The short version
If your business is covered by the Privacy Act 1988, using AI does not create a new privacy regime. It applies the existing one to a new set of facts, and four of the Australian Privacy Principles do most of the work.
- APP 8. Sending personal information to an overseas AI provider is a cross-border disclosure, with obligations attached.
- APP 6. Using information collected for one purpose to run an AI system for another can be a secondary use, which needs a basis.
- APP 10. You must take reasonable steps to ensure information you use or disclose is accurate, which sits awkwardly with a technology that produces confident errors.
- APP 11. You must take reasonable steps to secure it, which now includes the third parties your staff are pasting it into.
None of this makes AI unusable. All of it requires having thought about it before the data leaves.
This is general information, not legal advice. Where the consequences are material, get advice on your specific circumstances.
APP 8: sending data overseas
This is the one that catches most businesses, and it catches them because the disclosure does not feel like one. Nobody experiences pasting a paragraph into a chat window as an international data transfer. It is one.
APP 8 requires that before disclosing personal information to an overseas recipient, you take reasonable steps to ensure the recipient does not breach the APPs. And APP 8.1 carries a significant sting: in most cases you remain accountable for what the overseas recipient does with it. An act by them that would breach the APPs is treated as a breach by you.
What that means practically:
- Know where the processing happens. Several major AI platforms now offer Australian regions. Several do not, and some offer it only on certain tiers or with an explicit configuration. "Probably somewhere in the region" is not knowing.
- Read the actual terms for the tier you are on. Consumer and enterprise tiers of the same product routinely differ on training rights, retention and sub-processors. This is the single largest source of unintentional exposure we encounter.
- Update your privacy notice. If personal information may be disclosed overseas, APP 1 requires your policy to say so and, where practicable, to name the countries.
- Consider whether consent is your basis, and be careful with it. Consent under the APPs must be informed, voluntary, current and specific. A line in terms and conditions accepted two years ago is unlikely to meet that bar for a use that did not exist then.
The reasonable-steps standard scales with sensitivity. Running a public product description through a model is a very different proposition from running a client's health information through the same one.
APP 6: using data for a new purpose
APP 6 says that information collected for one purpose can generally only be used or disclosed for that purpose, unless an exception applies or the individual would reasonably expect the secondary use and it is related to the original one.
Where this bites with AI is the quiet cases, not the obvious ones:
- Support tickets collected to resolve customer issues, later used to train or evaluate a classification system.
- Employee records collected for payroll, later fed into an analysis tool.
- Client documents collected to deliver a service, later used as examples in a prompt library.
Each of those may well be defensible. The question is whether anyone asked before it happened. In our experience the third one is the most common and the least noticed, because building a library of good examples feels like an internal engineering activity rather than a use of personal information.
The practical control is not complicated: when designing an AI system, name the personal information it will touch and the purpose each item was originally collected for. If the two do not line up, either de-identify, get a basis, or change the design. Doing this at design time takes an hour. Doing it after a complaint takes considerably longer.
APP 10 and 11: accuracy and security
APP 10 requires reasonable steps to ensure personal information you use or disclose is accurate, complete and up to date, having regard to the purpose.
This is where AI's characteristic failure mode meets a legal obligation. A model that confidently produces a plausible but incorrect detail about a person, which is then written into a record, sent to a third party or relied on in a decision, is an accuracy problem with a compliance dimension. The mitigations are the ones good engineering calls for anyway: verification before a write, human review on anything consequential about an individual, and an audit trail showing what was checked.
APP 11 requires reasonable steps to protect information from misuse, interference, loss and unauthorised access or disclosure. Applied to AI, the questions are concrete: which staff can send personal information to which tools, what those tools retain, whether access is logged, and whether an unapproved tool being used right now would be visible to you. If the answer to the last one is no, that is an APP 11 gap independent of anything that has gone wrong.
What your privacy notice should say
Most privacy policies written before 2023 do not contemplate any of this. A refresh generally needs to cover:
- That AI tools are used in delivering your services, in plain language rather than a euphemism
- What categories of personal information may be processed by them
- Whether that processing occurs overseas, and where
- That the information is not used to train the provider's public models, assuming you have confirmed this contractually, and only if you have
- How long the provider retains it
- How an individual can ask what is held, ask for correction, or object
The tone matters more than people expect. A notice that says clearly "we use AI tools to draft and process documents, they run in Australian regions, your information is not used to train them, and a person reviews anything that affects you" builds trust. One that buries the same facts in a sub-processor annex satisfies the letter of the obligation and none of its purpose.
What this looks like in practice
For a mid-sized Australian business, a defensible position is roughly six things, and none of them are onerous:
- A data map for AI. Which systems, which personal information, which providers, which regions. One page, kept current.
- Enterprise tiers only, with a written agreement covering training, retention and sub-processors. Verified, not assumed.
- De-identification wherever the task allows it. A surprising proportion of AI work does not need identity at all, and the cheapest way to manage a privacy obligation is not to trigger it.
- Human review on anything affecting an individual: an entitlement, an assessment, an employment decision, a clinical matter.
- An updated privacy notice that says what actually happens.
- Logging sufficient to answer "what was sent, by whom, when, and to which provider" is also what makes a notifiable data breach assessment possible rather than speculative.
Notice how much of this overlaps with simply building the system well. Data minimisation, scoped access, human gates on consequential decisions and audit logs you can reconstruct from are good engineering before they are compliance. The businesses that find privacy obligations painful are usually the ones that skipped the engineering.
The direction of travel
Australian privacy law is under active reform, and the pressure is toward more transparency about automated decision-making rather than less. The OAIC has published guidance on privacy and commercially available AI products, and the National AI Centre's voluntary safety standard has become the reference point most local governance conversations start from.
You do not need to predict where it lands. You need a system where answering "what personal information does this touch, where does it go, who reviewed it, and can we prove that" takes an afternoon rather than a project. Every plausible version of the future asks that question.