AI and privacy: what a business can hand over to AI, and what it must protect

By the NRX3 team · Updated

AI changes very quickly. This guide was written to the best of our knowledge as of October 23, 2026; some of it may now be outdated or no longer apply.

Pasting a customer's email into an AI tool to prepare a reply is handy. But that email may contain a name, an address, a file number. This guide explains, in plain language, what you can hand over to AI and what you need to protect.

This guide is a general summary, not legal advice. For a specific situation, contact Québec's Commission d'accès à l'information, the Office of the Privacy Commissioner of Canada, or a lawyer.

In short

  • Privacy laws still apply when you use AI.
  • Before using a tool, know where your data goes and whether it's used to train a model.
  • Remove what identifies someone when it isn't needed.
  • An important decision about a person shouldn't be made by AI alone.
  • Write down your rules and tell your customers how you use AI.

What counts as personal information

Personal information is anything that identifies a person, directly or by combining details: name, email, phone number, address, customer number, but also a photo, a file, a purchase history. Some is more sensitive than the rest: health, finances, social insurance number, information about children.

What you can safely hand over to AI

  • text that's already public: your website, brochures, ads;
  • templates and internal documents with no personal information: procedures, boilerplate, general notes;
  • truly anonymized data, meaning it can no longer, irreversibly, be linked to a person.

What calls for caution

  • your customers' emails, files and complaints;
  • information about your employees: applications, reviews, absences;
  • sensitive data, such as health and finances;
  • your trade secrets: prices, contracts, plans.

For this data, only use a tool whose terms you know, ideally a "business" version that commits not to use your data to train its models.

Questions to ask about an AI tool

  • Is my data used to train the model? Can I opt out?
  • Where is it stored, and for how long?
  • Who at the provider can access it?
  • Can I delete it?
  • Does the provider have written commitments on data protection?

The main rules in Québec

Québec's Act respecting the protection of personal information in the private sector, amended by the law often called "Law 25", applies to businesses operating in Québec. Among its requirements:

  • a person in charge of protecting personal information, whose title and contact information are published on the business's website;
  • internal rules on retention, destruction and handling complaints, published in plain language;
  • a privacy impact assessment before certain technology projects and before sending information outside Québec, which often happens with AI tools hosted elsewhere;
  • informing the person when a decision about them is made solely by automated processing, and letting them submit their comments to someone at the business who can review the decision;
  • privacy settings set by default to the most protective level when a business collects personal information by offering the public a technology product or service that has such settings (browser cookies are an exception);
  • reporting confidentiality incidents that present a risk of serious injury, to the Commission d'accès à l'information and to the people concerned.

Elsewhere in Canada and around the world

Elsewhere in Canada, the federal private-sector privacy law generally applies to businesses, except in Alberta and British Columbia, which have their own similar laws. The federal law also applies, even in Québec, to federally regulated businesses (banks, telecommunications, transportation) and to information sent from one province or country to another. In December 2023, the Office of the Privacy Commissioner of Canada and its provincial and territorial counterparts published principles for the responsible use of generative AI. If you serve customers in Europe or elsewhere, other rules may apply too.

Good habits

  1. Remove what identifies: replace names with "customer A" when the name isn't needed for the task. Careful: that doesn't make the data anonymous; it's still personal information if the person can be identified.
  2. Choose your tools and tell your team which ones are allowed.
  3. Keep a person in the loop for any decision that affects someone: hiring, credit, a service refused.
  4. Be transparent: say in your privacy policy how you use AI.
  5. Clean up: delete what you no longer need to keep.

Sources