Can a SaaS provider reuse customer data to train an AI product?

A SaaS provider in Pakistan should not assume it can use all customer-uploaded information to train a commercial AI model merely because the data is stored on its servers. The answer depends on the customer agreement, ownership and confidentiality of the material, the lawful authority of the uploader, sector-specific duties and the nature of the proposed training. A distinction must be maintained between processing information to deliver the subscribed service and exploiting that information to improve or commercialise a separate product.

Define the data and intended processing

Start by identifying precisely what will be used for training: customer-entered prompts, documents, uploaded contracts, transaction records, customer contact lists, generated outputs or model telemetry. Each category may carry different ownership and sensitivity issues. A product team should map whether material is identifiable, commercially confidential or protected by copyright. Calling all content "usage data" in the terms of service does not resolve substantive rights.

The governing legal framework

Pakistan's Prevention of Electronic Crimes Act, 2016, as amended, addresses specified unauthorised activities concerning information systems and data. Contract Act obligations and confidentiality law may protect business information. Sector regulations can impose additional limits, particularly for financial and professional services. As of the available March 2026 legal surveys, Pakistan had not enacted a single general personal data protection law equivalent to the GDPR, although proposed legislation existed. The statutory position should be reverified before publication or implementation, and absence of a comprehensive act must not be mistaken for unrestricted permission.

Service processing versus secondary use

A customer subscribing to document analysis may authorise the provider to ingest documents, extract clauses and return results for that customer. It does not follow that the customer intended its confidential documents to become training examples for other users. Training is a separate purpose, with different retention and disclosure consequences. The contract should distinguish processing necessary to render services from optional secondary model improvement.

Who owns the uploaded content?

The uploading customer may own original documents or hold only a licence to use material belonging to clients, employees or other counterparties. The SaaS provider does not automatically receive ownership merely through upload. Determine whether the customer's authority extends to licensing training use. A corporate subscriber cannot validly waive third-party confidentiality or copyright rights it does not possess. The provider should preserve an express customer-content ownership clause.

Contractual training permission

A clear training licence should describe categories of content, permitted models, whether third-party processors receive it, retention and withdrawal mechanisms. Broad language saying the provider may use "all information for business purposes" can be disputed, especially where other clauses promise confidentiality. If training is optional, a genuine opt-in may reduce contractual uncertainty. Enterprise customers commonly expect default exclusion of confidential files from shared model improvement.

Confidential information and trade secrets

A document can be commercially sensitive even if it contains no personal information. Source code, undisclosed prices, technical designs, litigation strategy and customer lists may be entrusted for a limited purpose. A provider should not infer a right to memorise such data in a model from ordinary hosting access. Training procedures should protect confidentiality and prevent other customers from extracting proprietary material through prompts or outputs.

Personal information in business documents

Uploaded contracts and records may contain CNIC numbers, employment histories, contact details, health information and payment records. The lawful handling of such information can engage contractual, constitutional, sectoral and PECA concerns. In cross-border services, customer or data-subject residence can bring foreign privacy laws into play. A Pakistani server or company registration does not automatically eliminate obligations imposed on a foreign client.

Anonymisation is not automatically enough

Removing a customer's name does not always prevent identification where unique facts, account numbers or surrounding narrative remain. Training datasets should be evaluated for re-identification risk, not simply passed through a basic name-replacement script. Data minimisation and exclusion of sensitive fields can reduce risk. A provider should document exactly what anonymisation does and cannot accomplish, rather than promise that the data becomes entirely risk-free.

Third-party AI APIs

Where a SaaS provider sends customer content to an external model operator, the customer's permissions and the processor's terms matter. Review whether the AI vendor retains requests, uses them for training, transfers them outside Pakistan or permits subcontractor access. An enterprise "no training" commitment should be reflected in an actual provider contract and technical configuration. Marketing language unsupported by the processor terms can create material liability.

Professional confidentiality

Legal, medical and accounting customers may owe duties concerning client material independently of the SaaS contract. A lawyer using an AI research tool may not have authority to disclose privileged client documents for general model training. The SaaS vendor should offer restricted data handling and enterprise controls rather than place responsibility entirely on professional subscribers. Privilege and confidentiality considerations require separate review of customer use cases.

Copyright and training datasets

Protected literary, artistic and software works may be present in uploads. Training can involve copying or transformation of material, which raises questions under the Copyright Ordinance, 1962 and applicable licences. Pakistan should not be assumed to have a broad statutory AI-training exception merely because some foreign jurisdictions recognise text-and-data-mining rules. Review whether rights or permissions cover dataset construction and retained copies.

Data retention and model deletion

A contractual promise to delete uploaded files does not necessarily mean their information can be removed from a model trained upon them. The provider should explain the distinction between deleting source documents, logs, embeddings, backups and model parameters. Do not promise perfect unlearning unless the technology and contract can actually deliver it. Retention schedules should be realistic and auditable.

Opt-in, opt-out and enterprise separation

Offer a settings mechanism that accurately controls future training inclusion, with a clear account-level or tenant-level policy. A customer that declines shared training should not have its records placed in the corresponding pipeline through a support engineer's manual export. Track consent and configuration changes. Separate enterprise training datasets from ordinary service storage where appropriate.

Model outputs and leakage

Even where training is contractually permitted, the provider should evaluate whether a model memorises and reproduces customer-specific passages. Conduct red-team tests for names, unusual figures and confidential quotations. A promise that information is "securely stored" does not fully address output leakage or unauthorised retrieval. Access controls, filtering and privacy testing should be part of the design.

A legal SaaS example

A platform receives clients' pleadings and contracts for AI analysis. The provider wants to add all submissions to a shared legal assistant's training corpus. Unless lawful permissions and confidentiality conditions support that reuse, the safer legal position is to keep client material excluded by default. Public judgments lawfully obtained from authorised sources may present different rights and privacy questions from confidential private files.

A retail analytics example

An online merchant uploads customer orders for sales forecasting. The SaaS provider wants to train an industrywide purchasing model. Aggregate statistical insights generated without exposing protected information may raise different issues from copying each customer's identifiable order history into a reusable model. The contract should distinguish derived statistics from raw transactions and specify whether the merchant can consent on behalf of individuals.

Opinion and recommended course

A SaaS provider should treat model training as a separate, specifically documented use of customer content. Review contract authority, confidentiality, copyright, personal information and third-party processing terms; provide meaningful customer controls and avoid hidden secondary use. The prudent design is to exclude confidential enterprise content from shared training unless a legally sound arrangement expressly permits inclusion.

Principal authorities: Contract Act, 1872; Copyright Ordinance, 1962; Prevention of Electronic Crimes Act, 2016 as amended in 2025; applicable SECP or SBP sector confidentiality requirements; customer SaaS agreements and data processing schedules.