Does the Privacy Act apply to my business?
The OAIC states that most small businesses are not covered by the Privacy Act, but some are. A small business here means annual turnover of $3 million or less, counting all income from all sources. Several kinds of small business are covered regardless of turnover, and the OAIC recommends that small businesses consider opting in, citing increased customer confidence and trust. Even where the Act does not apply, larger customers may require similar handling in their contracts, so check those too.
- Health service providers, which the OAIC says include allied health, complementary therapists, child care centres and private schools.
- Businesses that trade in personal information, such as selling a customer list.
- Contractors providing services under a Commonwealth contract.
- Credit reporting bodies.
- Businesses that have chosen to opt in.
Can we put personal information into an AI tool?
The OAIC states that privacy obligations apply to any personal information input into an AI system and to output that contains personal information. Under APP 6, you may use or disclose personal information only for the purpose you collected it for, unless the person consents or would reasonably expect the secondary use and it is related to the original purpose (directly related, for sensitive information). A secondary use is more likely to be expected if your collection notice and privacy policy described it. As a matter of best practice, the OAIC recommends not entering personal information, particularly sensitive information, into publicly available generative AI tools.
What should we check in the AI vendor's terms?
The OAIC advises reviewing the terms and settings that apply to your use of the product, and in particular whether they give the developer access to data you input or generate. If they do, you need to decide whether using the product complies with APP 6, and what measures to put around it, such as turning off features that disclose data, preventing staff from entering personal information and training them. Business plans from AI vendors often have different data terms from free tools, so read the terms for the plan you will actually use.
- Whether inputs or outputs are used to train the vendor's models.
- How long prompts, files and outputs are retained.
- Where data is processed and stored.
- Which subcontractors can access the data.
- How the vendor notifies you of a security incident.
What if the data is processed overseas?
Many AI models run in data centres outside Australia. The OAIC lists cross-border disclosure under APP 8 among the obligations to consider when personal information goes into an AI product, alongside collection under APP 3 and accuracy under APP 10. Find out where each service in the workflow processes and stores data, including the automation platform, the AI model provider and any document extraction service. Some vendors offer processing in Australian regions. Record the locations, reflect them in your privacy policy where required and revisit them when a vendor changes its terms.
How do we limit what the AI sees?
The OAIC expects organisations to consider what information is necessary and to minimise the personal information put into an AI product. Design each AI step to receive only the fields it needs to do its job. Information that has been appropriately de-identified is no longer personal information, according to the OAIC, although whether a person is still reasonably identifiable depends on context. APP 11.3 notes that reasonable steps to secure personal information include technical and organisational measures, so access controls on the workflow itself matter as much as the AI vendor's.
- Send the order lines, not the whole customer record.
- Replace names and account numbers with internal reference numbers before the AI step.
- Exclude health, financial hardship and similar sensitive details unless the task needs them.
- Limit who can view the workflow's logs, which often contain the same data.
What changes on 10 December 2026?
The Privacy and Other Legislation Amendment Act 2024 added a transparency obligation to APP 1 that starts on 10 December 2026. It applies where you have arranged for a computer program to make a decision, or do something substantially and directly related to making one, that could reasonably be expected to significantly affect an individual's rights or interests, using their personal information. Your privacy policy must then describe the kinds of personal information used and the kinds of decisions involved. Most back-office automations, such as coding supplier bills, do not decide anything about individuals. A workflow that declines credit applications or shortlists job applicants may, so check it against the OAIC fact sheet.