Privacy & AI at Woodhill Digital AI.

When we talk about AI, we’re always talking about people first. Your customers, your team, and your reputation all depend on how well you look after information. Our job is to help you use AI and digital tools without losing control of your data or breaching New Zealand privacy expectations.

We design every project to respect the Privacy Act 2020 and the Privacy Commissioner’s guidance on AI, in a way that’s practical for New Zealand small and medium‑sized businesses.

How we think about privacy and AI

Whenever AI tools touch personal information, the usual privacy rules still apply. That means:

• The Privacy Act 2020 and the 13 Information Privacy Principles (IPPs) continue to govern how information is collected, used, stored, and shared.

• You remain responsible for privacy, even if a third‑party AI tool is doing some of the processing.

We help you slow down long enough to ask the key questions before turning anything on:
What information are we putting into this tool, where does it go, who can see it, and is that appropriate?

Our privacy commitments when using AI

When we recommend, configure, or support AI tools, we follow a few simple commitments:

• Privacy by default
  We assume your customer and staff data is confidential and treat it accordingly. We only use personal information in AI systems where it’s clearly needed for a defined purpose.

• Minimum necessary data
  We minimise the personal information sent into AI tools and avoid especially sensitive data unless there is a clear, agreed reason and appropriate safeguards.

• Transparency and plain language
  We help you explain, in simple terms, how AI is used in your business and what it means for people whose data you hold. This aligns with the Commissioner’s expectation of clear, accessible information for individuals.

• Security and retention
  We prefer tools with strong security practices and help you set access controls, retention periods, and deletion practices that match your risk level and obligations.

• Right‑sized privacy checks
  For meaningful or ongoing AI use that involves personal information, we encourage a simple, fit‑for‑purpose Privacy Impact Assessment (PIA) and help you work through it.

How we work with your data in practice

On real projects, this looks like:

• Mapping what data will flow into AI tools (for example, CRM records, emails, form submissions) and where it is processed or stored.

• Avoiding copy‑pasting confidential business documents or customer records into “free” AI tools without first checking the terms and risks.

• Using configuration settings (like data retention, logging, and access roles) to limit who can see what and for how long.

• Keeping simple documentation, so if a customer or staff member asks “what are you doing with my info?”, you can give a clear, confident answer.

If you already have internal privacy policies, we work inside them. If you don’t, we help you set some straightforward guardrails that make sense for your size and sector.

Your responsibilities, our support

You remain the “agency” or organisation responsible for complying with the Privacy Act 2020, including when you use AI tools.
Our role is to:

• Make you aware of the privacy implications of the tools you choose.

• Help you design processes that align with the Information Privacy Principles, especially around collection, use, disclosure, security, and access.

• Keep the whole thing understandable, so you can make informed decisions instead of guessing.

We don’t provide legal advice, but we do help you ask the right questions and, where needed, point you toward official guidance from the Privacy Commissioner.

If you’re worried about AI and privacy

If you’ve been hesitant to try AI because of privacy risks, you’re not alone. The good news is that with some simple design choices and clear boundaries, most NZ SMEs can safely use AI for things like drafting content, basic automation, and reporting while staying onside with the law.

We can walk through:

• Where AI does and doesn’t make sense in your business

• What data should never go into certain tools

• How to explain your AI use to customers and staff

If you’d like to explore AI but keep privacy front and centre, get in touch and mention “Privacy & AI” in your message. We’ll start with a short, no‑obligation chat about your current tools, your risks, and your options.