Australia's AI Privacy Landscape Is Changing Fast
In January 2026, the Office of the Australian Information Commissioner (OAIC) launched its first-ever privacy compliance sweep focused on AI. The OAIC is examining how Australian businesses collect, use, and disclose personal information through AI products and services. Penalties for non-compliant privacy policies can reach $66,000 per infringement.
By December 2026, new transparency obligations around automated decision-making will take effect. If your business uses AI to make or influence decisions about individuals, you may be required to disclose that fact and explain how the AI reaches its conclusions.
This is not a reason to avoid AI. It is a reason to adopt it responsibly. The businesses that implement AI with proper privacy controls now will be well-positioned when regulations formalise, while competitors who delayed will scramble to retrofit compliance onto systems built without it.
What the OAIC Expects From Businesses Using AI
The OAIC's guidance on AI and privacy outlines specific expectations for businesses using commercially available AI products. Here are the key requirements in practical terms.
Privacy Impact Assessments
Before deploying any AI tool that processes personal information, you should conduct a privacy impact assessment. This does not need to be a 50-page legal document. It needs to answer: what personal information will the AI process, how will it be used, where will it be stored, who will have access, and what are the risks if something goes wrong.
For most small businesses, this is a one to two page document per AI tool. For larger deployments, a more detailed assessment may be warranted. The point is to demonstrate that you considered privacy before deploying the technology, not after a complaint is filed.
Transparency With Customers
If AI is handling customer interactions, customers should know. This does not mean every AI-generated email needs a disclaimer. It means your privacy policy should explain that you use AI tools, what types of data they process, and how customers can contact a human if they prefer.
For AI receptionists and chatbots, a simple disclosure at the start of the interaction is sufficient: "You are speaking with an AI assistant. If you would like to speak with a person, please say so at any time."
Data Minimisation
Only collect and process the personal information that is necessary for the AI to perform its function. If your AI receptionist only needs a caller's name, phone number, and reason for calling, do not configure it to collect additional personal information that is not needed for the task.
Security
AI tools that process personal information must be secured against unauthorised access, just like any other system handling personal data. This includes access controls (who on your team can access the data), encryption in transit and at rest, regular security updates, and vendor security assessments.
Human Oversight
The OAIC emphasises that AI should not make consequential decisions about individuals without human oversight. For business applications like customer service, scheduling, and document processing, this is straightforward: the AI handles routine tasks and escalates anything consequential to a person.
The Automated Decision-Making Transparency Obligations
New provisions taking effect in December 2026 require businesses to be transparent when AI is used to make decisions that significantly affect individuals. Here is what this means in practical terms.
What Counts as an Automated Decision
A decision is automated if an AI system makes or substantially influences it without meaningful human review. Examples include: automatically approving or rejecting loan applications, using AI to screen job applicants, algorithmically determining pricing based on individual customer data, and using AI to assess insurance claims.
Routine business uses of AI, such as answering phone calls, scheduling appointments, or processing documents, are generally not caught by these provisions because they are not making decisions that significantly affect individuals.
What You Need to Disclose
If your business makes automated decisions that significantly affect individuals, you will need to: inform the individual that the decision was made or influenced by AI, explain the logic involved in a way the individual can understand, and provide a mechanism for the individual to request human review of the decision.
What Most Small Businesses Need to Do
For the majority of Australian SMEs using AI for customer service, admin, and operations, the December 2026 changes require minimal action. If you are using an AI receptionist to answer calls, an AI chatbot to handle enquiries, or AI tools to process documents, you are not making automated decisions about individuals. You are automating business processes.
The businesses most affected are those in financial services, insurance, human resources, and healthcare, where AI is used to assess, score, or make decisions about people.
Practical Compliance Checklist for Australian Businesses
Step 1: Inventory Your AI Tools
List every AI tool your business uses, including tools embedded in existing software. For each tool, document: what personal information it processes, where the data is stored, who the vendor is and where they are based, and what security measures are in place.
Step 2: Update Your Privacy Policy
Your privacy policy should disclose that you use AI tools and explain in general terms how they process personal information. The OAIC does not require you to explain the technical workings of your AI. It requires you to be honest and transparent about the fact that you use it.
Step 3: Conduct Privacy Impact Assessments
For each AI tool that processes personal information, complete a privacy impact assessment. Focus on identifying risks and documenting the controls you have in place to mitigate them.
Step 4: Review Vendor Agreements
Check that your AI vendors have appropriate data processing agreements in place. Key provisions to look for: data is processed only for the purposes you specify, data is stored in Australia or approved jurisdictions, the vendor has appropriate security measures, and the vendor will notify you of any data breaches.
Step 5: Train Your Team
Ensure your staff understand how to use AI tools in compliance with your privacy obligations. This does not require extensive training. A clear set of guidelines covering what information can and cannot be shared with AI tools is sufficient for most teams.
Not sure if your AI setup is compliant? Request a free consultation with Whitecrow AI and we can review your current tools and recommend adjustments.
Common Misconceptions About AI and Australian Privacy Law
"We cannot use AI because of privacy concerns"
Privacy law does not prohibit AI use. It requires responsible AI use. Businesses that implement proper privacy controls can use AI tools with confidence. The OAIC's guidance is designed to enable responsible adoption, not prevent it.
"Cloud-based AI violates Australian data sovereignty"
There is no general requirement for data to be stored in Australia. However, if you transfer personal information overseas, you must take reasonable steps to ensure the overseas recipient handles the information in accordance with the APPs. Major AI providers like OpenAI, Anthropic, and Google offer data processing options that meet Australian requirements.
"We need a lawyer to use AI"
For standard business uses of AI (customer service, admin, document processing), you do not need legal advice to get started. Follow the OAIC's published guidance, conduct basic privacy impact assessments, and update your privacy policy. If your use case involves automated decision-making about individuals or processing sensitive health or financial information, legal advice is recommended.
"Small businesses are exempt from privacy law"
Businesses with annual turnover under $3 million are generally exempt from the Privacy Act, but there are important exceptions: businesses that provide health services, trade in personal information, are related to organisations covered by the Act, or have opted in. Even exempt businesses should follow good privacy practices as a matter of customer trust and risk management.
Choosing AI Vendors With Good Privacy Practices
When evaluating AI tools for your business, ask potential vendors these questions:
- •Where is data processed and stored? Preference for Australian or approved jurisdiction hosting
- •How is data secured? Look for encryption, access controls, and regular security auditing
- •Is data used to train AI models? Some providers use customer data to improve their models. Understand whether your data contributes to training and whether you can opt out
- •What happens to data when I cancel? Ensure data is deleted when you end the service, not retained indefinitely
- •Does the vendor have a data processing agreement? This formalises the vendor's obligations around handling your data
Whitecrow AI builds AI solutions with Australian privacy requirements embedded from the start. Every system we deploy includes data minimisation, encryption, access controls, and clear data handling documentation.
Frequently Asked Questions
Does the OAIC compliance sweep affect my business?
If your business uses AI tools that process personal information, the OAIC sweep is relevant to you. The sweep is assessing how businesses disclose AI use in their privacy policies and whether they have appropriate safeguards. Review your privacy policy and ensure it mentions your use of AI tools.
What are the penalties for non-compliance?
Penalties for privacy breaches can reach $66,000 per infringement for individuals and significantly more for bodies corporate. However, the OAIC's approach has historically focused on education and compliance guidance before pursuing penalties. Demonstrating good faith effort to comply goes a long way.
Do I need to tell customers they are talking to an AI?
There is no explicit legal requirement to disclose AI in every interaction, but transparency is both an OAIC expectation and good practice. A simple disclosure at the start of an AI interaction builds trust and avoids any suggestion of deception.
Can I use ChatGPT for business without violating privacy law?
You can, provided you do not input personal information into ChatGPT without considering the privacy implications. Do not paste customer details, employee records, or other personal information into general-purpose AI tools unless you understand how the data will be stored and used. Enterprise versions of AI tools typically offer better data handling controls.
How often should I review my AI privacy practices?
Review annually at minimum, and whenever you deploy a new AI tool or the regulatory landscape changes. The December 2026 transparency obligations are a natural trigger for a review.
Navigating AI compliance can feel complex, but it does not have to be. Request a free consultation with Whitecrow AI for practical guidance on using AI responsibly in your Australian business.