exempt is not the same as being safe
The statutory tort for serious invasions of privacy commenced on 10 June 2025. OAIC says it is broader in application than the Privacy Act, extending to entities that may not be APP entities. It covers misusing information relating to a person, and remedies may include damages, an injunction, or an order requiring an apology.
So a business under the turnover threshold can still be sued. Buy the lawyer's hour if your turnover is near $3,000,000, if you have been paid for access to a client list, or if something has already gone out that should not have.
OAIC recommends. It does not prohibit.
Quoting this properly matters. OAIC's guidance on commercially available AI products, published 21 October 2024 and updated 17 January 2025, recommends as a matter of best practice that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools. Its reason is practical: once entered, it is very difficult to track or control how it is used, and potentially impossible to remove.
That is a recommendation, not a prohibition. Using AI is not unlawful, and pasting personal information into it is not, of itself, unlawful. For a business inside the Act, APP 6 provides pathways through primary purpose, reasonable expectations, or consent.
The other rule: publishing something it made up
Australian Consumer Law is the exposure nobody expects from AI copy. Section 18 prohibits misleading or deceptive conduct in trade or commerce, and s 29 prohibits false or misleading representations about services.
The ACCC's framing is what makes it bite: a claim about your services must be accurate, truthful, and based on reasonable grounds, and "It makes no difference whether a business intends to mislead or not". An invented sentence on an AI-written service page is not a harmless typo.
What to paste instead, and the AI privacy habit worth building
The list is not there to stop you using the tool, but to get the same answer without handing over a household.
- Initials, or a role. "M, a Groodle", not a name. "A client", not a client.
- A made-up example with the same shape. Same breed, same coat, same problem, everything else fictional.
- Retype instead of screenshotting. A screenshot carries the header, the number, and whatever sat three messages up.
- Redact first. Whatever you paste becomes part of what it can see, and there is no unsend.
- Ask for a template you fill in offline. Add the real names where they already live.
- For card numbers, use your payment system. If one arrives unasked, delete it and tell the client not to send it that way.
- For a clinical question, give facts without the family. Species, age, coat, the fact pattern.
- For photos, crop to the dog, or ask. Consent is one sentence at drop-off.
- For a confidential document, describe the problem. Do not paste the agreement.
Then spend ten minutes on the tools, once. In ChatGPT the training setting is "Improve the model for everyone", under Settings then Data Controls, and switching it off is account-wide. In Gemini it is Keep Activity, and Canva keeps its own privacy controls under Your account.
OAIC's selection checklist asks the sharpest question: do the terms let the developer access what you put in, and can you turn that off? Ask the same of any software already holding your client list. Ours is answered on a security and data handling page, beside what we have decided not to build.
A de-identified request:
What this actually reclaims for you
Not minutes. This one buys back the outcome you never have to explain.
Say Steph reaches for a chatbot six times a week, and swapping the names out costs her twelve seconds a time. Under two minutes a week, against a disclosure that cannot be retrieved from a household that trusted her with a key and a dog. A week of her diary is around 40 dogs across two groomers, and one pasted client list is every household she has ever served.
Skip the twelve seconds and most likely nothing happens, which is exactly why the habit never forms. Keep them, and the worst a chatbot can do to you is write a mediocre draft.
For the team version, a one-page policy you can print. Next in this level: why it lies to you, and the check that catches it.
Sources linked in place, all verified 9 August 2026. General information about Australian law, not legal advice.