Can I Use Customer Data To Train An AI Tool?

Yes, you may be able to use customer data to train an AI tool in New Zealand, but only if your privacy notices, customer terms and data handling practices actually allow it.

The tricky part is that AI training can feel like a normal business improvement, but legally it may be a new use or disclosure of personal information. If your customers gave you their data to buy a product, book a service or ask for support, that doesn't automatically mean you can feed it into an AI system.

The good news is that this doesn't have to stop your AI plans. You just need to be clear about what data you're using, why you're using it, who else can access it, and what your customers have agreed to.

Can I Use Customer Data To Train An AI Tool?

It depends, but you generally shouldn't use identifiable customer data to train an AI tool unless you've checked your Privacy Act obligations, privacy collection notice and your customer documents support that use.

Customer data can mean a lot of different things. It might include:

• names, email addresses, phone numbers and delivery addresses
• support tickets, chat logs and call transcripts
• purchase history, preferences and behavioural data
• photos, recordings or uploaded documents
• health, financial or other sensitive details customers share with you

If the data identifies a person, or could reasonably identify them when combined with other information, it's personal information under the Privacy Act 2020.

Using de-identified or aggregated data is usually lower risk. For example, training an internal tool on product return trends by month is very different from training it on named customer complaints that include order numbers, medical details or home addresses.

You also need to separate two common AI uses:

• Using AI to process data, such as summarising a support chat or drafting an email response.
• Using data to train or fine-tune AI, where the data helps the model learn and may influence future outputs.

Training is usually more sensitive because your customer information may be copied, retained or used beyond the single task you had in mind.

What Does The Privacy Act 2020 Say About AI Training?

The Privacy Act 2020 doesn't ban AI training, but it does require you to handle personal information fairly, securely and for proper purposes.

The Information Privacy Principles are the key rules to think about. For AI training, the most relevant ones are:

• IPP 1 - only collect personal information if it's necessary for a lawful purpose connected with your business.
• IPP 3 - tell people why you're collecting their information, who may receive it, and what rights they have.
• IPP 5 - protect personal information with reasonable security safeguards, supported by an information security policy where appropriate.
• IPP 9 - don't keep personal information for longer than you need it.
• IPP 10 - don't use personal information for a new purpose unless an exception applies, such as the new purpose being directly related to the original purpose or the person authorising it.
• IPP 11 - don't disclose personal information to another organisation unless an exception applies.
• IPP 12 - take care when disclosing personal information to an overseas organisation.

AI often raises IPP 10, IPP 11 and IPP 12 issues. If you upload customer data into a third-party AI platform, you may be using it for a new purpose, disclosing it to the AI provider, and sending it offshore.

The Office of the Privacy Commissioner can also expect you to show that you've thought about privacy risks before adopting new technology. A short privacy impact assessment can be a helpful way to record your reasoning, especially if you're using large data sets or sensitive information.

Do I Need Customer Consent Before Using Their Data?

You may need consent if AI training wasn't reasonably covered by what you told customers when you collected their data.

Consent isn't the only legal basis for every privacy use in New Zealand. In some cases, you might be able to use personal information for a purpose that's directly related to the original reason you collected it. For example, using support tickets to improve your customer service processes may be easier to justify than using those same tickets to train a public-facing AI chatbot that stores the data offshore.

Consent is more likely to be needed where:

• the data is sensitive, such as health, financial, location or children's information
• you didn't mention AI, analytics or product improvement in your privacy policy
• the AI provider can use the data to train its own models
• the data will be shared overseas
• customers would be surprised by the use
• the AI output may affect customer access, pricing, eligibility or service outcomes

If you do ask for consent, make it specific. A vague line saying you may use data for business purposes may not be enough for AI training. Customers should understand what information you want to use, what the AI tool does, whether data is shared with a third party, and whether they can opt out or complete a privacy consent form.

You should also be careful under the Fair Trading Act 1986. If you tell customers their data is only used to provide the service, but you're also using it to train AI, that can create misleading conduct risk.

What Should My Privacy Policy, Customer Terms And AI Vendor Terms Say?

Your documents should clearly explain your AI data use, and your AI vendor terms should stop your provider doing more with the data than you've agreed to.

Templates and an AI governance policy can be useful starting points, but AI clauses work best when they're tailored to your actual tools, data flows and customer promises.

Privacy Policy Updates

Your privacy policy should be easy for customers to understand. For AI, check whether it covers:

• what customer information you collect
• whether you use information for analytics, automation, AI training or service improvement
• which kinds of service providers may receive information
• whether information may be stored or processed outside New Zealand
• how customers can access or correct their information
• how customers can contact you about privacy concerns
• how long you keep the information

Customer Terms Or Consent Clause Outline

A lawyer should tailor this before you use it, but a practical AI data clause often covers:

1. Purpose - explain the specific AI use, such as improving support responses or personalising product recommendations.
2. Data Types - list the categories of customer data involved, avoiding broad catch-all wording where possible.
3. De-identification - say whether you'll remove names, contact details and other identifiers before use.
4. Third-Party Tools - explain if an AI provider may process the data for you.
5. Training Restrictions - state whether the provider can or can't use your data to train its own models.
6. Overseas Processing - note if data may be processed outside New Zealand.
7. Opt-Out Or Consent - set out how customers can say no, where that option is offered or required.
8. Retention - explain how long AI training data is kept and when it's deleted.

AI Vendor Terms

Before you upload customer data, check the AI platform's terms and conditions. Look for clauses on data ownership, model training, confidentiality, security, location of servers, subcontractors, deletion rights and audit rights. If the provider's free plan allows it to use your inputs to improve its own services, that may not suit customer personal information.

How Can I Reduce The Privacy Risk Before Training?

You can reduce the risk by using less personal information, removing identifiers and choosing AI tools with strong business-grade data protections.

Start with the data minimisation mindset. You don't need to use every piece of data just because you have it. Ask yourself what the AI tool actually needs to learn.

A Practical Example

Say Mia runs a New Zealand online skincare store with 8,000 customer support tickets. She wants to train an AI assistant to suggest replies to common product questions.

When Mia reviews the data, she finds about 1,200 tickets mention skin conditions, medications or allergic reactions. Another 500 include full names, addresses and order numbers. Instead of uploading all 8,000 tickets into a general AI tool, Mia takes a safer path:

• she removes names, email addresses, addresses and order numbers
• she excludes the 1,200 tickets containing health information from the first training set
• she uses 6,300 lower-risk tickets about shipping, product availability and general ingredient questions
• she updates her privacy policy to mention AI-assisted customer support improvement
• she checks that her AI provider won't use her inputs to train its own public model
• she keeps a record of the decision and reviews the system before it goes live

That approach doesn't remove every legal issue, but it makes the project much easier to justify than uploading the full data set without telling customers.

AI Data Use Checklist

Before you train or fine-tune an AI tool, work through this checklist:

1. Map The Data - list what customer data you'll use and where it came from.
2. Check The Original Notice - review what your privacy policy, forms and terms said when you collected it.
3. Decide If Consent Is Needed - consider whether customers would expect this use.
4. Remove What You Don't Need - de-identify, aggregate or exclude sensitive records where possible.
5. Review The AI Provider - check training rights, storage, security, overseas processing and deletion.
6. Update Customer Documents - align your privacy policy, terms and consent wording.
7. Limit Access - only let the right team members handle the data, and set an acceptable use policy for AI tools.
8. Set A Retention Date - decide when the training data will be deleted or refreshed.
9. Test Outputs - check the tool doesn't reveal personal information or make unfair assumptions.

If customer data has already been uploaded to an AI tool, pause further uploads, preserve your records, check the platform's deletion options and review whether a notifiable privacy breach may have occurred. Under the Privacy Act, a privacy breach must be notified to the Office of the Privacy Commissioner and affected individuals if it's likely to cause serious harm.

Key Takeaways

• You can use customer data to train AI in New Zealand only if the use fits your Privacy Act obligations and customer promises.
• Identifiable customer data is higher risk than de-identified, aggregated or synthetic data.
• Consent may be needed if AI training is a new, surprising or sensitive use of customer information.
• Your privacy policy, customer terms and AI provider terms should all line up before you upload data.
• Check whether your AI provider can use your inputs to train its own models, especially on free or public tools.
• If data has already been used in a risky way, pause, document what happened and get privacy advice before continuing.

If you'd like help with your privacy policy updates, customer terms, AI data clauses or data protection advice, you can reach us at 0800 002 184 or team@sprintlaw.co.nz for a free, no-obligations chat.