Practical guides on using AI at work while client names, IDs and case numbers stay on your computer — for Australian firms, councils and care providers.
Seven things to take out, in order, and the three words for what you did. Only one of them takes your file out of scope, and it is rarely the one you did.
Often yes, and it turns on where the output is used, not where you sit. Article 2, the deadlines after the Digital Omnibus, and what a deployer actually owes.
Seven insurer and broker forms, opened and read. Two ask about AI, and both want a description. Ten model answers and the evidence, free in Word and PDF.
Free AI acceptable use policy template in Word and PDF: 15 numbered clauses, four annexes, and the whole text on the page. No email, no watermark.
It is a disclosure. Whether you must report it differs in the UK, Ireland, Australia and the US. The tests, the first hour, and what no tool can do for you.
The same questions, answered against the rules that apply where you work.
PHI vs PII in an HR file: why an FMLA note is not PHI, what California calls sensitive personal information, and what to take out before AI sees it.
United StatesAI disclosure language for engagement letters: when US bars expect the client to be told, and a clause to paste, with the client data sentence in two versions.
United StatesDo you have to disclose AI use in court filings? It depends on the court and the judge. What you may be asked to sign, and what must stay in the firm.
United StatesUnder US law the same edit has five consequences. Privilege and Rule 1.6 are not about identifiers, and two state breach laws exempt encryption, not masking.
United StatesA records request returned thousands of pages of city staff chat logs. What that means for resident data, and which rules actually bind a US agency.
United StatesHIPAA compliant AI is not a product you buy. The ChatGPT plans OpenAI will sign a BAA for, the features each excludes, and the 18 HIPAA identifiers.
United StatesOpenAI runs two privacy policies at once, and the American one is newer and wider. What it says about sharing, selling, keeping, training and deleting.
United StatesYes on consumer plans unless you turn it off, and no on commercial ones. The opt out has two written exceptions, and the retention ladder runs to seven years.
United StatesCopilot is four products with one name, and Microsoft split its consumer documentation on August 18, 2026. Which page applies to you, and what each one says.
United StatesGoogle keeps human reviewed chats for three years after you delete your activity, and says so itself. What the Gemini settings reach, and what they leave alone.
United StatesFive carriers, two application forms and a March 2026 court ruling, read: the sublimits, the exclusions, the controls they require, and what they say about AI.
United KingdomSpecial category data under UK GDPR hides in payslips, fit notes and tribunal files. Where it sits, why Article 9 applies, and what to cut before a prompt.
United KingdomEngagement letter AI clause for solicitors and accountants in England and Wales: what the SRA, PCRT and UK GDPR expect, and wording to copy.
United KingdomCan NHS staff use ChatGPT? Only once the letter stops pointing to a patient. What UK GDPR, Caldicott and the DSPT expect, and what to remove before you paste.
United KingdomUse of AI in court documents: since 1 July 2026 the TCC Guide says if in doubt, disclose. What you sign, what the CJC proposes, what stays in the firm.
United KingdomThe ICO says removing names and numbers is not effective anonymisation. What that leaves you holding under the UK GDPR, and how to test a file before it goes.
United KingdomWhat a council officer can put into ChatGPT or Copilot, what must never leave, and the UK rules that decide it: UK GDPR, the ICO, the ATRS and section 170.
United KingdomNo tool is compliant by itself: your use of it is. The criteria that decide, the four assistants measured against them, and where UK transfers actually stand.
United KingdomFrom OpenAI's pages: who it discloses to, how long a conversation lives, what the training switch does not stop, and whose company answers a UK user.
United KingdomAnthropic's own pages: the training switch, the 30 days that become five years, the flagged chat kept for two, and where the data actually sits.
United KingdomGoogle's own privacy hub is unusually blunt about human reviewers. Training, the 18 months, the 72 hours, and the three years that survive deletion.
United KingdomFour products share the name, and the answer changes with each. Microsoft's own pages on training, human review, the Bing carve out and the UK's place.
United KingdomSix UK routes to cyber cover, compared from their own wordings and forms: limits, exclusions, excesses, what they require, and what they say about AI.
IrelandSpecial category data under GDPR turns up in Irish payslips, sick certs and WRC files. What Article 9 changes when that text goes into an AI tool.
IrelandAn engagement letter AI clause for Irish solicitors and accountants: what the Law Society and your Institute expect, and wording ready to copy into the letter.
IrelandGDPR patient data in an Irish practice: what can go into ChatGPT for a referral letter, what cannot, and the IHI and PPSN rules that sit on top.
IrelandIs pseudonymised data personal data? Yes, if you hold the key. For the AI provider, the Court of Justice said in 2025 that it depends. The Irish view.
IrelandPractice Direction HC 142 applies from 1 September 2026. What the AI declaration on an affidavit covers, and what should never reach the chatbot first.
IrelandYes, and Irish law also says who may use it at all. What else comes out of a file before an AI sees it, and why the DPC says that is not anonymising.
IrelandWhat council staff already use AI for, what resident data must not leave the building, and what the Act, the DPC and the NCSC ask of the 31 local authorities.
IrelandIreland is in the EU, so the Act applies here in full. What a deployer owes today, the dates after the July 2026 omnibus, and which Irish body enforces what.
IrelandNone on its own. What decides it in Ireland is the contract, the training, where the data goes and what you put in. Four assistants, criterion by criterion.
IrelandYes, and turning training off does not undo it. What OpenAI stores, for how long, who reads it, and why the Irish DPC is the regulator that decides.
IrelandOn a personal plan it can, unless you say no, and then it keeps chats for five years. On a business plan it may not. The documents, and the Irish regulator.
IrelandGoogle Ireland Limited runs Gemini here, human reviewers read a subset, and reviewed chats last three years. What the settings change, and what they do not.
IrelandCopilot is four products, and the answer changes with each. What Microsoft trains on, what leaves the EU Data Boundary, and what the DPC told LinkedIn.
IrelandNine Irish cyber documents, opened and read: what cover here actually pays for, what the Consumer Insurance Contracts Act 2019 changes, and how to compare.
AustraliaPrivacy Act sensitive information sits in Australian payslips, leave certificates and CVs. What changes when it reaches AI, and what to take out first.
AustraliaAn Australian engagement letter AI clause, drafted from rule 9, TPB(GS) 55/2026, APES 305 and APP 5, with the client data paragraph written two ways.
AustraliaAhpra AI guidelines for the letters a practice drafts with AI: which patient details stay out of ChatGPT, why the Medicare number is its own problem.
AustraliaDe-identified vs pseudonymised: the Privacy Act defines only the first. What each word means for a client file, and which one lets it go into ChatGPT.
AustraliaThe NSW Supreme Court AI practice note makes an affidavit say AI was not used. What you sign, and what must never reach a chatbot before you file.
AustraliaThe NDIS Commission asked providers to de-identify first. Here is what comes out of a progress note, in what order, and the step no software does for you.
AustraliaThe Privacy Act does not cover your council. Which law does depends on your state, and two of them changed on 1 July 2026. Here is what binds you.
AustraliaNo tool is compliant on its own, a use is. What APP 6, APP 8 and APP 11 ask of ChatGPT, Claude, Gemini and Copilot, and who the Privacy Act actually covers.
AustraliaYes, and how long depends on the account and the settings. What OpenAI stores, what turning off training does not cover, and where an Australian file goes.
AustraliaOn a personal plan only if you allowed it, and then for five years. On Claude for Work and the API, not by default. What that does and does not settle.
AustraliaGoogle says it does not sell it. It also says people read a subset of chats, and that reviewed chats survive deletion. What that means for an Australian file.
AustraliaIt depends which Copilot and which account. What enterprise data protection covers, the queries that leave for Bing, and where an Australian tenant's data sits.
AustraliaFour Australian cyber policy wordings, opened and read in full. What they pay for, the exclusions that decide a claim, what it costs, and how to compare.