AI Data Security: A Guide for Non-Technical Business Owners

Picture a building-materials distributor days before the books close. The finance admin has a stack of overdue invoices to chase, one WhatsApp message per customer. She exports the receivables list (customer names, WhatsApp numbers, amounts outstanding, days overdue) and pastes it into a free chatbot on her own phone, under her personal Gmail. The reminders come out polite and tidy. Done before lunch. The owner never finds out.

AI data security in a business depends less on which AI you use than on three things you can check yourself: whose account is used, which plan is paid for, and what the AI is allowed to touch. The same chatbot treats data differently on a free personal account and on a business plan. Once AI is connected to your email or accounting system, the question becomes what it can read and do.

Where did that receivables list go?

Nothing broke in that story, and the admin meant no harm. She got real work done with the only tool she had. The consequence is quieter than a leak that makes the news: the receivables list now sits in an account the company doesn't control and can't delete. No contract with the provider. No record. If you ever have to answer what data has left the business, there is nothing to open.

Consumer plans play by different rules. As of late September 2026, Google says chats and files in consumer Gemini are saved and used to develop its services, including training AI models, while the activity setting is on. Some chats are read by human reviewers, and reviewed chats can be kept for up to three years (Source: Google, Gemini Apps Privacy Hub, 2026). Google itself tells users not to enter confidential information they wouldn't want a reviewer to see.

As of early October 2026, Microsoft uses Copilot conversations from signed-in personal accounts to train AI unless the user opts out, with some categories of users excluded, and keeps that activity for 18 months by default (Source: Microsoft, 2026). On ChatGPT, content from Free, Plus and Pro accounts can be used to improve the models unless the setting is switched off; paying for Plus doesn't change that default (Source: Bluehost, 2026, citing OpenAI's help centre). On consumer Claude, it depends on the setting the user has chosen (Source: Anthropic, 2026). These policies change, so check the settings yourself.

Same task, three setups

Now replay the story. Same admin, same task, but the company pays for a business plan and she signs in with a work account. Business terms now apply. In Gemini for Google Workspace, prompts count as customer data, aren't used to train models, and aren't reviewed by humans outside the company's domain without permission (Source: Google Workspace, 2026). Microsoft says much the same for Copilot on organisational accounts, which follows the company's existing access permissions and audit trail (Source: Microsoft, 2026). Claude for commercial use and the OpenAI API don't train on customer data by default either (Source: Anthropic, 2026; OpenAI, 2026).

The third setup removes the pasting altogether. An AI agent connected to the accounting system reads the receivables list and drafts the reminders itself. It's tidier, and the data no longer travels to anyone's phone. But the risk has moved.

When AI reads your email and systems

OWASP ranks prompt injection first among its top ten risks for applications built on language models (Source: OWASP, 2025). Put simply, instructions can be planted in a web page, file or email the AI reads, even in a form no human eye can see. OWASP itself admits it's unclear whether any fool-proof prevention exists, so its advice is to limit the damage: minimal access, human approval for risky actions, and outside content kept separate from instructions.

OWASP's own example is easy to picture. An assistant meant only to summarise email is also allowed to send. One poisoned email is enough to make it forward private data outside the business (Source: OWASP, 2025). A flaw of this kind was found in a mainstream product: Microsoft patched a flaw called EchoLeak in Microsoft 365 Copilot in June 2025, rated CVSS 9.3 for severity, with no evidence it was ever exploited (Source: Aim Security, reported by The Hacker News, 2025). Even a vendor that size has to patch.

In our experience building agents that connect to clients' systems, the first question is what the agent may read and do. Which model to use comes second. If its job is to read, give it read access only. Messages to customers wait for a person's approval before they go out.

What AI data security means for your business

Back to that admin. She used a personal account because the office offered no approved tool. The pattern is widespread: in IBM's study of 602 data breaches, staff use of unsanctioned AI showed up in 43% of breached organisations, up from 20% a year earlier, and 92% of organisations that had an AI-related incident lacked adequate AI access controls (Source: IBM, 2026). Netskope found 47% of generative AI users at work still on personal accounts, down from 78%, and that figure comes from its corporate customers, not SMEs (Source: Netskope, 2026).

In Indonesia, a Salesforce survey of 1,000 workers found that 70% feel more confident working with AI, while only 33% had received AI training from their employer (Source: Salesforce, 2026). Your staff are already ahead of you. A ban with no replacement tool tends to push usage further out of sight, especially in offices where customer lists, photos of ID cards (KTP) and transfer receipts have long lived in WhatsApp on personal phones.

Sorting is more useful than banning. Our suggestion at Agentiq, which is not any official standard, is three simple drawers.

• Open: material that is already public, such as product descriptions, public price lists and general writing drafts. Fine in any tool.
• Restricted: internal documents with no personal data, such as SOPs, anonymised sales figures and meeting notes without names. Business plan and work account only.
• Locked: personal data and trade secrets, such as national ID numbers and cards (NIK and KTP), payslips, bank details, customer lists with contacts, contracts and margins. Only in a system the company holds the contract for, with role-based access and a record of who asked what. Anywhere else, strip the identifiers first.

That receivables list belongs in the locked drawer. Because it holds customers' personal data, sending it to a tool the company has no contract with is also a compliance matter under Indonesia's Personal Data Protection (PDP) Law, covered in our related article.

For this week, two things are enough: provide one official tool on work accounts, and pin the three-drawer rule up where your team works. It isn't a big job. Then, before any agent is connected to your systems, put these questions to the vendor and ask for written answers.

• Is our data used to train models, and which clause of the contract says so?
• How long are prompts and files kept, and can we delete them?
• Which systems can the agent read, and which can it change? Can read and write permissions be separated?
• Which actions wait for human approval, and who is that person?
• Is there a log we can open ourselves, and what happens to the agent's access when the employee who set it up leaves?

If you'd like to see what AI access and approval controls could look like for your business, walk us through your process on our contact page. The Agentiq team will reply with concrete recommendations, not a template.