Free 30-minute scoping call. Tell us the problem, we’ll show you the fix.Book a call
AI

Is your data safe with AI? A checklist for NZ businesses

Is AI safe for your business data? The questions to ask about training, storage, access, approvals and the NZ Privacy Act 2020 before you start.

  • 17 September 2026
  • 5 min read
  • Dragon Hill Technology

AI can save businesses a lot of time, but it often works with sensitive information: customer details, financial records, contracts. Before you use it, work through this checklist.

1. Is your data used to train the AI?

Consumer AI tools may use what you type to improve their models. Business-grade AI services generally commit not to. Check the terms, and use business accounts, not personal ones.

2. Where is your data stored?

Know which country your data is processed and stored in, and whether that matters for your clients or contracts.

3. Who and what can the AI access?

An AI agent should only reach the systems and data it needs for its job. Don’t give it access to everything “just in case”.

4. Does a person approve important actions?

Sending money, changing prices or emailing customers should wait for a person to approve. Read what an AI agent is for how this works.

5. Is every action recorded?

You should be able to see what the AI did, when and why.

6. Are you meeting the Privacy Act?

The NZ Privacy Act 2020 applies to personal information however it’s processed, including by AI. Be open with customers about how you use their information, and only use what you need. The Office of the Privacy Commissioner has published guidance on AI for organisations.

7. What happens when the AI is wrong?

Plan for mistakes: limit the AI to tasks where errors are caught, give customers an easy way to reach a person, and review its work regularly. Our guide to AI chatbots for customer service covers this for customer-facing tools.

8. Can you switch it off?

You should be able to pause or remove the AI quickly, and take your data with you.

Quick checklist

  • Business-grade AI with no training on your data
  • Known data location
  • Least-access permissions
  • Human approval for important actions
  • Full activity log
  • Privacy Act obligations reviewed
  • A plan for mistakes and an off switch

Want AI that’s built safely from the start? Every AI agent we build has human approval, limited access and a full record of its actions. See our AI solutions or discuss your AI agent.

FAQ

Questions and answers

Straight answers to the questions we hear most. Can’t see yours? Ask us directly.

Still have questions?Talk to the people who build your project.
Do AI tools train on my business data?

Some consumer tools may. Business-grade AI services generally offer terms that your data is not used for training. Check the provider’s terms before you start.

Does the Privacy Act apply to AI?

Yes. The NZ Privacy Act 2020 applies to personal information however it is processed, including by AI tools. The Office of the Privacy Commissioner has published guidance on AI.

How do I stop an AI agent doing something it should not?

Limit what it can access, require a person to approve anything important, and keep a record of every action it takes.

Let’s talk

Tell us what’s slowing your business down

Book a free 30-minute scoping call. We’ll listen, suggest the fix, and send a clear quotation in writing.

Or email us at info@dragonhill.ai
What happens next
  1. 1. Tell us the problemA real person replies quickly.
  2. 2. Free 30-minute callWe suggest the simplest fix.
  3. 3. Quotation in writingScope, price and deadline agreed first.
No obligation