What not to paste into an AI tool: tenant details and privacy

Keep personal details out of the chat box. That's the short rule. A rental office holds a lot of them, so it's worth knowing what to leave out and how to still get a useful draft.

What the regulator says

Australia's privacy regulator, the OAIC, has published guidance on commercially available AI products. Its advice, which it words as a "best practice" recommendation, is not to type personal information into publicly available AI chat tools. It singles out sensitive information.¹

For organisations covered by the Privacy Act, the OAIC says it applies to all uses of AI involving personal information. Check with the OAIC whether it applies to your business.¹

All of that is Australian. Offices in the United Kingdom can start with the ICO, and offices in the United States with the FTC and their state regulators. Go to your own regulator's pages for what applies to you.

What a rental office holds

One general description says managers process applications, conduct screenings and manage security deposits.² Those jobs collect some of the most sensitive paperwork a small business sees.

Keep these out of an AI chat:

• Tenant and applicant names, phone numbers, emails and the unit address.
• Date of birth, licence, passport or other ID details.
• Income, employer, bank and payment details.
• Application forms, reference checks and screening results.
• Bond or deposit account details.
• Owner bank details and tax information.
• Photos or recordings that show people.
• Anything about someone's health, family, religion or other personal circumstances.
• Key codes, alarm codes and lockbox numbers.

The regulator notes that photographs or recordings can contain sensitive information.¹ That's one more reason not to upload tenant photos.

Personal information isn't only the true stuff

It's easy to think a made-up line can't hurt. Truth doesn't come into it. A false detail about an identifiable person still counts as personal information, says the OAIC.¹ So a tool's invented line about a named tenant is covered too. Another reason to keep names out and to check every draft.

Placeholders do most of the work

You almost never need the real detail for the tool to do its job. Swap it:

Then paste, get your draft, and put the real details back in your own email program. The enquiry replies page shows this in a working prompt.

Check the tool's own settings

Tools differ in how they store and use what you type. Settings and terms change, so read the maker's privacy page for the product you use before you rely on any of it. Look for what it says about stored chats and whether your text is used to train the tool. Don't assume.

Where you can, pick an account whose terms your office has actually read.

Staff need the rule too

One careless colleague can undo the lot. Write a half-page office rule and go through it with everyone, including casuals:

• What never goes into a tool.
• Which tool, and which account, staff may use.
• That a person reads every draft before it's sent.
• Who to ask when unsure.

The OAIC guidance also talks about policies and procedures for using AI.¹ A half-page rule is a reasonable start for a small office.

When it already happened

If someone pasted in something they shouldn't have, don't hide it. Tell whoever manages privacy in your business, and look at your regulator's guidance on data breaches. In Australia that's the OAIC. Elsewhere it's your own national or state body. This site can't say whether a particular slip needs reporting.

For the wider picture of what tools can and can't do in your office, see the overview.