Protecting Client Information When Using AI.
AI can save property managers considerable time, but tenancy and landlord records contain information that should not be casually copied into an AI tool. Good AI use starts with minimising personal information, using approved systems and giving the AI only what it actually needs to complete the task.
Property managers work with a large amount of personal information.
Names.
Addresses.
Phone numbers.
Bank details.
Identification documents.
Financial information.
Applications.
Tenancy histories.
Email conversations.
Inspection photographs.
When AI becomes part of the working day, it can be very easy to copy information from a file, paste it into an AI tool and ask for help.
That is where PMs need to be careful.
Do not give AI more information than it needs.
One of the simplest rules is:
If the AI does not need the information to complete the task, leave it out.
If you want help drafting an email about delayed maintenance, the AI probably does not need:
the renter's full name
date of birth
phone number
email address
bank details
identification
complete tenancy application
full property file
It may only need:
Renter reported leaking shower three weeks ago. Contractor has recommended repairs. Landlord approval remains outstanding. Draft a professional update.
The result can be just as useful with far less personal information.
Remove identifying details where possible.
Often you can replace identifying information with simple descriptions.
Instead of:
Sarah Jones at 24 Smith Street, Richmond
use:
the renter
or:
the property
Instead of providing the landlord's name, simply use:
the landlord.
You can add names and property details back into the final communication afterwards.
Be especially careful with sensitive information.
Some information requires much greater care.
Avoid unnecessarily putting information into AI tools relating to matters such as:
health information
financial records
identification documents
bank details
information about children
personal circumstances
sensitive application information
The OAIC recommends, as a matter of best practice, that organisations do not enter personal information, particularly sensitive information, into publicly available generative AI tools because of the privacy risks involved.
Do not paste entire files because it is convenient.
A PM may only need help with one paragraph, but copying an entire:
tenancy application
email history
condition report
tribunal file
landlord record
renter profile
can expose far more information than is necessary.
Extract the relevant facts first.
Then give AI only what it needs.
Understand which AI tool you are using.
Not every AI service handles information in the same way.
Before an agency approves an AI tool, it should understand things such as:
what happens to information entered into it
whether information is retained
who may have access to it
whether data may be used to improve or train models
what security controls exist
whether administrators can control data use
how information can be deleted
where data may be processed or stored
The OAIC recommends organisations conduct due diligence before adopting commercially available AI products and consider privacy, security, access and human oversight.
This is an agency-level decision, not something every PM should have to investigate individually.
Use agency-approved AI tools.
A property management business should ideally have a clear position on which AI tools staff can use.
That might include approved versions of:
ChatGPT or similar AI assistants
AI features inside existing PM software
AgentCentre AI Tools
transcription tools
email assistants
meeting tools
automation platforms
Having approved tools reduces the risk of staff independently signing up for different free AI services and entering client information without understanding how it will be handled.
Be careful with email threads.
Long email threads are particularly easy to paste into AI.
They can also contain far more information than expected.
Before using AI to summarise a thread, check for:
contact details
signatures
forwarded emails
banking information
personal circumstances
unrelated conversations
attached documents
confidential information
Remove anything the AI does not need.
Inspection photos also contain information.
Photos should not automatically be treated as harmless.
They may show:
people
family photographs
documents
medication
personal belongings
computer screens
vehicle registration
other identifying information
Think before uploading inspection photographs or videos into an AI system.
Use only what is necessary for the task.
AI output can create privacy issues too.
Privacy is not only about what goes into the AI.
It can also involve what comes out.
AI may:
incorrectly attribute information to someone
combine facts inaccurately
make unsupported assumptions
infer information that was never provided
create statements about an identifiable person that are wrong
The OAIC specifically notes that AI-generated or inferred information about an identifiable person can itself be personal information.
That makes human review particularly important.
Check the facts before putting AI output into the file.
Imagine AI summarises a long email thread and incorrectly states:
The renter admitted causing the damage.
If that statement is then copied into the property record without checking the original emails, an AI mistake has become part of the agency's records.
Always verify:
names
dates
amounts
instructions
allegations
decisions
statements attributed to individuals
AI summaries are useful working tools.
They should not automatically become the official record.
Be transparent about how AI is being used.
Agencies using AI with personal information should also consider whether their privacy policy, collection notices and internal procedures properly explain that use.
The OAIC recommends organisations be transparent about how personal information is handled in connection with AI and establish appropriate policies and procedures.
This is worth reviewing at an agency level rather than leaving individual PMs to make their own decisions.
Create a simple internal AI rule.
Property management teams do not need a 40-page AI policy before they can use AI sensibly.
A useful starting rule might be:
Use approved AI tools. Provide the minimum information required. Remove identifying information where possible. Do not enter sensitive information unless the agency has specifically approved that use. Always review the output before using it.
That single rule prevents many of the obvious risks.
A safer way to prompt.
Instead of:
Write an email to John Smith at 18 Victoria Street. He owes $2,860, his phone number is 04XX XXX XXX and I have attached his tenancy ledger.
try:
Draft a professional email to a renter regarding outstanding rent. The current amount outstanding is $2,860. Explain that we need to discuss the situation and ask them to contact the agency. Keep the tone clear and professional.
Add the identifying information afterwards in your normal system.
The AI does not need to know who the person is.
Before putting client information into AI, ask five questions.
1. Does the AI actually need this information?
If not, remove it.
2. Can I remove the person's identity and still get the same result?
Usually, yes.
3. Is this an agency-approved AI tool?
If you do not know, check.
4. Does this include sensitive or confidential information?
If it does, stop and consider whether it should be used at all.
5. Will a person check the result before it is used?
They should.
AI should reduce work, not create a new privacy risk.
Property managers do not need to avoid AI.
There are plenty of useful applications that require little or no personal information.
The safest approach is to use AI for the task, not give it the entire file.
Give it the facts it needs.
Remove what it does not need.
Use approved tools.
Check the output.
That allows PMs to gain much of the time-saving benefit of AI without unnecessarily exposing landlord or renter information.