If you run a small business in Australia and your team has started using Claude, security is probably somewhere on your worry list. You do not have time for a forty-page policy, and you should not need one. This is the five-minute version: what to check, what stays private, and the handful of rules worth setting before the tool spreads further across your business.
The stakes are real but manageable. The Australian Small Business and Family Enterprise Ombudsman has put the average cost of a cyber incident for a small business at around $49,000, and most of that damage comes from ordinary mistakes rather than sophisticated attacks. Good habits with an AI assistant cost you nothing and remove a surprising amount of that risk.
Start with the one question that matters
Before anything technical, answer this: what does your team actually paste into Claude? For most small businesses the honest answer is client emails, draft quotes, spreadsheets, and the occasional contract. That tells you exactly where your exposure sits. Security for a small business is not about firewalls and jargon. It is about knowing what information leaves your building and where it goes.
Once you can name the sensitive material your team handles day to day, every other decision gets simpler.
The five-minute check
Sit down with whoever set up Claude for your business and walk through these five points. None of them needs a technical background.
Which plan are you on? A paid business plan (Team or Enterprise) is built for company use, with admin controls and clearer data terms than a personal account. If your staff are logging in with personal free accounts, that is the first thing to fix.
Is training on your data switched off? Check the data settings for your plan and confirm your conversations are not being used to improve the model. On the business tiers this is the standard arrangement, but confirm it rather than assume it.
Who has access? Every person with a login is a door into your account. Remove former staff promptly, and give each person their own login rather than sharing one.
What are people pasting? If tax file numbers, bank details, or health information are going into any tool, you need a written rule about it. More on that below.
Where do the outputs go? A draft Claude writes is only as safe as the email or document it lands in. The AI step is rarely the weak link; the human copy-and-paste afterwards usually is.
If you can answer those five points honestly, you are already ahead of most businesses your size.
What actually stays private
Owners often ask a fair question: when my team types something into Claude, who can see it? A useful mental model is that a business-grade AI account behaves like a professional supplier you have a contract with, not like a public website. On the paid business tiers, your inputs are used to give you an answer, not to train the model or feed anyone else's results. Even so, you should read the terms for the specific plan you are paying for rather than take a blog's word for it, because the details differ between a personal account and a company one.
We are deliberately careful here. There are things a responsible consultant will not promise you: that no employee will ever paste something they should not, that a password will never be reused, or that any tool is immune to human error. Security is a set of habits, not a guarantee you can buy.
Three rules worth writing down
You do not need a policy document. You need three sentences your team can remember. Here is a starting point you can adapt for a Sydney cafe, a Brisbane trades business, or a professional services firm.
Never paste a full identity document, bank account, or medical record into any AI tool. If a task genuinely needs that data, do it the old way or ask first.
Use your work login only, and turn on two-factor authentication. A shared password in a group chat is how most small business breaches actually start.
Treat AI output as a draft, not a decision. A human checks anything that goes to a client, a regulator, or the tax office before it is sent.
Three rules on a printed page beside the till, or pinned in your team chat, will do more for your security than most of the software people try to sell you.
Where the Privacy Act fits in
If your business turns over more than $3 million a year, or handles health information, you already have obligations under the Privacy Act, and using an AI tool does not change them. The principle is the same one you follow with a filing cabinet: you are responsible for the personal information you collect, wherever you store or process it. Using Claude to draft a client reply is fine. Feeding a spreadsheet of customer records into any tool without thinking about consent and storage is where owners get into trouble.
For a smaller business under the threshold, the law is lighter, but your customers' trust is not. Losing a client's data costs you the client, whatever the regulator says.
A sensible next step
Most small businesses do not need a security project. They need one afternoon to set up business logins properly, confirm the data settings, and write those three rules down. Do that and you have closed the gap that causes the majority of incidents for firms your size.
If you would like a second set of eyes on how your team is using Claude, or help turning these habits into a one-page policy your staff will actually follow, you can book a short call with our Sydney team through our contact page.
