Does Australian Privacy Law Apply to AI Tools?

Often yes. If your business is covered by the Privacy Act 1988 and you put personal information into an AI tool, the Australian Privacy Principles generally still apply. This is general information only and does not replace legal advice for your situation.

Why the tool does not change the rules

The Privacy Act regulates how covered organisations collect, use, store and disclose personal information. Pasting client details into an AI service is a use, and often a disclosure to a third party, so the usual principles come into play. These include having a lawful purpose, being open about how you handle information and taking reasonable steps to protect it.

Questions worth asking

• Are we covered? Some small businesses are exempt based on turnover, but exceptions exist, such as businesses that provide health services.
• What personal information goes into the tool? Names, contact details and health or financial information all count.
• Where does the provider store and process it? Offshore handling can raise additional obligations.
• Does your privacy policy or collection notice mention it?
• What do client contracts say?

Sensible habits

• Keep sensitive personal information out of consumer AI accounts.
• Prefer business plans with clear data terms, and read them.
• Remove or mask identifying details where you can.
• Record which tools are approved and what they may be used for.

Privacy law and guidance on AI are developing, and your obligations depend on your industry and size. Speak to a lawyer before relying on any of the above, and check the OAIC's current guidance on commercially available AI products.

21Labs helps you map which tools touch which data through AI strategy, so your lawyer has something concrete to review.