# Keep client data out of the wrong place: the AI privacy and security build Source: https://getstartedwithai.net/tutorials/ai-privacy-security-solo-pro Site: Get Started With AI Tagline: Build AI automations that actually run your business. Audience: solo professionals, freelancers, consultants and AI implementers in training Contact: hello@getstartedwithai.co.uk This Markdown companion is generated from the prerendered page for AI crawlers. # Keep client data out of the wrong place: the AI privacy and security build Defaulting to paste it into ChatGPT is no longer acceptable practice for solo professionals handling client briefs, financials, contracts or intellectual property. UK GDPR and the EU AI Act both apply, and clients increasingly ask before they sign. The 12-point hygiene checklist in this guide closes the data-leakage and disclosure gaps without blocking useful AI work. Pair it with sector-specific guardrails for legal, healthcare, finance and education, plus the one-page data-handling policy template you can hand a client when they ask. Time to apply: about 60 minutes if your accounts already exist. ## The four risk categories - Data leakage: client data ending up in training sets or used for model improvement. - Unauthorised processing: using AI on data the client has not consented to. - Misattribution: AI output presented as human work without disclosure. - Identity risks: voice clones, deepfakes, impersonation. ## The default rules - Use a Pro or Team plan, never Free, for client work. Free plans usually train on your data. - Turn off training data use. Settings, Data Controls, Improve the model = off. - Sanitise sensitive data before paste. Replace real names, emails, account numbers with placeholders. - Disclose AI involvement when output is public-facing. Even a brief drafted with AI assistance line. - Get written consent before recording calls or cloning voices. ## The 12-point hygiene checklist - I have turned off training data use on every paid AI account. - I use Pro or Team tier for client work, not Free. - I sanitise sensitive data before pasting (names, emails, account numbers, financials). - I have a documented data handling policy that clients can request. - I get written consent before recording calls. - I disclose AI involvement on public-facing output where the AI did substantive work. - I never clone a voice without explicit written consent. - I store client files in a secure system (Drive Workspace, OneDrive Business), not personal accounts. - I have 2FA on every AI tool account. - I review my AI tool subscriptions quarterly and cancel any I am not using. - I have a deletion policy for client data after engagement ends. - I have a process for breach notification if data is compromised. ## Sector-specific guardrails - Legal: data must not leave the firms approved cloud. Use Microsoft 365 Copilot inside the tenant or self-hosted Whisper for transcripts. - Healthcare: extreme caution with patient data. Most consumer AI tools are not appropriate. Use sector-specific tools or get explicit data processing agreements. - Financial services: similar to legal. Many firms ban consumer AI tools entirely. Work with the clients IT and compliance team. - Schools and education: child safeguarding rules apply. Default to manual processes for anything involving minors. ## How to write a data handling policy - One page maximum. - Sections: data we collect, where we store it, what we do with it, how clients can request deletion, how we handle breaches. - Specific named tools: We use Claude Pro with training data turned off, files stored in Google Drive Business with 2FA, audit log retained for 12 months. - Update it quarterly when tools or processes change. - Make it available on request, not buried on a page nobody reads. ## When to escalate to a lawyer - Any client in legal, healthcare and financial services, defence, or government. - Any voice cloning or deepfake-adjacent work. - Any data subject access request from a client or third party. - Any potential or actual data breach, however small. - Spending £200 on a 30-minute lawyer call is cheaper than discovering you got it wrong. ## What you ship A signed-off hygiene checklist on your own AI accounts, a one-page data handling policy your clients can request, and the procedural answer for the next prospect who asks how you handle their data. Charge clients £400 to £1,500 for the package: 60-minute privacy audit, written policy, 30-day check-in. Pair with technical setup: turning off training, configuring tenant boundaries, hardening accounts. Walk through your own policy as the demo. ## Common mistakes - Defaulting to Free tier for client work. Free trains on your data; do not use it for sensitive work. - Skipping the consent step on call recordings. The legal exposure is real. - No data handling policy because you are too small to need one. Clients ask; if you cannot answer, you lose deals. - Treating disclosure as optional on public AI-generated content. The EU AI Act and UK best practice both expect it. ## What to build next Pair this with the ElevenLabs voice cloning ethics tutorial for voice-specific guardrails, and the WIRE Method which bakes hygiene into every embed step. ## Related builds More tutorials in Foundations. Each one runs in 60 to 90 minutes and ships a finished asset. ### Ship one working AI system in 30 minutes: the solo professional setup 30 to 60 minutes. Beginner + Solo Pro. [Open tutorial](/tutorials/start-using-ai-this-week-30-min) ### Stop paying for tools you do not use: when an AI upgrade pays back 30 to 60 minutes. Beginner + Solo Pro. [Open tutorial](/tutorials/free-vs-paid-ai-tools-payback) ### Replace 10 hours a week in your first 30 days as a solopreneur 30 to 60 minutes. Solo Pro. [Open tutorial](/tutorials/ai-for-solopreneurs-first-30-days) ### Save the £600 course fee: an honest read on AI courses for beginners 60 to 90 minutes. Beginner. [Open tutorial](/tutorials/ai-courses-for-beginners-worth-it) ## Questions people ask before they start ### Will my data really be used for training? On Free tiers of most consumer AI tools, often yes. Pro and above usually default to no, but always check Settings, Data Controls. For Team and Enterprise, the default is no with admin controls to enforce it. ### Do I need a Data Processing Agreement with my client? For UK GDPR, if you process personal data on the clients behalf, yes. The DPA can be a 1-page addition to the engagement contract; templates are available from ICO. ### What about the EU AI Act? It applies to high-risk AI uses (employment, education and critical infrastructure). For most solo professional work, the disclosure obligations are the main concern: AI-generated content should be marked when public-facing. ### Can I use AI on client data if my client asks me to? Yes, with the right hygiene. The clients consent does not override the underlying data handling rules; you still need to use Pro tier, turn off training, store files securely. Consent permits the use; hygiene controls how it is done. ### How do I handle a subject access request? Acknowledge within 7 days, respond within one calendar month per UK GDPR. ICO publishes templates. Loop in a lawyer if the request is complex or hostile.