Amelia Harris, a NZ Privacy and Data Protection Consultant at genPrivacy, recently published a blog on why AI data protection matters for NZ businesses. Here at NFP Resource we felt that much of what Amelia was discussing was relevant to NZ public-good entities so with Amelia’s permission we reproduce much of her blog here.
Ameila says that “AI has moved from “something to think about later” to something people are already using at work.
AI use is already happening inside most organisations, whether leadership has approved it or not. For New Zealand businesses, the biggest risk usually isn’t AI itself. It’s staff using it without clear rules, approved tools, or oversight. The Privacy Act 2020 still applies when AI is involved, and a few practical steps can reduce risk without shutting innovation down.
That might be for drafting emails, summarising notes, rewriting documents, brainstorming ideas, or speeding up admin.
In some businesses, that use is visible and discussed. In others, it’s happening behind the scenes, through personal logins, free tools, browser extensions, or built-in AI features no one has properly reviewed yet.
That’s why AI data protection matters.
Not because every AI tool is automatically risky. And not because businesses need to panic and ban it all.
It matters because once people start feeding business, employee, or customer information into tools that haven’t been assessed properly, the organisation can lose sight of where data is going, how it’s being handled, and what new risks are being created.”
The blog goes on to discuss the following topics:
- AI use is already happening inside your organisation
- The real risk is unmanaged AI use
- What Shadow AI can look like
- The Privacy Act still applies when AI is involved
- Free AI tools and enterprise AI tools are not the same
- What staff should never enter into AI tools casually
- Why banning AI usually creates a different problem
- Where to start if you’ve done nothing yet
- How to start using AI more safely
- What a practical AI use policy should cover
- Good AI governance supports innovation
- FAQs about AI data protection for New Zealand businesses
If AI use is already creeping into your organisation, now is the time to deal with it
You need an approach that fits your organisation, your people, your systems, and the kind of information you’re responsible for protecting.
That might mean identifying Shadow AI, reviewing current tools, assessing privacy risk, putting an AI use policy in place, training staff, or working out which enterprise tools and settings are the safest fit for your business.
You don’t need to figure this out on your own
If that’s where you’re at, I can help you put the right foundations in place so your business can use AI more confidently without losing sight of privacy, trust, or control.