Customer Data, Supplier Data and What Never Goes Into a Prompt

Your business holds information that belongs to other people. Customer payment details, supplier contacts, employee salary information, and transaction histories are not yours alone. These data are held in trust or by legal obligation. Once you feed this information into an AI system, you have shared it with the AI vendor and anyone they choose to share it with. For a small business, this is where many risks start.

The golden rule is simple: do not paste confidential data into public AI tools. If your tool requires sending data to a cloud server controlled by another company, and that company retains or trains on your data, then you are transferring confidentiality and control. For customer data protected by data protection law such as the UK Data Protection Act 2018 or the EU General Data Protection Regulation, this transfer creates legal liability. You have a duty to keep customer data secure and only process it as the customer consented. Sending it to a language model vendor may breach that consent.

This rule has exceptions, and they matter. If you use a paid version of a tool that commits not to train on your data and encrypts your data in transit and at rest, you have more protection. If you use an on-premises tool that runs entirely on your own servers and never sends data outside your network, you have nearly complete control. The data still belongs to your customers or suppliers, but you have kept it confidential. If you use an open-source model running on your own equipment, you have the same advantage. The key is: know where your data goes.

Think through specific scenarios in your business. A small recruiter using AI to help screen CVs must not paste entire CVs, including candidate names, phone numbers, and personal information, into a public chatbot. Instead, the recruiter can paste a redacted version with only role-relevant content. A small bookkeeper using AI to categorise invoices must not paste invoice details that include customer account numbers, payment terms, or future delivery addresses. The bookkeeper can paste only the date, vendor name, and amount. A small lawyer using AI to summarise client documents must not use a free public tool for any document that contains client names, transaction details, or legal strategy. A paid service with data confidentiality commitments, or an on-premises model, is necessary.

Your team needs to understand this rule in practical terms. Rather than saying “do not use AI on confidential data,” say “if the data includes someone else’s name, contact details, payment information, or private facts, do not paste it into a public tool.” This is clearer and more actionable. Your staff can ask themselves: whose information is this, and would that person want it going to an AI vendor? If the answer is no, do not send it.

There is a second layer. Even if you remove personally identifying information, you may still be revealing business secrets. Supplier quotes, customer lists, pricing strategies, and the financial terms of your contracts are business confidential. They are assets. If you paste a key supplier’s quote into a language model to help you generate a bid for a customer, you have revealed part of your supply chain to the AI vendor. If the vendor trains on this data, your cost structure becomes part of the general knowledge base. This may not breach data protection law, but it breaches your own business confidentiality.

The practical approach for a small business is to invest in confidentiality tools where the cost is justified. If your business processes high volumes of sensitive data and would benefit significantly from AI assistance, a paid service with strong confidentiality commitments is worth the cost. If you use AI only occasionally or for lower-risk tasks, public tools with sensitive data removed are often acceptable. The decision depends on your risk tolerance and the nature of your data. Document it. Write down what data types can and cannot go into which tools. Give your team a one-page guide. Review it annually. That documentation is your defence if a question ever arises about how you handled confidential information.