If your business turns over more than $3 million a year, or you're a health service, trade in personal information, or contract to government, the Privacy Act applies to you whatever your size, and that includes how you use AI. From 10 December 2026, covered businesses must also say in their privacy policy when computer programs make or help make decisions that significantly affect people. Most smaller businesses are exempt, but following the same rules is cheap and it's what customers and bigger clients expect.
This guide is general information, not legal advice. It's written for owners who want to know where they stand before they put AI to work on customer emails, quotes and records.
Does the Privacy Act apply to my business?
The Privacy Act 1988 and its Australian Privacy Principles apply to businesses with annual turnover above $3 million. Below that, most businesses are exempt, with important exceptions. The Act still applies to you, at any size, if you:
- Provide a health service and hold health information. This catches more businesses than people expect, including allied health, clinics and some fitness businesses.
- Trade in personal information, such as buying or selling customer lists.
- Contract to the Australian Government to provide services.
- Have chosen to opt in to being covered.
If you're unsure, the Office of the Australian Information Commissioner (OAIC) has a checklist, linked below.
What does the regulator say about putting customer data into AI?
The OAIC published guidance on using commercially available AI products in October 2024. Its key points, in plain English:
- Don't put personal information into public AI toolsAs best practice, the OAIC recommends businesses don't enter personal information, and particularly sensitive information, into publicly available generative AI tools.
- Check the product before you use itKnow what the AI company does with your data, where it's stored and who can access it.
- Be open about itSay in your privacy policy how you use AI with personal information.
- AI-made information counts tooIf AI generates or infers personal information about someone, that's treated as collecting it.
- Use it for the purpose you collected itInformation collected to deliver an order shouldn't be fed into AI for an unrelated purpose without consent.
A business AI account with training switched off, used under a clear policy, is very different from staff pasting customer details into free tools. We explain the difference in is Claude safe for business data.
What changes on 10 December 2026?
Amendments passed in 2024 add a new transparency rule for automated decisions. From 10 December 2026, if your business is covered by the Privacy Act and uses computer programs, including AI, to make or substantially help make decisions that could significantly affect someone's rights or interests, your privacy policy must describe:
- the kinds of personal information those programs use,
- the kinds of decisions made by programs alone, and
- the kinds of decisions where a program does something substantially and directly related to making the decision.
"Significantly affect" is the key phrase. AI drafting a reply that a person checks and sends is very unlikely to count. AI automatically deciding who gets credit, a refund, a job interview or a price is the kind of thing the rule is aimed at. The OAIC published guidance on this in September 2026.
The simplest way to stay well clear: keep a person making the decisions that matter. That's how we set up every business anyway: AI prepares, a person decides.
What other rules apply?
| Rule | What it means for AI use | Who it applies to |
|---|---|---|
| Notifiable Data Breaches scheme | If personal information is exposed and serious harm is likely, you must assess it within 30 days and notify affected people and the OAIC | Businesses covered by the Privacy Act |
| Serious invasions of privacy | People can sue for a serious invasion of their privacy, in force since 10 June 2025 | Not limited to businesses covered by the Privacy Act |
| Australian Consumer Law | Misleading claims are banned whether a person or AI wrote them, including fake reviews | Every business |
| Spam Act | Marketing emails and texts need consent and an unsubscribe, however they're written | Every business |
Do I have to tell customers I use AI?
There's no Australian law that requires you to label AI-generated content. The Government's guidance on being clear about AI-generated content is voluntary, and says it depends on context. What the law does require is that you don't mislead people, so don't present AI messages as personally written by someone who never read them, and don't use AI for fake reviews or testimonials.
A good rule: be upfront wherever a customer would care. A line in your privacy policy, and honesty if a customer asks, covers most small businesses.
What should a small business do, covered or not?
The Government's Guidance for AI Adoption, published by the National AI Centre in October 2025, boils responsible AI use down to six practices. For a small business they look like this:
| Practice | In a small business |
|---|---|
| Decide who is accountable | One named person owns your AI use and your policy, usually the owner |
| Understand the impact | List which jobs AI does and who they affect |
| Measure and manage risk | Sort your information into green, amber and red |
| Share essential information | Mention AI in your privacy policy and be honest when asked |
| Test and monitor | Check AI work before it goes out, and spot-check jobs that run on their own |
| Keep human control | A person approves anything that reaches a customer or spends money |
Most of that fits on one page. Our free AI use policy template covers it.
Common questions
Does the Privacy Act apply to small businesses?
Most businesses with annual turnover of $3 million or less are exempt. The exceptions include health service providers, businesses that trade in personal information, government contractors and businesses that opt in. Those are covered at any size.
Can I put customer information into ChatGPT or Claude?
The OAIC recommends not entering personal information, especially sensitive information, into publicly available AI tools. A business plan your company controls, where data isn't used for training by default, is a different situation, but you should still limit what goes in to what each job needs.
What is the automated decision-making rule?
From 10 December 2026, businesses covered by the Privacy Act must say in their privacy policy when computer programs use personal information to make, or substantially help make, decisions that could significantly affect people. It doesn't stop you using AI. It requires you to be open about it.
Do I need a privacy policy if I'm exempt?
Not legally, in most cases. But having one builds trust, bigger clients often ask for it, and if you collect any information through your website it's good practice. Keep it short and honest.
Is this legal advice?
No. It's general information as at November 2026. For advice on your situation, talk to a lawyer or check the OAIC's guidance directly.
- OAIC: Guidance on privacy and the use of commercially available AI products
- OAIC: New resources on transparency for AI and automated decision-making
- OAIC: Rights and responsibilities under the Privacy Act
- OAIC: Statutory tort for serious invasions of privacy
- OAIC: Notifiable data breaches
- National AI Centre: Guidance for AI Adoption
- National AI Centre: Being clear about AI-generated content