Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
If the Privacy Act 1988 (Cth) covers your business, using AI does not remove your existing privacy obligations. Personal information you put into an AI system—and information it generates about an identifiable person—must be considered throughout the workflow. Before deployment, establish whether the Act applies, justify and minimise the data use, check the product and vendor arrangements, assess privacy impacts, tell people what actually happens, and put suitable accuracy, security, oversight and review controls in place.
There is also a time-sensitive change: from 10 December 2026, APP 1.7–1.9 require specified privacy-policy disclosures for certain significant decisions made or substantially assisted by computer programs. This is a general guide to the Privacy Act and OAIC guidance, not legal advice or a determination of any particular business’s obligations.
Does the Privacy Act apply to my small business if I use AI?
Check coverage before assessing a particular AI tool. Australian Government agencies and organisations with annual turnover above $3 million generally have Privacy Act responsibilities. Most small businesses at or below that threshold are exempt, but the exemption has exceptions and special cases. The OAIC identifies, among others, private-sector health service providers, businesses that trade in personal information and certain Commonwealth contractors. Its small-business material also identifies credit reporting, residential tenancy database and AML/CTF reporting categories.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Do not rely on a “small business” label alone. Confirm the relevant legal entity, its turnover, its activities and any exception that may apply. The OAIC’s small-business coverage guidance is the place to check the categories; where your circumstances are unclear, get professional advice.
#1 Best Overall
For businesses covered by the Act, the OAIC says the Privacy Act and Australian Privacy Principles (APPs) apply to AI uses involving personal information, including training, testing and use. Personal information is information or an opinion, true or false, about an identified or reasonably identifiable individual. An inference, inaccurate output or artificially generated material can qualify if it is about such a person. That means the privacy review may need to include prompts, uploaded documents, retrieved records, generated summaries and scores—not just the original customer record.
What should I do before deploying AI automation?
Use the following sequence to decide whether an AI workflow is appropriate and to build privacy controls before staff or customers rely on it.
- Define the task and map the data flow. Record the business function, why AI is being considered, whether it is necessary and what information enters and comes out. Identify who can access prompts, outputs and logs, where information goes, and whether the provider stores it or uses it further. The OAIC’s guidance cautions against using AI simply because it is available and recommends checking the product’s suitability, testing, privacy and security risks, information access and human oversight.
- Collect only what is reasonably necessary. For an APP entity, APP 3 limits collection of ordinary personal information to what is reasonably necessary for the entity’s functions or activities. Sensitive information has stricter collection conditions and generally requires consent unless an exception applies. Ask whether the task can be done with less information, redacted information or no personal information. Public availability, or a vendor’s ability to receive data, does not by itself make a use unrestricted.
- Check the purpose and vendor arrangements. If you already hold the information, identify the purpose for which it was collected and assess whether sending it to the AI tool is a permitted use or disclosure under APP 6. Before staff enter personal information, establish who at the provider or its subprocessors can access inputs and outputs, how long information is retained, how deletion works, and whether it can be reused for another purpose. Assess these arrangements alongside product suitability and security.
- Assess privacy impacts proportionately. The OAIC recommends privacy by design, including a privacy impact assessment (PIA), when considering AI products. Its PIA tool describes a systematic assessment of how a project may affect people’s privacy and recommendations to manage, minimise or eliminate those impacts. Scale the assessment to the project’s size, complexity and risk; record mitigations and remaining risks. A PIA is a practical risk-management tool, not a certificate of legal compliance.
- Make notices and policies reflect the actual workflow. The OAIC recommends clear information about AI use in privacy policies and collection notices, and clear identification of public-facing AI tools such as chatbots. Explain what the business actually does with personal information, including relevant use, disclosure or generation. Do not promise safeguards or practices that the organisation has not implemented.
- Test outputs and assign human responsibility. AI can produce false or inaccurate information. APP 10 accuracy duties apply to personal information handled by an APP entity, and the OAIC recommends steps appropriate to the risk. For consequential decisions, understand how the tool produces outputs, assign a person to check accuracy, and give that person the authority and practical ability to overturn the result. People affected should receive an adequate explanation of how the decision was reached and how AI contributed.
- Keep controls active. Set permitted-use rules, train staff, monitor the system and review it regularly. Reassess when the product, data, purpose or workflow changes; a system that was suitable at launch may not remain fit for purpose.
Can I put customer information into ChatGPT or another AI tool?
There is no blanket yes or no based only on the product name. First establish whether the Privacy Act applies to your business and whether the proposed information and use are permissible. Then apply the same data-flow and vendor checks used for any AI system: necessity, collection basis, purpose compatibility, access, retention, deletion and possible secondary use.
Rank #2
If the provider’s handling is not clear enough for the business to assess those points, do not enter identifiable customer information until the uncertainty is resolved. Consider whether the task can be completed with redacted or non-identifying information instead. The OAIC’s guidance calls for product due diligence; it does not establish that every tool’s terms or settings are suitable for every business or use case.
Do I have to tell customers that I use an AI chatbot?
The OAIC recommends making AI use clear in privacy policies and collection notices, and clearly identifying public-facing AI tools such as chatbots. The information should match the actual interaction and handling of personal information. A notice is not a substitute for having a lawful basis to collect, use or disclose the information, nor does it make inaccurate or excessive collection appropriate.
For any AI-enabled service, ensure the business understands what information the system receives and produces, who can access it, and how it is used. That understanding is necessary to give people a meaningful account of the workflow rather than a generic statement that AI is involved.
What must my privacy policy say about AI-assisted decisions from 10 December 2026?
From 10 December 2026, APP 1.7–1.9 add specific privacy-policy disclosure requirements when the statutory conditions for a significant computer-assisted decision are met. In broad terms, the conditions concern an entity arranging for a computer program to make a decision—or do something substantially and directly related to making one—where the decision could reasonably be expected to significantly affect an individual’s rights or interests and the individual’s personal information is used in the program’s operation.
Recommended Free Tools
Where the requirements apply, the policy must include specified information, including the kinds of personal information used and the kinds of decisions made solely or partly through the program. The obligation is not limited to systems labelled “AI”: the OAIC describes “computer program” broadly to include rule-based programs, AI, machine learning, apps and generative AI tools.
Human review does not automatically remove a decision from scope
A person reviewing a result does not necessarily put the workflow outside the disclosure rules. A program’s output may be in scope if it is a key factor and directly connected to the human decision. Relevant considerations in the OAIC guidance include how much the decision-maker relies on the output, the likelihood of overriding it, the output’s type, explainability and its integration into the workflow.
Examples to assess, not automatic triggers
The OAIC gives examples including AI-assisted performance assessments affecting promotion, automated refund approvals or refusals, job application screening and ranking, complaint escalation, loan risk scores relied on by loan officers, and scholarship rankings considered by a panel. These examples illustrate possible applications; they do not mean every use of AI triggers APP 1.7–1.9. Assess the statutory conditions for each decision process.
Prepare before commencement
- Inventory AI-assisted decisions, including decision-support workflows where staff review an output.
- Identify which decisions could significantly affect an individual’s rights or interests.
- Record the kinds of personal information used and how the program contributes to the decision.
- Where the conditions apply, update the APP privacy policy before 10 December 2026 with the required information.
- Document how staff test, question and, where appropriate, override outputs so human review is meaningful.
The OAIC says the transparency obligation generally remains with the APP entity that uses personal information to make the decision, even when a third-party system operates the program.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallHow should I compare AI products or workflows?
Assess each candidate against the same operational questions. The best option is not necessarily the most capable system; it is the option that is suitable for the task and whose data handling and risks the business can manage.
- Data: Does the task require personal or sensitive information, or can less information achieve it?
- Provider handling: Who can access inputs, outputs and logs? How are they retained or deleted, and can they be reused for provider purposes?
- Fitness for purpose: Has the system been tested for the intended use, including accuracy and explainability?
- Consequences and oversight: How harmful could an incorrect output be, and can a person meaningfully review and override it?
- Transparency: Can the business accurately maintain notices and privacy-policy information as the workflow changes?
- Governance: Can the organisation provide staff training, ongoing monitoring and review for the product’s lifecycle?
What should the business record and revisit?
Keep a working record of the legal entity and coverage assessment, AI tools and purposes, data entering and leaving each workflow, vendor access and retention arrangements, the reasons the information is necessary, and any sensitive-information controls. Retain the PIA and its mitigations, the relevant notices and policy changes, staff training and oversight arrangements, and the way accuracy and system performance are monitored. Revisit the record when the tool, provider, data, purpose or decision process changes.
The OAIC’s AI use guide was published on 21 October 2024 and its page records an update on 17 January 2025. OAIC APP 3 guidance was updated on 13 May 2026; its APP 1 guidance sets out the 10 December 2026 commencement date. The OAIC notes that its AI guidance is not a complete account of privacy issues or other regulatory regimes. A business may also need to consider rules outside the Privacy Act, including workplace, employment, discrimination, consumer, sector-specific and state or territory requirements.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
