AI and privacy: what Australian businesses need to know

Does the Privacy Act apply to my business?

The Privacy Act 1988 and its Australian Privacy Principles (opens in a new tab) apply to many businesses. Many small businesses with an annual turnover of $3 million or less are exempt, but there are important exceptions, for example businesses that provide a health service. The OAIC website explains who is covered.

Even if your business is exempt, following good privacy practice is sensible. Customers expect their information to be handled carefully, and your business may become covered as it grows or changes what it does.

What the OAIC says about AI products

The Office of the Australian Information Commissioner has published guidance on privacy and the use of commercially available AI products (opens in a new tab). Some of its key points are summarised below.

In particular, the OAIC recommends as a matter of best practice that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools, because of the significant and complex privacy risks involved.

• Privacy obligations apply to personal information put into an AI system, and to AI output that contains personal information.
• Do due diligence before adopting an AI product, including its privacy and security risks and who can access the information.
• Update privacy policies and notices to explain your use of AI clearly.
• Clearly identify public-facing AI tools, such as chatbots, as AI.

Everyday risks with AI tools

Most privacy problems with AI come from ordinary habits rather than complex technology. A staff member pastes a customer complaint into a free chatbot to draft a reply. A meeting recorder uploads a client call to a service nobody has checked. A spreadsheet of customer details is uploaded to analyse sales.

Each of these may be fine with the right tool and settings, and risky without them. The fix is usually simple: approved tools, clear rules and a little training.

• Remove names and identifying details before using AI to draft or summarise.
• Use business accounts with data controls rather than personal free accounts.
• Check whether a tool uses your inputs to train its models, and switch it off if you can.
• Be especially careful with health, financial and HR information.

Choosing AI providers carefully

Before connecting any AI tool to customer or staff information, ask the provider some basic questions and keep the answers on file. If you work with a specialist, ask them to explain where data flows in anything they build. Our guide to choosing AI tools includes a longer checklist.

• Where is information stored and processed, and in which countries?
• Who at the provider can access it, and for what purposes?
• Is it used to train AI models, and can that be turned off?
• How long is it kept, and can it be deleted on request?
• What security controls are in place, such as encryption and multi-factor authentication?

Security and data breaches

Every new tool is another account that could be compromised. Turn on multi-factor authentication, give people only the access they need and remove access when someone leaves. The Australian Cyber Security Centre's small business cyber security guide (opens in a new tab) is a good free checklist.

If your business is covered by the Privacy Act, the Notifiable Data Breaches scheme (opens in a new tab) requires you to notify affected people and the OAIC about eligible data breaches that are likely to result in serious harm. Knowing which tools hold personal information makes it much easier to respond if something goes wrong.

A simple privacy checklist for AI

You can put the basics in place in a few hours. Write them into your AI policy; our guide on creating an AI strategy explains how. If you need help reviewing tools or setting up safer workflows, browse specialists and book a free 15-minute consultation, or read about adding a chatbot responsibly.

• Keep a list of AI tools in use and what information each one touches.
• Approve tools before staff use them with business information.
• Keep personal and sensitive information out of public AI tools.
• Update your privacy policy to explain how you use AI.
• Turn on multi-factor authentication and review access regularly.
• Know who to call and what to do if there is a data breach.