Privacy and Safe Use at Work in Canada

So far you have used AI to write, research and make images. This lesson is about the one habit that keeps all of that safe: knowing what should never go into the chat box in the first place.

You do not need to be a lawyer or a tech expert. You need one simple rule, two minutes in your settings, and one page your staff can follow. By the end of this lesson you will have all three.

Where your words go

An AI chat tool does not run inside your phone or laptop. Everything you type or upload travels over the internet to the company that runs the tool. Its computers write the answer and send it back.

What happens next depends on your plan and your settings. Your chat is normally saved so you can return to it. It may also be used for training, which means the company uses real conversations to improve future versions of its AI. Plans differ. OpenAI, for example, says content from its services for individuals may be used for training unless you opt out, while its Business, Enterprise and Edu workspaces are not used for training by default.

A fair way to think about it: the chat box is like an email to a company you barely know. Only send what you would be comfortable having stored on someone else's computers.

The traffic-light rule

Before you paste anything, give it a colour.

• Green, go ahead: public information, your own marketing text, general questions. "Write a spring promotion for a Mississauga landscaping company" is green.
• Yellow, remove details first: internal business matters such as a supplier dispute, a pricing idea or a difficult customer conversation. Use it only after you take out names and anything else that points to a real person or company.
• Red, never paste: customer personal information, health details, payment card or banking numbers, government ID numbers (SIN, driver's licence, health card), passwords, and employee records.

What turns yellow into green is the placeholder habit you practised in Lesson 3. A placeholder is a stand-in word in square brackets. Swap real details for [CUSTOMER], [ADDRESS] and [AMOUNT] before you paste, then put the real ones back yourself in your own email or document. Check for the small things too: phone numbers, email addresses, order numbers and licence plates all point to a real person. The AI can still write a useful reply without knowing who it is for.

If you are not sure which colour something is, treat it as red.

Photos, screenshots and files count too. A screenshot of your booking calendar or an invoice is full of red information, even if you only wanted help with the layout.

Canadian rules in plain language

Canada's federal privacy law for businesses is PIPEDA (the Personal Information Protection and Electronic Documents Act). The Office of the Privacy Commissioner of Canada says it applies to private-sector organizations across Canada that collect, use or disclose personal information in the course of a commercial activity. Alberta, British Columbia and Quebec have their own similar laws. Ontario does not have a general one, so PIPEDA covers customer information held by Ontario businesses. It rests on ten fair information principles. Three matter most here: get consent, use information only for the purpose it was collected for, and safeguard it.

Typing a customer's details into an AI tool is a use of that information. Someone who gave you a phone number to book a furnace repair most likely did not agree to have it sent to an AI company. Canada's federal, provincial and territorial privacy commissioners cover this in their joint Principles for responsible, trustworthy and privacy-protective generative AI technologies. Their advice is to use anonymized or de-identified information in prompts instead of personal information wherever you can.

Health information in Ontario has its own law, PHIPA (the Personal Health Information Protection Act). It applies to "health information custodians" such as doctors, nurses, dental professionals, physiotherapists, massage therapists, pharmacies and hospitals, and to people acting for them. In a clinic, patient details are always red.

PIPEDA's rules on employee information apply to federally regulated businesses such as banks and telecom companies, not to most Ontario small businesses. Treat staff records as red anyway. Your employees trust you with them.

Change may be coming. Bill C-36, the Protecting Privacy and Consumer Data Act, was introduced in Parliament on June 15, 2026. When this lesson was checked on October 2, 2026, it had not passed and was still at an early stage in the House of Commons, so PIPEDA is still the law.

Two Ontario rules apply to employers with 25 or more employees. Since January 1, 2026, a publicly advertised job posting must include a statement if you use AI to screen, assess or select applicants. You also need a written policy on electronic monitoring of employees.

If you belong to a regulated profession (health, legal, accounting, real estate, insurance), check with your regulator before using AI on client matters. The Law Society of Ontario publishes a practice note called "Generative AI: Your professional obligations". The College of Physicians and Surgeons of Ontario says physicians are ultimately accountable for their use of AI tools.

Settings to change today

Menus move, so if a name below has changed, look for words like "data", "privacy" or "activity". These were checked on each company's help pages on October 2, 2026. Copilot is not listed below. If you chose it in Lesson 1, open its settings, find the privacy section, and use Microsoft's Copilot privacy controls page listed in the Lesson 2 sources.

• ChatGPT: Settings, then Data controls, then Improve the model for everyone. Turn it off and new chats are not used for training. A deleted chat leaves your view at once and is scheduled for permanent deletion within 30 days, with some exceptions for security and legal reasons. A Temporary chat stays out of your history and out of training, though a copy may be kept for up to 30 days for safety.
• Google Gemini: Settings & help, then Activity, then Keep Activity. It is on by default, and activity is auto-deleted after 18 months unless you pick 3 or 36 months. Google says human reviewers read some chats. With Keep Activity off, chats are still held for up to 72 hours. Gemini also offers Temporary Chat, which is also held for up to 72 hours.
• Claude: Settings, then Privacy, then Help Improve our AI models. If it is on, your data may be kept in de-identified form for up to five years. Deleted chats are removed from Anthropic's systems within 30 days, though chats flagged for breaking the rules can be kept longer. Incognito chats (the ghost icon) are available on the Free plan, are not used for training, and are kept for 30 days by default.

One more thing to know: if you click thumbs up or thumbs down on an answer, OpenAI and Anthropic say that conversation may be used for training even if you have opted out.

Notice the pattern: even a temporary chat is sent to the company and kept for a while. These settings lower the risk for green and yellow material. They do not make red material safe.

Three more habits and your one-page rule

• Keep a human in decisions about people. Hiring, giving credit and refusing service affect someone's life. AI can summarise or organize, but a person decides and can explain why.
• Be honest about AI. If a customer is chatting with an AI on your website or phone line, say so, and offer a way to reach a person.
• Expect better scams. Get Cyber Safe warns that criminals use AI to write phishing emails (fake messages that try to trick you out of money or passwords) that look more real and more personal, and to copy real voices. The Canadian Centre for Cyber Security advises hanging up and calling back on a number you already know and trust, and agreeing on a shared code word or call-back step at work. Report fraud to your local police and to the Canadian Anti-Fraud Centre at 1-888-495-8501.

Now put it on one page for your team: which tools are approved, what must never be pasted, and who checks AI-written content before it reaches a customer.

For a GTA small business, the everyday risk is less about the AI and more about the paste button. One clear rule for you and your staff makes mistakes much less likely.

This lesson is general information, not legal advice. For a specific situation, ask a lawyer or your regulator.

Prompts you can copy

Draft your one-page AI use policy

Check your draft for gaps

Reply to a customer using placeholders

Make a quick staff quiz

Before you move on

Sources checked for this lesson: Office of the Privacy Commissioner of Canada: PIPEDA in brief • Office of the Privacy Commissioner of Canada: PIPEDA fair information principles • Office of the Privacy Commissioner of Canada: Principles for responsible, trustworthy and privacy-protective generative AI technologies • Office of the Privacy Commissioner of Canada: Privacy in the workplace (PIPEDA and employee information) • Parliament of Canada LEGISinfo: Bill C-36 (Protecting Privacy and Consumer Data Act) status • Government of Canada news release: new privacy legislation tabled, June 2026 • Information and Privacy Commissioner of Ontario: Health privacy (PHIPA) • Information and Privacy Commissioner of Ontario: Frequently Asked Questions, Personal Health Information Protection Act (PDF) • Ontario: Guide to the Employment Standards Act, requirements related to publicly advertised job postings • Ontario: Guide to the Employment Standards Act, written policy on electronic monitoring of employees • OpenAI Help Center: Data controls in ChatGPT • OpenAI Help Center: How your data is used to improve model performance • OpenAI Help Center: Deleting and archiving chats in ChatGPT • OpenAI Help Center: Temporary chat in ChatGPT • Google: Gemini Apps Privacy Hub • Google: Manage and delete your Gemini Apps activity • Anthropic Privacy Center: How do I change my model improvement privacy settings? • Anthropic Privacy Center: How long do you store my data? • Anthropic Privacy Center: Is my data used for model training? • Claude Help Center: Using incognito chats • Law Society of Ontario: Using technology (artificial intelligence resources) • College of Physicians and Surgeons of Ontario: Advice to the Profession, Using Artificial Intelligence in Clinical Practice • Get Cyber Safe: How cyber criminals are using artificial intelligence (AI) for online threats • Canadian Centre for Cyber Security: What is voice phishing (vishing)? ITSAP.00.102 • Canadian Anti-Fraud Centre: Bulletin, Fraud using Deepfakes