Where Does Your Business Data Actually Go When You Use AI?
Privacy and data protection is the most cited barrier to AI adoption on both sides of the Tasman. In Australia 39% of businesses named privacy and security, higher than the equivalent figure in the US, UK and Canada. In New Zealand it sits alongside limited time at the top of the list. This is usually written up as a problem of perception, something to be reassured away. It is not. It is a reasonable question that most vendors answer badly, and it has a real answer.
The three places your data can end up
When you put text into an AI tool it can end up in three materially different places. It can be processed and discarded, which is what a properly configured API call does. It can be retained for a period, typically for abuse monitoring, then deleted. Or it can be retained and used to train future models, which means fragments of it may surface elsewhere. These are three different risk profiles and they are frequently discussed as though they were one. Most consumer chat products default toward the third. Most business API tiers default toward the first. The difference is a configuration and a contract, not a property of AI.
Training on your data is a setting, not a law of nature
That is the single most useful thing to understand: whether your data trains a model is a setting. It is chosen, by you or by whoever built your system, and it can be verified. Any vendor unwilling to state plainly which of the three applies to your data, in writing, has told you something. When we build, that decision is made explicitly at the start and written down, because retrofitting it after the fact usually means rebuilding.
What data sovereignty means in practice
Data sovereignty is the next layer and it is about geography rather than training. It asks which country your data physically sits in and which legal regime therefore reaches it. For a New Zealand business handling customer records under the Privacy Act 2020, or an Australian business under the Australian Privacy Principles, that is not an abstract concern. It determines who can compel access. The practical answer is to keep the system of record in your control and let the model see only what it needs for the task in front of it, which is an architectural choice made when the thing is designed.
Retrieval keeps the knowledge without shipping the archive
The technique that resolves most of this is retrieval. Instead of sending your whole archive somewhere to be absorbed, you keep the documents where they are, and at question time the system fetches the handful of relevant passages and shows only those to the model. Your knowledge base stays yours, nothing is uploaded wholesale, and the answer still cites the source. That is what RAG search and an AI knowledge base mean in practice, and it is the default shape for anything we build that touches internal documents.
The questions worth asking any AI vendor
Five questions will separate a serious vendor from a reseller. Is my data used to train models, yes or no, in writing. Which country is it stored in. How long is it retained and who can access it during that window. If I leave, what happens to it. And can you show me the data flow, not the marketing diagram. Anyone building production AI should be able to answer all five without checking. Ours are set out on the responsible AI page.
The businesses hesitating over privacy are not being timid, they are asking the question that most AI buyers skip and then regret. It has good answers. If you want yours looked at specifically rather than generically, get in touch and we will map where your data would actually go.
Ready to put AI to work in your business?
We find the one workflow costing you the most time or the most leads, ship it into production, and prove what it saved. Businesses across New Zealand.
Citation
@online{kiwidynamics2026wheredoesyourbusinessdataact,
author = {Kiwi Dynamics},
title = {Where Does Your Business Data Actually Go When You Use AI?},
date = {2026-08},
year = {2026},
url = {https://kiwidynamics.co.nz/blog/where-does-your-business-data-actually-go},
}Was this helpful?
Thanks, that helps.
Related content
-
The Missing Role Blocking AI Projects in NZ and Australia
Research into Australian AI adoption names an acute shortage of "AI Translators", people who understand both the technology and the operation. That gap, not the technology, is why most AI projects stall.
Read more -
What a $76 Billion AI Economy Means for an Ordinary Kiwi Business
Generative AI could add up to $76 billion to the New Zealand economy by 2038. Translating a national forecast into what it changes for a business of ten people.
Read more -
Tino Rangatiratanga Evals: a benchmark for tikanga grounding
Existing benchmarks measure whether a model knows facts about te ao Maori. They do not measure whether it behaves according to tikanga. Tino Rangatiratanga Evals is the benchmark we built to test that.
Read more