AI and the Australian Privacy Act

By Dylan Bailey, Certified Claude Expert · Updated 4 August 2026 · 7 min read

There's a common assumption that AI sits in a legal grey area in Australia and that everyone is waiting for rules. For privacy, that isn't really the position. The Privacy Act already applies, and it applies in a way that's reasonably predictable once you look at it directly.

This is general information, not legal advice. If you handle health, financial, government or other regulated information, get advice specific to your circumstances.

The starting point

The Act regulates personal information — information about an identified individual, or one who is reasonably identifiable. It doesn't matter whether you process that information in a spreadsheet, a CRM or an AI tool. The obligations attach to the information, not the software.

So the question is never "is AI allowed". It's the same question you'd ask of any new system: what are we doing with personal information, and does that sit within what we've collected it for and told people about?

The principles that bite most often

APP 6 — use and disclosure. You can generally use personal information for the purpose you collected it for. Using it for something materially different needs consent or another basis. Running client data through an AI tool to do the work you were engaged for is usually consistent; using it to train something for an unrelated purpose usually isn't.

APP 8 — cross-border disclosure. This is the one most businesses miss. The major AI providers process outside Australia, so using them typically involves a cross-border disclosure — and you remain accountable for how that recipient handles the information. Business-tier terms matter here, because they're where those protections live.

APP 11 — security. You must take reasonable steps to protect personal information. Staff pasting client data into free consumer accounts on personal logins would be difficult to characterise as reasonable steps.

APP 1 — open and transparent handling. Your privacy policy has to actually describe what you do. If AI tools are now part of how you handle personal information, the policy should say so.

An Australian small-business example

A Queensland allied health practice starts using an AI tool to summarise session notes. It saves real time.

Three problems, none of them exotic. Health information is sensitive information, attracting higher protection. The tool is a consumer tier with no commitment against training. And the practice's privacy policy — written in 2019 — says nothing about disclosure to a third-party processor overseas.

The AI use isn't automatically unlawful. But it was adopted without anyone running the three checks that would have been run for any other new system touching patient records.

A practical sequence

• Find out what's actually in use. You can't assess what you don't know about — and unsanctioned use is common.
• Sort your data. Which work involves personal information at all? A surprising amount doesn't, and that work needs none of this analysis.
• Use business tiers where personal information is involved. The contractual terms are the substance of your APP 8 position.
• Check where processing happens. Providers publish this. Some offer regional processing options.
• Update the privacy policy. It should describe what you actually do now.
• De-identify as a default habit. "Client A" removes most of the issue from most tasks at no cost.

Where this is heading

Australia has been consulting on AI-specific regulation, particularly for high-risk uses, and Privacy Act reform has been under way for some time. The direction of travel is toward more obligation rather than less.

That's an argument for building the habits now while the stakes are low — knowing your tools, using business tiers, keeping personal information out of places it shouldn't be. Businesses that do this will find future requirements a matter of documentation. Businesses that don't will be starting from an unknown position.