AI tools can help a small business draft messages, summarize documents, prepare marketing content and organize customer requests. But convenience should never come before data protection. A prompt can contain personal information, confidential business details or customer records that should not be shared with an unfamiliar service.
This guide provides a practical privacy check before a team uploads business information to an AI tool. It is operational guidance, not legal advice. Requirements depend on the country, the type of data and the business relationship.
1. Identify what you are about to share
Start by classifying the information in the task. Do not treat every document as harmless simply because it is being pasted into a chatbot.
- Public information: published product descriptions, public FAQs and information already intended for customers.
- Internal business information: unpublished plans, supplier terms, internal procedures and non-public financial details.
- Personal information: names, phone numbers, email addresses, customer messages, employee details and identifiers.
- Highly sensitive or restricted information: payment credentials, passwords, authentication codes, identity documents, health information and confidential records.
When classification is uncertain, stop and ask the person responsible for data protection or security. Never paste passwords, API keys, payment card details or authentication codes into a general-purpose AI prompt.
2. Minimize the information in the prompt
Give the AI only the information needed to complete the task. If you want help drafting a reply to a customer, you may not need the customer’s full name, phone number, address or order reference.
- Replace names with neutral labels such as “Customer A”.
- Remove phone numbers, email addresses, addresses and account identifiers.
- Use a short, fictional example when the real record is not necessary.
- Share an extract rather than an entire spreadsheet or customer database.
- Keep the original source in the business system with its normal access controls.
Data minimization reduces exposure and often makes the task easier to review. The Moroccan CNDP describes proportionality as limiting personal data to what is necessary for the stated purpose; consult the applicable rules for your organization and situation.
3. Check the provider and the account settings
Before using a tool with non-public information, consult the provider’s current official documentation and the settings available in the account you will actually use. Do not assume that a free account, an individual subscription and a business workspace have identical data controls.
Record the answers to these questions:
- What does the provider say about using submitted content to improve or train its models?
- Can the organization control or opt out of that use, and does the setting apply to every user?
- How long may prompts, files and generated outputs be retained?
- Can administrators manage users, access, exports and deletion requests?
- Does the provider explain subprocessors, data locations and incident notifications?
- Are the relevant privacy and security terms available for the specific plan?
Save the official policy or terms you reviewed, together with the date. Product policies and account controls can change, so a previous review should not be treated as permanent approval.
4. If your business operates in Morocco
Morocco’s Law 09-08 addresses the protection of individuals in relation to the processing of personal data. The CNDP’s official materials explain that personal data can include identifiers such as names, postal or email addresses, phone numbers and other information that identifies or can identify a person.
The CNDP also describes obligations concerning the purpose and proportionality of processing, data quality, confidentiality and security, and formalities that may apply before processing. Its guidance distinguishes declaration and prior-authorization situations, and discusses transfers of personal data abroad. The applicable requirements depend on the specific processing activity and circumstances.
Do not assume that selecting an AI provider or changing an account setting alone makes a workflow compliant. Before transferring customer or employee information to an external AI service, have the responsible person assess the provider, purpose, data categories, contractual terms, hosting or transfer arrangements and any required CNDP formalities. Consult the CNDP or qualified legal counsel for a case-specific assessment.
Pay particular attention to hosting outside Morocco. The CNDP publishes a specific procedure for transfers of personal data abroad under Articles 43 and 44 of Law 09-08. It also explains that a transfer request depends on the underlying processing having completed the applicable declaration or authorization formalities. Before sending live customer or employee data to a provider whose systems may process or store it abroad, check the actual data flow, destination, contractual safeguards and applicable CNDP procedure with the responsible person or qualified counsel.
5. Separate experimentation from production use
A tool that works well with public sample text is not automatically approved for customer or employee information. Start with a low-risk pilot.
- Choose one narrow task, such as rewriting a public product description.
- Use synthetic or anonymized examples during initial testing.
- Identify who can access the account and its conversation history.
- Review output quality, errors and the amount of human correction required.
- Only consider real business data after the provider, plan, settings and internal approval have been checked.
Keep the pilot separate from live customer operations until the business has documented the controls and assigned an owner.
6. Put human review into the workflow
AI-generated content can contain invented details, disclose information included in a prompt or misunderstand the context. A human should review any output before it is sent to a customer, used for a decision or added to an official record.
- Check names, dates, amounts, contractual terms and factual claims.
- Confirm that the output does not reveal confidential information.
- Remove unnecessary personal data from the final response.
- Escalate legal, financial, employment, health or other high-impact decisions to an appropriately qualified person.
- Keep a record of who approved the workflow and when it was last reviewed.
7. Create a simple AI data-use register
A small business does not need a complicated system to start governing AI use. A simple register can make responsibilities visible and help prevent accidental data sharing.
| Field | What to record |
|---|---|
| Tool and plan | Provider, product, account type and workspace owner |
| Business purpose | The task the tool is approved to support |
| Data category | Public, internal, personal or restricted |
| Controls checked | Training use, retention, access, deletion and relevant terms |
| Owner | Person responsible for the workflow |
| Approval and review | Approver, review date and next review trigger |
8. A practical pre-use checklist
- ☐ I know what information the prompt or uploaded file contains.
- ☐ I have removed data that is not necessary for the task.
- ☐ I have not included passwords, payment credentials or authentication codes.
- ☐ I have checked the official terms and settings for this exact account and plan.
- ☐ The business has approved this type of data for this use.
- ☐ Access to the account and its outputs is appropriately controlled.
- ☐ A named person will review the output before it is used externally or for a decision.
- ☐ The workflow owner knows how to report a suspected exposure or incident.
Example: drafting a customer response safely
Risky prompt: “Reply to this customer: [full name, phone number, email, home address, order number and complete complaint].”
Safer prompt: “Draft a polite response to a customer whose delivery is delayed. Apologize, explain that the team is checking the status and ask them to contact the business through its normal support channel. Do not invent a delivery date.”
The second prompt provides enough context for a useful draft without exposing the customer’s identity. The employee can add verified order details later inside the approved business system.
Apply privacy controls to customer support
If you are designing an AI-assisted customer service process in French, Darija or Arabic, see our multilingual AI customer support workflow. It shows how to limit the information supplied to an assistant, use approved answers and route sensitive cases to a person.
Related AIToolSee guides
- How We Review AI Tools — the criteria used to assess usefulness, limitations and transparency.
- AI Tools for Small Businesses: Build a Practical AI Stack — start with one workflow and measure its value.
- AIToolSee Privacy Policy — how this website describes its own privacy practices.
Official references and further reading
- Moroccan CNDP — Textes et lois, including Law 09-08.
- Moroccan CNDP — FAQ, including examples of personal data.
- Moroccan CNDP — Conditions, describing purpose limitation, proportionality, data quality, confidentiality and security measures.
- Moroccan CNDP — Transfers of personal data abroad, explaining the procedure under Articles 43 and 44 of Law 09-08.
- Moroccan CNDP — Notify a processing activity, outlining the applicable notification and authorization routes.
- NIST — AI Risk Management Framework, a voluntary framework for managing AI-related risks.
Editorial note: This guide provides general operational guidance. It does not certify any AI provider or replace a legal or security assessment. The CNDP links are primary references; readers should check the latest official materials and obtain case-specific advice where needed.
Final takeaway
The safest AI workflow is not the one that sends the most information to the most powerful tool. It is the one that uses the minimum necessary data, has a clearly reviewed provider and account setup, assigns responsibility and keeps a human checkpoint before important outputs are used.