AI Data Security: How Canadian Businesses Can Use AI Tools Without Leaking Company Data

Short answer: AI data security means controlling what company information goes into AI tools, what the vendor can do with it, and what the tool can reach or do once it is connected to your systems. For most Canadian businesses, the fixes are not exotic. Use business accounts that don’t train on your data. Set a simple rule about what may never be pasted into a prompt. Fix file permissions before you switch on an assistant that searches them. Treat AI vendors as service providers under PIPEDA and, in Quebec, Law 25. If you build AI features into your own website, keep keys, logs and data on infrastructure you control.

AI has moved from experiment to routine work in Canada. In Statistics Canada’s second-quarter 2026 survey, 19.2% of businesses said they had used AI to produce goods or deliver services in the previous 12 months, up from 12.2% a year earlier and 6.1% in 2024. The same survey found that cybersecurity and privacy concerns were the barrier businesses named most often, ahead of cost.

Those concerns are reasonable. Every prompt, uploaded spreadsheet and connected mailbox is a new path for company data to leave the building. This guide explains how those leaks happen, what the main AI vendors say they do with your data, what Canadian privacy law expects, and the controls that close the gaps, ending with a 30-day plan. It is general information, not legal advice; if you handle health, financial or children’s data, confirm the details with a privacy lawyer.

Why AI data security is now a business problem in Canada

Three sets of numbers explain why this has moved up the agenda.

Adoption is rising fast, and so is caution. Statistics Canada’s survey, released June 11, 2026, drew 9,251 responses. Among businesses that used AI, the most common uses were data analytics (36.6%), text analytics (34.5%), chatbots (28.2%) and large language models (24.8%). Cybersecurity or privacy concerns were the top barrier at 13.4%, rising to 30.0% among businesses with 100 or more employees. One caveat matters here: the survey asks about AI used to produce goods or deliver services. It may not capture an employee pasting a contract into a free chatbot on their lunch break, which is exactly where many leaks start.

Unapproved AI is now a measurable cause of breaches. IBM’s Cost of a Data Breach Report 2026, based on research by the Ponemon Institute, found that security incidents involving “shadow AI” (workers using AI tools the company hasn’t approved) more than doubled, to 43% from 20% the year before. Those incidents cost more, averaging USD 5.39 million against USD 4.63 million a year earlier. In 49% of them, data was lost or compromised. Among organisations that had an AI-related breach, 92% lacked proper AI access controls, such as role-based access and multi-factor authentication.

Breaches in Canada are expensive. IBM Canada reported in July 2026 that the average cost of a breach for Canadian organisations reached a record CA$7.11 million, with an average breach lifecycle of 205 days. Twenty-eight per cent of Canadian organisations reported an AI-generated attack. For a wider picture of the threats Canadian sites face, see these Canadian website security statistics.

How company data leaks through AI tools

There are at least seven leak paths, and each needs a different control.

1. Prompts and uploads leave your network

When someone types into a cloud AI tool or uploads a file to it, that content is sent to the vendor’s servers, processed there and usually stored, at least for a while. This is a disclosure to a third party, even if nobody outside the vendor ever sees it. For personal information, Canadian law treats this as a transfer to a service provider, which brings obligations covered below.

2. Consumer accounts may use your chats to train models

Free and personal plans are often set up differently from business plans. OpenAI, for example, says content in ChatGPT Free, Plus and Pro may be used to improve its models unless the user opts out, while ChatGPT Business, Enterprise and its API are not used for training by default. Anthropic changed its consumer terms in 2025 so that Claude Free, Pro and Max users choose whether their chats are used for training. Training on a chat does not mean the model will repeat it word for word to another user. But once data is in a training set, you can’t pull it back out.

3. Retention and human review

Even when a chat is not used for training, it may be kept. Google’s Gemini Apps privacy hub tells users that human reviewers may read some conversations and says plainly: “Please don’t enter confidential information that you wouldn’t want a reviewer to see.” It says conversations reviewed by people can be kept for up to three years. Stored chats can be breached, reviewed or demanded in a legal or access request.

4. Connected assistants inherit your oversharing

Assistants that plug into your email, files and chat create a different risk. Microsoft says Microsoft 365 Copilot only shows users data they already have at least view permission for. That is the right design, but it means every overshared SharePoint folder or “anyone with the link” file becomes searchable in plain language.

5. Prompt injection

A prompt injection is an instruction hidden in content the AI reads, such as a web page, email, PDF or support ticket, that makes the model ignore its original instructions. It is number one on the OWASP Top 10 for LLM Applications. The Canadian Centre for Cyber Security warns that injected instructions can make an assistant send data out, for example by embedding it in the address of an image the tool then loads. Its advice includes limiting the AI’s ability to communicate externally.

6. Agents that can act, not just answer

AI agents can browse, send email, edit files or call other systems. If one is tricked or simply wrong, it can do damage at machine speed. OWASP calls this “excessive agency”. Joint guidance published by the Cyber Centre and its international partners on agentic AI advises starting with low-risk, non-sensitive tasks and applying strict access controls.

7. Wrong answers become your answers

Data security also covers the integrity of what AI produces. In Moffatt v. Air Canada (2024 BCCRT 149), British Columbia’s Civil Resolution Tribunal held the airline responsible after its website chatbot gave a customer wrong information about bereavement fares. The tribunal called the idea that the chatbot was “a separate legal entity” a “remarkable submission” and found the airline “did not take reasonable care to ensure its chatbot was accurate.” The award was small (about $650 in damages), but the principle is clear: if AI speaks for your business, you own what it says.

Consumer vs business AI accounts: what vendors say they do with your data

The single most effective step for most businesses is moving staff from personal AI accounts to business accounts with data protection terms. The table summarises what each vendor’s own documentation said when we checked in November 2026. Terms change often, so re-read them before you sign anything.

Two lessons come out of this table. First, the difference between a personal and a business account is often the difference between “may train on your data” and “won’t”. Second, “not used for training” is not the same as “not stored” or “stays in Canada”. Ask each vendor where data is processed, how long it is kept and who can access it.

If you are still deciding which tools to standardise on, this overview of AI tools for productivity is a useful starting list. Check each tool against the questions above before you approve it.

Classify before you prompt: a traffic-light rule

Policies fail when they are too long to remember. A three-colour rule is easy to teach and easy to check.

This lines up with what Canada’s privacy regulators ask of AI users. The Office of the Privacy Commissioner of Canada (OPC) and its provincial counterparts advise that, “where possible and reasonable,” people use anonymised or de-identified information in prompts, and enter personal or confidential information only where authorised to do so.

A practical habit helps: before pasting, replace names, emails, account numbers and addresses with placeholders such as [CLIENT A] or [ACCOUNT 1]. In most cases, the AI’s answer is just as useful.

What Canadian privacy law expects when staff use AI

Canada does not yet have an AI-specific law in force for private businesses. The proposed Artificial Intelligence and Data Act died with Bill C-27 when Parliament was prorogued in January 2025. But existing privacy law already applies to AI use whenever personal information is involved.

PIPEDA: you stay accountable

Under the Personal Information Protection and Electronic Documents Act (PIPEDA), which covers private-sector organisations in most provinces, sending personal information to a vendor for processing is allowed. The OPC’s guidance on cross-border processing says directly that “PIPEDA does not prohibit organizations in Canada from transferring personal information to an organization in another jurisdiction for processing.”

The catch is accountability. PIPEDA’s principle 4.1.3 says you remain responsible for personal information you transfer to a third party, and you must use contractual or other means to provide “a comparable level of protection” while it is being processed. In practice, for an AI vendor, that means:

• A signed agreement or data processing addendum that limits use of your data to providing the service
• Clear terms on training, retention, deletion and sub-processors
• Security commitments you can point to, such as an independent audit report
• Telling customers in your privacy notice that their information may be processed by service providers, possibly outside Canada

A consumer account accepted by an employee with a click usually gives you none of this. That is the legal case for business accounts.

Breaches involving AI tools are still breaches

If personal information is exposed through an AI tool, for example a chat history leak or an agent that emails a customer list to the wrong place, PIPEDA’s breach rules apply. The OPC says organisations must report breaches that create a “real risk of significant harm” to the OPC, notify affected individuals as soon as feasible, and keep a record of every breach of security safeguards for two years, including ones that don’t meet the reporting threshold. Add AI tools to your incident response plan so staff know that “I pasted the wrong file into a chatbot” is something to report, not hide.

The regulators’ own principles for generative AI

In December 2023, the OPC and provincial and territorial privacy authorities published principles for responsible, trustworthy and privacy-protective generative AI. Two points matter for businesses that use AI tools. First, the regulators state that inferences an AI makes about a person count as personal information. Second, they call for privacy impact assessments before higher-risk uses and set out “no-go zones”, such as unlawful collection of personal information and profiling that leads to discriminatory treatment. They also anticipate others, such as generating false or defamatory information about identifiable people.

These principles are not theoretical. In May 2026, the OPC, Quebec’s Commission d’acces a l’information and the privacy commissioners of British Columbia and Alberta released findings from their joint investigation into OpenAI. They found that the early training of ChatGPT did not meet Canadian privacy requirements on consent, collection, accuracy and individuals’ access to their information. The federal finding was conditionally resolved based on commitments from OpenAI. The lesson for businesses is that Canadian regulators are actively examining how AI systems handle personal information.

Quebec’s Law 25 goes further

If you collect personal information from people in Quebec, Quebec’s private-sector privacy act, as amended by Law 25, adds specific duties that bite on AI projects:

• Privacy impact assessment for new systems (section 3.3). You must conduct one for any project to acquire, develop or overhaul an information system or electronic service delivery system involving personal information. Rolling out an AI assistant that reads customer files fits this description.
• Assessment before data leaves Quebec (section 17). Before communicating personal information outside Quebec, including to an AI vendor’s servers elsewhere in Canada or abroad, you must conduct a privacy impact assessment. The transfer can go ahead only if the information would receive adequate protection, and it must be covered by a written agreement.
• Written mandates for service providers (section 18.3). Contracts must set out how the provider protects the information and that it may only be used for the mandate.
• Automated decisions (section 12.1). If you use AI to make a decision about a person based exclusively on automated processing, such as rejecting an application, you must tell them, and on request explain the main factors and give them a chance to submit observations to someone who can review the decision.
• Confidentiality incidents (sections 3.5 to 3.8). Incidents with a risk of serious injury must be reported promptly to the Commission d’acces a l’information and to affected people, and all incidents must be recorded in a register.

Penalties are significant. Administrative monetary penalties can reach $10 million or 2% of worldwide turnover, and penal fines up to $25 million or 4%, whichever is greater.

What may change: Bill C-36

In June 2026, the federal government introduced Bill C-36, which would replace the privacy part of PIPEDA. As introduced, it includes rights related to automated decision-making and a requirement to assess privacy impacts before personal information is transferred outside Canada. It is not law yet, and its wording may change as it moves through Parliament. Check its status on LEGISinfo before relying on any part of it. If you are already following the steps in this guide, you will be well placed whatever the final version says.

Build an AI acceptable use policy people will actually follow

Banning AI rarely works. IBM’s research on shadow AI suggests that when approved tools are missing, people find their own. A short, practical policy with a good approved option does more. The Cyber Centre’s top 10 AI security actions recommend exactly this kind of governance: map which AI tools are sanctioned and unsanctioned, publish an acceptable use policy, and keep allow and deny lists.

A workable policy fits on two pages and answers these questions:

1. Which tools are approved? Name them, and the account type (for example, “ChatGPT Business through your company login, not a personal account”).
2. What data can go where? Include the traffic-light table above.
3. Who approves new tools? One named person or role, with a quick turnaround so people don’t route around it.
4. What about browser extensions, meeting recorders and AI features inside other apps? These are easy to miss. Note-takers that join calls and summarisers in email clients see sensitive data too.
5. Who checks AI output? Anything sent to a customer, published, or used to make a decision about a person needs human review.
6. When must AI use be disclosed? For example, on customer-facing chatbots, or when a decision about a person is automated.
7. How do you report a mistake? Make reporting easy and blame-free. A quick report is what lets you meet breach timelines.
8. What happens when someone leaves? Remove their access to AI accounts, connectors and agents with everything else.

Review it every six months; vendor terms change faster than most policies.

Technical controls that stop AI data leaks

Policy sets expectations; controls catch the mistakes. Roughly in order of value for effort:

Centralise accounts with single sign-on and MFA. Buy business plans, connect them to your identity provider, and require multi-factor authentication. You get one place to grant and remove access, and you can see who is using what. This addresses the access control gap IBM found in 92% of organisations with AI-related breaches.

Turn off training and set retention. In each tool’s admin console, confirm that training on your data is off, set the shortest retention that works, and decide whether chat history can be shared or exported.

Fix permissions before you connect an assistant. Run a sharing report on your file storage. Remove “anyone with the link” access to sensitive folders, and tighten groups that have grown too wide. Then connect the assistant, starting with a pilot group.

Use data loss prevention where you can. Many business email and storage suites can detect patterns such as credit card or social insurance numbers. The Cyber Centre recommends data loss prevention and scrubbing secrets from what goes into AI systems. Some tools can warn or block when sensitive patterns are pasted into an AI site.

Keep logs. Keep audit logs of prompts and actions for business AI tools where the plan supports it, and make sure someone looks at them. Logs are how you find out what happened after a mistake.

Limit what agents can do. Give AI agents the minimum access they need, require human approval for actions such as sending email or making payments, and keep a way to switch them off quickly. The Cyber Centre’s guidance recommends human-in-the-loop controls and kill switches for exactly this reason.

Verify unusual requests out of band. AI makes convincing voice and video impersonation cheap. The Cyber Centre points to a case in early 2024 where a British engineering firm lost millions after criminals used AI-powered deepfakes of senior staff. Require a callback on a known number before any payment change or urgent transfer.

Securing AI features on your own website or app

Many businesses now add AI to their own sites: a support chatbot, smart product search, or a tool that summarises documents for clients. Here you are no longer just a user of AI. You are the operator, and the OWASP Top 10 for LLM Applications becomes your checklist. The points that matter most for a small team:

• Keep API keys on the server. Never put an AI provider’s key in browser JavaScript or a mobile app. Call the model from your server, store the key in an environment variable or secrets manager, and rotate it if it is exposed.
• Don’t put secrets in the system prompt. OWASP lists system prompt leakage as its own risk. Assume users can get the model to reveal its instructions.
• Treat model output as untrusted input. Escape it before showing it, and never pass it straight into a database query, shell command or email without checks. OWASP calls this improper output handling.
• Control what retrieval can reach. If your chatbot searches documents (often called RAG), make sure it only searches documents the current user is allowed to see. Vector databases need access controls too.
• Limit tools and actions. If the chatbot can look up orders, give it read-only access to that one function, not your whole database.
• Rate-limit and cap spending. OWASP’s “unbounded consumption” covers both abuse and runaway bills. Set per-user limits and a billing cap with your AI provider.
• Minimise and log. Send the model only what it needs. Log requests and responses on your own server, redact personal information where possible, and set a retention period.
• Test what it says. After Moffatt v. Air Canada, assume that what your chatbot promises, you promise. Test it against your real policies, show a clear notice that it is an AI assistant, and give people an easy way to reach a human.

For ongoing checks, pair this with general hardening. 4GoodHosting’s guides to website security best practices and securing a server step by step cover the foundations, and its walkthrough on monitoring server logs explains how to spot unusual activity, such as a sudden burst of chatbot requests.

Where your hosting fits

Your hosting choice doesn’t make a third-party AI service private. If your site sends prompts to a model provider, that provider’s terms and server locations still apply. But hosting does decide where everything around the model lives: the application code, the API keys, request logs, uploaded files, and the document index your chatbot searches. Keeping those on Canadian servers you control limits how many places your data sits, and makes your privacy notices and Law 25 assessments simpler to write.

It also opens a second option: running an open-weight model yourself, so prompts never leave your server. That suits narrow jobs such as classifying support tickets or searching internal documents. It needs more memory, and often more processing power, than a typical website. 4GoodHosting’s guide to AI hosting for small business explains which AI workloads run on a Linux VPS and which need more. Its Canadian dedicated servers page describes GPU-ready computing for AI and machine learning workloads, and private networking that keeps internal traffic off the public internet. Confirm GPU availability and configuration with its team, since the published plan comparison lists CPU configurations.

When you assess any host for AI-related work, ask the same questions you would ask an AI vendor: where is data stored, who can access it, and will it be used for anything else? 4GoodHosting publishes its answers on its security practices page. It states that its web servers are in Vancouver and Toronto, that it does not host customer data outside Canada, and that it does not use customer personal information or hosted content to train AI or machine learning models, or provide that data to third-party AI providers. For how responsibility is split between you and a provider, its guide to enterprise cloud security in Canada covers shared responsibility and data residency in more depth. If privacy at the hosting layer is your main concern, see this explainer on data privacy and WordPress hosting.

A 30-day AI data security plan

You don’t need a big project. Four weeks of focused effort covers most of the risk.

Week 1: Find out what is in use. Ask staff, without blame, which AI tools, extensions and meeting recorders they use and for what. Check your identity provider and expense reports for AI subscriptions. Write the list down.

Week 2: Pick approved tools and lock them down. Choose one or two business-grade tools that cover most needs. Connect them to single sign-on with MFA, turn off training, set retention, and sign the vendor’s data processing terms. Record where each vendor processes data.

Week 3: Publish the policy and train people. Share the two-page acceptable use policy and the traffic-light rule. Run a 30-minute session with real examples from your business. Add AI mistakes to your incident reporting process and breach register.

Week 4: Fix the plumbing. Run a file-sharing report and remove overly broad access before enabling any assistant that searches company data. If you have a website chatbot, check where its keys, logs and documents live, and test it against your actual policies. If you serve Quebec, complete privacy impact assessments for AI systems that handle personal information.

Then revisit the list and vendor terms every six months.

Frequently asked questions

Is it safe to use ChatGPT or other AI tools with company data?

It depends on the account and the data. Public information is generally fine in any approved tool. Internal information should go only into business accounts whose terms exclude training and set retention. Personal information about customers or staff, credentials and confidential documents should stay out of general AI tools unless the system has been specifically approved for that data.

Does PIPEDA allow us to use an AI tool hosted outside Canada?

Yes, PIPEDA does not prohibit transferring personal information outside Canada for processing. You remain accountable for it, need contractual protections that provide a comparable level of protection, and should be open with customers that their information may be processed in other countries. Quebec’s Law 25 adds a documented assessment and written agreement before personal information leaves Quebec.

What is shadow AI?

Shadow AI is employees using AI tools the organisation has not approved or does not know about, often on personal accounts. IBM’s 2026 research found that security incidents involving shadow AI more than doubled from the previous year. Giving staff a good approved tool is usually more effective than a ban.

Do we need a privacy impact assessment before using AI?

In Quebec, Law 25 requires one for projects to acquire or develop information systems involving personal information, and before personal information is communicated outside Quebec. Elsewhere in Canada, the privacy regulators recommend assessments for higher-risk AI uses. Even when not required, a short written assessment is good practice.

Can an AI chatbot on our website create legal liability?

Yes. In Moffatt v. Air Canada, a BC tribunal held a business responsible for wrong information its chatbot gave a customer. Test chatbot answers against your real policies, label the assistant clearly, and offer a route to a human.

Is running our own AI model safer than using a cloud AI service?

It keeps prompts and documents on servers you control, but makes you responsible for security, updates and access control, and needs more computing resources. Many businesses use a mix of self-hosted tools for sensitive data and business-grade cloud services for the rest.

Key Takeaways

• Statistics Canada found cybersecurity and privacy concerns were the barrier businesses named most often in Q2 2026. IBM found shadow AI incidents more than doubled.
• Personal and business AI accounts are often governed by different terms. Move staff to business accounts that exclude training and set retention.
• Use a traffic-light rule: public data anywhere approved, internal data in business accounts only, personal and confidential data never in general tools.
• Under PIPEDA you stay accountable for data you send to AI vendors. Quebec’s Law 25 adds privacy impact assessments, written agreements and rules on automated decisions.
• Fix file permissions before enabling assistants that search company data, and limit what AI agents can do without human approval.
• If you run AI on your own site, keep keys server-side, treat output as untrusted, log on your own infrastructure, and test what the chatbot says.

Sources

• Statistics Canada, Analysis on artificial intelligence use by businesses in Canada, second quarter of 2026
• IBM, Cost of a Data Breach Report 2026
• IBM Canada Newsroom, Canada’s Data Breach Costs Hit Record High (July 29, 2026)
• Canadian Centre for Cyber Security, Top 10 artificial intelligence security actions (ITSAP.10.049)
• Canadian Centre for Cyber Security, Generative artificial intelligence (ITSAP.00.041)
• Canadian Centre for Cyber Security, Careful adoption of agentic AI
• Office of the Privacy Commissioner of Canada, Principles for responsible, trustworthy and privacy-protective generative AI technologies
• Office of the Privacy Commissioner of Canada, Joint investigation of OpenAI: background (May 6, 2026)
• Office of the Privacy Commissioner of Canada, Guidelines for processing personal data across borders
• Office of the Privacy Commissioner of Canada, What you need to know about mandatory reporting of breaches of security safeguards
• Government of Quebec, Act respecting the protection of personal information in the private sector (P-39.1)
• Parliament of Canada, LEGISinfo: Bill C-36
• Civil Resolution Tribunal, Moffatt v. Air Canada, 2024 BCCRT 149
• OWASP GenAI Security Project, Top 10 for LLM Applications 2025
• NIST, AI Risk Management Framework and Generative AI Profile (NIST AI 600-1)
• CISA and partners, AI Data Security: Best Practices for Securing Data Used to Train and Operate AI Systems
• OpenAI, How your data is used to improve model performance and Enterprise privacy
• Anthropic, Updates to consumer terms and privacy policy
• Google, Gemini Apps Privacy Hub and Generative AI in Google Workspace Privacy Hub
• Microsoft Learn, Data, privacy, and security for Microsoft 365 Copilot

This article was written by the team at 4GoodHosting, a Canadian-owned web hosting company operating since 2002 with data centres in Vancouver and Toronto. This article is a guest contribution to P4 Emachines.