In Australia, the Privacy Act applies to any use of AI involving personal information by a business it covers. The privacy regulator recommends not entering personal information into public AI tools, treats AI-generated information about people as collected personal information, and from 10 December 2026 some businesses must explain automated decisions in their privacy policies.
This is general information, not legal advice.
Key takeaways
- According to the OAIC, "The Privacy Act applies to all uses of AI involving personal information."
- Businesses with annual turnover of $3 million or less are often exempt, but many are covered regardless, including health service providers.
- The OAIC recommends, as best practice, not entering personal information into publicly available generative AI tools.
- Information AI generates or infers about an identifiable person, including errors, counts as personal information.
- From 10 December 2026, covered businesses using automated decisions that could affect people must describe them in their privacy policy.
Does the Privacy Act apply to how businesses use AI?
Yes, for businesses the Act covers. According to the Office of the Australian Information Commissioner, the Privacy Act applies to all uses of AI involving personal information. That covers what staff type into AI tools, what AI produces about people, and what an AI product does with the data it receives. The Australian Privacy Principles apply as they do elsewhere.
The OAIC set this out in its guidance on commercially available AI products, published in October 2024 and updated in January 2025. It sits alongside separate guidance for organisations that develop or train AI models.
The guidance covers both directions. Personal information going into an AI system is a use or disclosure, and must fit the purpose it was collected for. Personal information coming out of one is a collection, with its own rules.
Does the small business exemption cover my business?
Possibly, but check carefully. The OAIC defines a small business as one with an annual turnover of $3 million or less, and most such businesses are exempt. However, many are covered regardless of turnover, including health service providers, businesses trading in personal information and contractors to the Commonwealth.
The full list of exceptions on the OAIC's site is longer than most owners expect:
| Covered regardless of turnover | Example |
|---|---|
| Health service providers | Clinics and allied health practices |
| Trading in personal information | Buying or selling contact lists |
| Commonwealth contractors | Services delivered under a Commonwealth contract |
| Credit reporting bodies | Credit checks and reporting |
| Related to a covered business | Linked to a business the Act already covers |
| Opted in | Chose to be covered by the Act |
Even an exempt business has reasons to follow the rules. Larger customers often require privacy compliance in their contracts. Customers also expect it, and the OAIC's guidance is a sensible standard for handling their information. If in doubt, take advice on whether the exemption applies.
What does the OAIC say about putting personal information into AI tools?
As a matter of best practice, the OAIC recommends that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools. Where personal information does go into an AI system, the use must match the purpose it was collected for, or the person must have consented or would reasonably expect it.
The guidance explains why caution matters. Once personal information is entered into an AI system, it can be very difficult to track or control how it is used, and potentially impossible to remove.
In practice, the biggest exposure in most businesses is staff using personal AI accounts with customer or employee details. The guide to shadow AI covers how common that is and why bans do not work.
Business plans help but do not settle the question. They usually change how the vendor may use your data, for example excluding it from model training by default. They do not change the purpose test under the Privacy Act. The checklist for moving staff to business plans covers the switch.
Is AI-generated information about people personal information?
Yes, when it is about an identified or reasonably identifiable person. The OAIC says that generating or inferring personal information with AI is a collection, which must comply with Australian Privacy Principle 3. That includes inaccurate information, such as hallucinations and deepfakes, so an AI's wrong guess about a customer is still their personal information.
This catches businesses out. A sales team might ask AI to summarise everything about a prospect, and the AI fills gaps with confident guesses about role, age or circumstances. Those guesses are now personal information the business holds.
So the same disciplines apply to output as to input. Collect only what is reasonably necessary, correct what is wrong, and do not keep AI-inferred profiles nobody needs. A person reviewing output about real people should check it as carefully as anything published.
What changes in December 2026 for automated decisions?
The Privacy and Other Legislation Amendment Act 2024 introduced an obligation about automated decision-making. From 10 December 2026, businesses covered by the Act that use personal information in automated decisions with the potential to affect people's rights or interests must describe them in their privacy policy: the kinds of information used and decisions made.
According to the OAIC, the policy must cover "the kinds of personal information used" and "the kinds of decisions made using ADM". The OAIC consulted on guidance for the obligation during 2026, and its final guidance is the place to confirm the detail.
For most growing businesses this is a review task, not a rebuild. List any process where software, AI or not, decides something about a person without a human deciding: credit terms, application screening, pricing tiers, eligibility. Then check whether the privacy policy describes them.
What should an Australian business do now?
Five steps cover most of it. Move staff using personal AI accounts with company data onto business plans. Set a clear rule about personal information in AI tools. Update the privacy policy to describe AI use. Check vendors before adopting them. And review automated decisions before 10 December 2026.
- Business accounts. Move people off personal AI accounts where company data is involved.
- A data rule. One sentence in the AI policy on what personal information may go where.
- Transparency. The OAIC expects privacy policies to explain AI use, and public-facing AI such as chatbots to be clearly identified.
- Vendor checks. Ask how each product uses and stores what you enter.
- Automated decisions. Identify them and describe them in the privacy policy.
The OAIC also recommends a privacy-by-design approach, including a privacy impact assessment for new AI uses. For vendor questions, the AI vendor checklist turns the OAIC's guidance into a list to work through.
Skein moves people using personal AI accounts with company data onto business plans first, and every connection it sets up starts read only; the AI leadership page covers the decisions leaders need to make. That suits a growing business whose staff already use AI with customer information. A business handling health or other sensitive information should involve its privacy or legal adviser before setting the rules.
Frequently asked questions
Does the Privacy Act apply to AI in Australia?
Yes, for businesses the Act covers. The privacy regulator states that the Privacy Act applies to all uses of AI involving personal information. That includes information staff enter into AI tools, information AI generates about people and how AI vendors handle the data a business shares with them.
Can I put customer information into ChatGPT or Claude?
The OAIC recommends, as best practice, not entering personal information into publicly available generative AI tools. Business plans with suitable data terms reduce the risk, but the use must still match the purpose the information was collected for, or have consent. Check your policy and the vendor's terms first.
Are small businesses exempt from privacy rules on AI?
Many businesses with annual turnover of $3 million or less are exempt from the Privacy Act. However, some are covered regardless, including health service providers, businesses trading in personal information and Commonwealth contractors. Contracts with larger customers often require compliance anyway, so check before relying on the exemption.
Is information AI makes up about a person covered by privacy law?
Yes, if it is about an identified or reasonably identifiable person. The OAIC treats generating or inferring personal information with AI as a collection under the Australian Privacy Principles. That applies even when the information is wrong, such as a hallucinated detail about a customer or a deepfake image.
What is the automated decision-making privacy change in 2026?
From 10 December 2026, businesses covered by the Privacy Act that use personal information in automated decisions that could affect people's rights or interests must explain them in their privacy policy. The policy must describe the kinds of personal information used and the kinds of decisions made with automated systems.
Related reading
- Office of the Australian Information Commissioner. "Guidance on privacy and the use of commercially available AI products." OAIC, 21 October 2024, updated 17 January 2025. https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/guidance-on-privacy-and-the-use-of-commercially-available-ai-products
- Office of the Australian Information Commissioner. "Small business." OAIC, accessed 30 October 2026. https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/organisations/small-business
- Office of the Australian Information Commissioner. "Consultation on guidance for transparency in automated decision making." OAIC, 18 May 2026, updated 16 October 2026. https://www.oaic.gov.au/engage-with-us/consultations/consultation-on-guidance-for-transparency-in-automated-decision-making