Privacy Act and AI tools for Australian businesses
Personal information typed into Claude, ChatGPT or Copilot is still personal information. So is personal information the tool writes back. The Office of the Australian Information Commissioner says privacy obligations apply to both, where the Privacy Act covers the business. Its best practice advice is not to enter personal information, and particularly sensitive information, into publicly available generative AI tools.
On this page
Does the Privacy Act apply?
Many small businesses are not covered. The OAIC says a small business, for this test, is one with annual turnover of $3 million or less, and that most of those businesses are not covered by the Privacy Act. Some are covered no matter the turnover. The list on the OAIC page includes a health service provider, a business trading in personal information, a contractor under a Commonwealth contract, an operator of a residential tenancy database, a business accredited under the Consumer Data Right, a business prescribed by the Privacy Regulation, and a business that has opted in. Read the OAIC small business page for the full list. This guide is not legal advice.
From 10 December 2026, a business the Privacy Act already covers has to add a note to its privacy policy when three tests are all met. It has arranged for a computer program to make a decision, or to do something substantially and directly related to making that decision. The decision could reasonably be expected to significantly affect a person's rights or interests. Personal information about that person is used in the program. The policy then has to name the kinds of personal information used, the kinds of decisions the program makes on its own, and the kinds of decisions the program substantially informs. A person still approving a quote is not automatically one of these decisions. The OAIC published the fact sheet on 30 September 2026 (OAIC).
From 1 July 2026 the Privacy Act also applies to personal information a reporting entity handles for its AML/CTF obligations, even when turnover is $3 million or less. That includes the newer group of reporting entities from the same date. Other work at that business stays outside the Act unless another exception already covers it (OAIC AML/CTF guidance).
What the OAIC said about AI tools
The guidance is Guidance on privacy and the use of commercially available AI products, published 21 October 2024 and updated 17 January 2025. These are the five points the OAIC put at the top. They apply when the Privacy Act covers you.
| OAIC point | What it means at a desk |
|---|---|
| Personal information going in, and personal information coming out, is still personal information | A customer's name, address, job photos or contract in a prompt is not "just a chat" |
| Privacy policies and notices should say how you use AI. A public chatbot should be identifiable as AI | If the website chat is a model, say so |
| Generating or inferring personal information is a collection under Australian Privacy Principle 3 | A made up phone number about a real person still has to be handled as personal information |
| Australian Privacy Principle 6 limits use to the purpose you collected it for, unless consent or a related reasonable expectation applies | A file collected to write a quote is not automatically available to train a model or to paste into a public tool |
| Best practice: do not enter personal information, particularly sensitive information, into publicly available generative AI tools | Health information, tax file numbers and a free personal ChatGPT login do not belong together |
A practical checklist
Work down this list before staff are told they may use a tool. If the Act does not cover you, the same list is still the rule we put in a company workspace, because a customer does not care which exemption you sit under.
- Decide whether the Act covers this business. Use the OAIC small business page, or ask your adviser. Do not guess from turnover alone.
- Name the tool and who owns the login. A company ChatGPT Business or Claude Team workspace can be closed when someone leaves. Five personal Plus or Pro accounts cannot.
- Write what may be pasted. Your own templates and public information are a different risk from card numbers, tax file numbers, health information and passwords.
- Keep a human on anything with a price. A draft quote can be prepared by the tool. Sending it, or raising an invoice, stays with a person.
- Say so in the privacy policy if you have one. The OAIC wants the use of AI described, and a public facing chatbot identified as AI.
- Do not paste into a public free tool to "just try it". That is the case the OAIC called out.
Cloud hosting is a different question. Where the servers sit, and whether a government customer needs an IRAP assessment, is covered in IRAP vs the Privacy Act.
How we set this up
An AI Starter Session is the company workspace, the admin owner, and a one page paste rule the staff can read. Typical range is $600 to $999 plus GST. A Skill Pack ($2,500 to $5,000 plus GST) or a Workflow Build ($4,000 to $9,000 plus GST) comes after that, if there is a repeated job worth building. The first step is a free 30 minute AI check. Vendor licences are billed by Anthropic or OpenAI, usually in US dollars. Scope is in Claude and ChatGPT setup.
FAQ
Can staff paste a customer's name into free ChatGPT?
The OAIC's best practice advice is not to enter personal information, and particularly sensitive information, into publicly available generative AI tools. Use a company owned ChatGPT Business or Claude Team workspace, and keep a written rule for what may be pasted. This is not legal advice.
Does the Privacy Act apply to a business under $3 million turnover?
Often no. The OAIC says most businesses with annual turnover of $3 million or less are not covered. Some are covered anyway, including health service providers, businesses that trade in personal information, and businesses on a Commonwealth contract. From 1 July 2026 a reporting entity is also covered for personal information it handles for AML/CTF obligations, including the newer group of reporting entities. Other work at that business stays outside the Act unless another exception already covers it. Check the OAIC small business page, or ask your adviser, before you assume you are exempt.
If the tool writes a customer's details back, is that personal information?
Yes, when the output is about an identified or reasonably identifiable person. The OAIC says generating or inferring personal information, including an incorrect or made up detail, is a collection and has to meet Australian Privacy Principle 3.
Is this legal advice?
No. It is a reading of the OAIC guidance published on 21 October 2024 and updated on 17 January 2025, the OAIC small business page, the OAIC note published on 30 September 2026 about privacy policies from 10 December 2026, and the OAIC AML/CTF guidance. How it applies to one business is a question for that business's adviser.
Related service: Claude and ChatGPT setup · contact eWEB TEC.
Want the paste rule written for your team?