Can your SaaS use customer data to train its AI models?

Many SaaS companies now want to use what their product sees, such as documents, tickets, transcripts and usage logs, to train or fine-tune AI models. Customers increasingly ask the opposite question in procurement: will our data be used to train your models? Both questions have the same starting point.

This post is general information, not legal advice.

Start with your contracts

Before privacy law, look at what you’ve already promised.

• Customer agreement. Read the “Customer Data” clause in your SaaS agreement or terms of service. Many limit the vendor to using customer data to provide the service. Some allow use “to improve the services,” which may or may not stretch to training models that benefit other customers.
• Data processing agreement. If you’ve signed a data processing agreement acting as a service provider to your customer, you’ve usually agreed to process personal information only on the customer’s instructions. Using it for your own model development is a different purpose.
• Enterprise paper. Large customers often add express prohibitions on AI training in their own templates or security addenda.
• Your privacy policy and marketing. Statements like “we never use your data to train AI” bind you in practice, and misleading statements can raise Competition Act issues too.

Changing your terms going forward doesn’t automatically cover data you collected under the old terms. Check how your agreement handles amendments.

Then privacy law

If the data includes personal information, PIPEDA applies to your commercial use of it. In outline:

• Purpose. You must identify the purposes for collection at or before the time you collect, and a new purpose, such as model training, generally needs fresh consent. Section 5(3) limits you to purposes a reasonable person would consider appropriate in the circumstances.
• Consent. Consent must be meaningful. The OPC’s guidance expects you to make the key elements prominent, including uses people wouldn’t reasonably expect. Training a general model on users’ content is likely to be one.
• Service provider role. If your customer collected the information and transferred it to you for processing, your customer remains responsible for it under PIPEDA, and your use is limited to the purposes the transfer was for.

The OPC’s December 2023 principles for generative AI stress legitimate purposes, consent, openness and limiting the personal information used in training. For Quebec users, Quebec’s private sector law, as amended by Law 25, adds its own rules on purposes, consent and the use of de-identified and anonymized information.

Does de-identification solve it?

It helps, but it isn’t a blanket answer. Under PIPEDA, information can still be personal information if there’s a serious possibility that someone could be identified from it, alone or combined with other available information (Gordon v. Canada (Health), 2008 FC 258). Free-text documents, transcripts and images are especially hard to de-identify reliably, and models can sometimes reproduce training data. Quebec law distinguishes de-identified information, which is still personal information, from anonymized information, which must meet a higher standard. Since May 30, 2024, Quebec’s Regulation respecting the anonymization of personal information requires a documented re-identification risk analysis (looking at whether a person could be singled out, linked across datasets or inferred), a conclusion that the residual risk is very low, periodic reassessment and, since January 1, 2025, a register of anonymized information.

Aggregated usage metrics, such as feature clicks and error rates, carry less risk than customer content.

Choosing a position

There’s no single right answer. Common positions are:

1. No training on customer content. Simplest to sell to enterprise customers. You can still use aggregated, non-identifying service data to run and improve the service.
2. Opt-in. Customers who want a better model for their own account, or who accept shared improvements, can turn training on.
3. Opt-out. Training is on by default, with a clear setting to turn it off. This is more likely to meet resistance from business customers and needs careful privacy disclosures for individual users.
4. Customer-specific models. Fine-tuning that benefits only the customer whose data was used, with no cross-customer use.

Whichever you choose, say it plainly in your terms, your privacy policy, your AI product terms and your security documentation, and make sure your engineering pipeline actually enforces it.

A checklist before you train

• Read your customer agreement, DPA and any enterprise addenda for limits on use.
• Identify whether the data includes personal information, and whose.
• Decide your position and update your terms and privacy policy to match.
• Give notice of changes and get consent where the law requires it.
• Keep training data separate by customer and record what went into each model.
• Set retention rules for training sets and a way to honour opt-outs.
• Check your sub-processors, including model providers, for their own training terms.

We prepare AI product terms, SaaS agreements and privacy policies at fixed fees, listed on our fees page. To talk through your training data plans, book a free 15-minute consult.