About this article: AI-assisted writing, reviewed against the cited sources. This is source research, not a lab validation of the procedures. Check the stated versions and your own recovery requirements before making changes.
This article is not legal advice. It is a technical reading of the Commonwealth Privacy Act 1988 and of guidance from the Office of the Australian Information Commissioner (OAIC), for engineers who build or call models. It does not say whether your organisation is bound, whether a particular prompt is lawful, or what to tell a regulator. A lawyer with your facts has to answer those. State and territory laws are outside this note. Nothing here is a NetLeverage product claim. No system was tested.
An AI writing system produced this article from public legislation and regulator guidance. No legal review or system validation is claimed.
The controls that follow are the ones an engineer can actually build: what is allowed into a prompt, where that prompt goes, how model output is labelled before it is stored as fact, and a register of systems that advise or make decisions about people. The law decides the rest.
Why it matters
The Act's definition of personal information is wider than a name and an email address. Section 6 says it is information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information or opinion is true or not, and whether or not it is recorded in a material form. The OAIC's guidance on commercially available AI products, updated 17 January 2025, applies that to model output. A hallucination or a generated image is still personal information if it is about someone who is identified or reasonably identifiable. A system that writes a paragraph about a customer, and is wrong, has not stepped outside the definition by being wrong.
Sensitive information is a narrower list in the same section. It includes information or an opinion about racial or ethnic origin, political opinions, religious or philosophical beliefs, union membership, sexual orientation or practices, and criminal record, where that is also personal information. It includes health information, certain genetic information, biometric information to be used for automated biometric verification or identification, and biometric templates. The OAIC says many photographs and recordings contain sensitive information, including artificially generated ones, and that consent is not implied merely because someone was notified.
An APP entity — an agency or an organisation — must comply with the Australian Privacy Principles. The Act also contains exemptions, including for many small-business operators with annual turnover of $3,000,000 or less under sections 6C and 6D. Those provisions contain conditions and exceptions, including activities for which a small organisation may still be covered. This article does not determine eligibility for an exemption.
How it works
The compilation opened for this article is Compilation No. 104, dated 4 June 2026. The Register's note on that compilation says uncommenced amendments are not shown in the text. On 10 November 2026, the automated-decision clauses discussed below are still in that position. They are printed in the Privacy and Other Legislation Amendment Act 2024, which received Royal Assent on 10 December 2024. Schedule 1, Part 15, commences on 10 December 2026. Until that day, the operative APP 1 in the June compilation ends at clause 1.6.
What you type is already regulated
The OAIC's position, in that January 2025 update, is that privacy obligations apply to personal information put into an AI system, and to output that contains personal information. Generating or inferring it is a collection under Australian Privacy Principle 3. For an organisation, APP 3.2 bars collecting non-sensitive personal information unless it is reasonably necessary for a function or activity. APP 3.5 requires lawful and fair means. APP 3.3 generally requires consent before sensitive information is collected, unless a listed exception applies.
APP 6.1 then limits use and disclosure. If the entity holds personal information collected for a primary purpose, it must not use or disclose it for a secondary purpose unless the individual has consented or clause 6.2 or 6.3 applies. One path in clause 6.2 is that the individual would reasonably expect the secondary use, and the secondary purpose is related to the primary purpose, or directly related if the information is sensitive. The OAIC's AI guidance says it may be difficult to establish that reasonable expectation for a secondary, AI-related purpose, given the risks. Where the organisation cannot clearly establish it, the OAIC says that to avoid regulatory risk the organisation should seek consent or offer a meaningful opt-out. That is the Commissioner's guidance. It is not a court judgment, and it is not a form of consent you can paste into a prompt.
The OAIC also publishes separate guidance on developing and training generative AI models; the commercial-product guidance is not a complete account of training obligations.
The same guidance draws a line engineers can implement. Using a tool to carry out the job you already collected the information for, such as answering a customer, is not the same purpose as using the customer's information to train a model. The OAIC says purposes should be framed narrowly rather than expansively, and that training is the kind of purpose that needs its own justification. A privacy policy sentence that says "we use AI" does not, on that guidance, describe both.
The OAIC also separates use from disclosure in operational language. Input may be a use if the data stays within the organisation's control. It may be a disclosure if it is made accessible to others outside the organisation and released from the organisation's effective control. Its worked example is an insurer pasting a claim, including health information, into a public chatbot. The OAIC describes that as a disclosure to the chatbot's owners. Whether your vendor arrangement is a use or a disclosure is a legal characterisation. The technical fact you owe your counsel is who else can read the prompt, the retrieved documents, and the logs.
As a matter of best practice, the OAIC recommends that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools. The reason it gives is practical as well as legal: once personal information is in a generative system it can be very difficult to track, and potentially impossible to remove, and it can be pulled back out by attacks that try to make the model repeat training data.
Where the bytes go
APP 8 applies when an APP entity discloses personal information to an overseas recipient: a person who is not in Australia or an external Territory, and who is not the entity or the individual. Before that disclosure, clause 8.1 requires reasonable steps to ensure the recipient does not breach the Australian Privacy Principles, other than APP 1. Clause 8.2 lists exceptions, including a substantially similar enforceable law, informed consent, and the prescribed-country route in paragraph 8.2(aa) and clause 8.3, added in December 2024. Whether a relevant country is actually prescribed must be checked against current regulations; this article assumes none. This article does not apply those exceptions to any vendor.
Section 16C is the accountability backstop when clause 8.1 did apply. If the recipient is not itself bound by the principles under the Act, and does something that would have breached them (other than APP 1) if it had been bound, the Act takes that act to have been done by the APP entity. Sending the prompt offshore does not hand the obligation to the vendor.
Two transparency duties are already in the June 2026 text, separate from the December 2026 decision clauses. APP 1.4 requires the privacy policy to say whether the entity is likely to disclose personal information to overseas recipients and, if so, the countries where those recipients are likely to be located, if it is practicable to specify them. APP 5.2 requires a collection notice to cover the same overseas point, among other matters, to the extent the steps are reasonable. A region name on a marketing page is not that list. The engineering record is which service executed the request, in which location, and whether a support engineer or a training job can read it later.
APP 11.1 requires reasonable steps to protect personal information the entity holds from misuse, interference and loss, and from unauthorised access, modification or disclosure. Clause 11.3, in this compilation, says those steps include technical and organisational measures. Clause 11.2 requires destruction or de-identification when the entity no longer needs the information for a permitted purpose, it is not a Commonwealth record, and no Australian law or court or tribunal order requires retention. The OAIC tells organisations assessing an AI product to look at known incidents, the vendor's controls, and whether a cloud deployment can disclose personal information outside Australia. It says a local deployment is likely to be more privacy-preserving because it limits third-party access. That is a design preference in the guidance, not a finding that a particular region's contract satisfies APP 8.
Part IIIC is the notifiable data breaches scheme. The guide in the compilation says an eligible data breach is unauthorised access, disclosure, or loss that is likely to result in serious harm, and that an entity must notify when it has reasonable grounds to believe that happened, or when the Commissioner directs it. Prompts and outputs that are personal information belong in the same access logging and retention rules as the customer database. A transcript nobody owns cannot be assessed.
APP 10 is the accuracy rule. Clause 10.1 requires reasonable steps so that personal information the entity collects is accurate, up to date and complete. Clause 10.2 requires reasonable steps so that what it uses or discloses is, for that purpose, accurate, up to date, complete and relevant. The OAIC says the steps should match the higher risk in an AI context, including disclaimers that state accuracy limits, and a human who is responsible for checking personal information obtained through the system. It also says records should show where information is a model output, and therefore a probabilistic assessment rather than a fact. Writing the model's paragraph straight into the system of record fails that distinction even when the paragraph happens to be right.
Decisions, from 10 December 2026
The new clauses are not a right to an explanation of model weights. They are a privacy-policy content rule. As inserted by the 2024 Act, APP 1.7 will require the policy to contain the information in clause 1.8 if three things are all true. The entity has arranged for a computer program to make a decision, or to do a thing that is substantially and directly related to making a decision. The decision could reasonably be expected to significantly affect the rights or interests of an individual. Personal information about the individual is used in the operation of the program to make the decision or to do that thing.
Clause 1.8 asks for three kinds of information: the kinds of personal information used in such programs; the kinds of decisions made solely by such programs; and the kinds of decisions for which a thing substantially and directly related to the decision is done by such programs. Clause 1.9 says making a decision includes refusing or failing to make one, and that a decision may affect rights or interests whether the effect is adverse or beneficial. The examples written into 1.9 are a decision under an Act or legislative instrument to grant or refuse a benefit, a decision that affects rights under a contract, agreement or arrangement, and a decision that affects access to a significant service or support.
The application provision says this applies to decisions made after commencement, whether the arrangement, the use of the personal information, and the acquisition or creation of that information happened before or after 10 December 2026. A model you deployed in 2025 is not grandfathered for decisions made after the start date.
The OAIC fact sheet, opened 10 November 2026, says a computer program includes rules, artificial intelligence, machine learning, ordinary software, and generative AI, including chatbots. A decision can be in scope even with human review, and even if the program does not replace the whole process. "Substantially" means a key factor in the human's decision. "Directly" means a direct connection with making it. The fact sheet says machine-learning or generative output for a decision that significantly affects rights or interests would generally be in scope unless there is extensive human oversight and control. The impact must both be more than trivial and have the potential to considerably influence the individual's circumstances or outcomes; satisfying only the first part understates the OAIC threshold. If in doubt, the OAIC says include the clause 1.8 information.
What the policy must not become, according to the same fact sheet, is a dump of granular technical detail. Individuals should be able to understand the handling. Categories may be grouped, but the detail must be meaningful to a reasonable person, and health information or biometric templates should be clear if they are used. Commercial-in-confidence material and trade secrets are described as outside the obligation. The fact sheet says embarrassment is not commercial-in-confidence. A vendor of the software is expected to give the decision-maker enough high-level information to write the policy. The OAIC generally expects the transparency obligation to stay with the entity that uses the personal information to make the decision.
The OAIC's APP 1 guidelines, version 2.0, updated 30 September 2026, state the same start date and the same three conditions. APP 1.2, which is already in force, requires reasonable steps to implement practices, procedures and systems that ensure compliance and that let the entity handle inquiries and complaints. A register of decision systems is one way to have the facts those documents ask for. It is not itself a clause of the Act.
What to choose and why
| Control | What it is for | What it does not decide |
|---|---|---|
| Keep personal information, and especially sensitive information, out of public generative tools | OAIC best practice, and the difficulty of deletion once a prompt has left | Whether a named enterprise contract is a use or a disclosure |
| Record the purpose before the prompt is sent | APP 6's primary purpose, and the OAIC's split between doing the original job and training a model | Whether a customer would "reasonably expect" a secondary use |
| Store model text about a person as model text until a person checks it | APP 10, and the OAIC's point that a probabilistic output is not a fact | Whether the output is accurate in a dispute |
| Name the service, the location, and who can read logs | APP 8.1's reasonable steps, section 16C, and the overseas lines already required in the policy and the collection notice | Whether a foreign law is "substantially similar" |
| Protect and expire prompt stores as you do other personal information | APP 11, including technical and organisational measures in this compilation | Whether a given breach is an eligible data breach |
| From now, list systems that advise or decide, the kinds of personal information, and how much a human can change the outcome | The facts APP 1.8 will ask for on 10 December 2026, including for arrangements that already exist | Whether a particular workflow "significantly affects" someone |
Engineering recommendation, not a compliance opinion: block public generative tools on any path that can see customer records; require an internal tool to declare its purpose and region before it accepts a prompt; keep the decision register even where a lawyer may later say a workflow is out of scope. The fact sheet tells entities in doubt to include the information.
Risks and limits
- This is not legal advice. It is not a privacy impact assessment, a collection notice, or a policy you can publish.
- Compilation No. 104 shows the Act as amended and in force on 4 June 2026. A later compilation, a regulation prescribing a country for APP 8.3, or a court decision can change the picture. The automated-decision text quoted here is the amending Act, because that text had not commenced when the compilation was made.
- The OAIC materials are guidance. The fact sheet says it does not cover every privacy obligation and should be read with the Act. The AI products guide says the same, and says it does not cover other regulatory regimes.
- Whether your organisation is an APP entity, whether an exemption applies, and whether a vendor is an overseas recipient, are legal conclusions. The article stops at the definitions and the controls.
- "Extensive human oversight" is the OAIC's phrase for when a generative output may fall outside the new transparency rule. A button labelled "approve" is not, by itself, that oversight. What counts is a question for counsel against the real workflow.
- No command was run and no customer record was processed.
Sources
Sources checked on 10 November 2026; access limitations are identified below.
- Privacy Act 1988 (Cth), Compilation No. 104, 4 June 2026, C2026C00227 — https://www.legislation.gov.au/C2004A03712/2026-06-04/2026-06-04/text/original/epub/OEBPS/document_1/document_1.html. Section 6 definitions, APP 1.1–1.6, APP 3, APP 5.2, APP 6.1–6.2, APP 8, APP 10, APP 11, section 16C, Part IIIC guide.
- Privacy and Other Legislation Amendment Act 2024 (Cth), assented to 10 December 2024 — https://www.legislation.gov.au/C2024A00128/asmade/2024-12-10/text/original/epub/OEBPS/document_1/document_1.html. Commencement table item 7; APP 1.7–1.9; application to pre-existing arrangements.
- OAIC, Guidance on privacy and the use of commercially available AI products, published 21 October 2024, updated 17 January 2025 — https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/guidance-on-privacy-and-the-use-of-commercially-available-ai-products.
- OAIC, APP Guidelines, Chapter 1, version 2.0, updated 30 September 2026 — https://www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-guidelines/chapter-1-app-1-open-and-transparent-management-of-personal-information.
-
OAIC, APP 1.7–1.9 Transparency Obligation fact sheet — https://www.oaic.gov.au/__data/assets/pdf_file/0021/269013/APP-1.7-1.9-Transparency-Obligation-Fact-Sheet.PDF.
-
OAIC, Guidance on privacy and developing and training generative AI models — https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/guidance-on-privacy-and-developing-and-training-generative-ai-models. Consult separately for development and training obligations.
This article was originally published on .