If you run a business in Australia and use AI tools, you're probably asking which privacy laws apply to you. The Privacy Act is part-way through a two-stage reform, and AI is now a normal part of doing business. So the legal rules are changing fast.
The truth is, privacy law around AI isn't simple. No five-minute checklist will make you compliant overnight. But there are clear steps you can take to learn what you must do and to protect your business.
This guide cuts through the legal fog. It explains what Australian privacy laws mean for your business when you use AI tools. That covers everything from chatbots on your website to AI search and analysis platforms.
What the New Privacy Rules Actually Mean for Small Businesses Using AI
The Privacy Act 1988 already covers many AI activities. Recent reforms have already made the penalties steeper, and the next stage would make your duties clearer. For most small businesses, this means you'll need to think harder about how you collect, use and store customer data when AI is involved.
Here's what that looks like in practice. Say you run a physio clinic and use an AI booking system that learns from patient preferences. Then you're handling personal information. Or say you're a tradie with an AI chatbot on your website that remembers customer details. The same rules apply.
Two things matter most right now. First, the regulator already has stronger powers and more ways to fine businesses, from reforms passed in December 2024. Second, the rules on data breaches are firm. If you suspect a data breach, you must assess it quickly, within 30 days at most. If it is likely to cause serious harm, you must tell the Office of the Australian Information Commissioner (OAIC) and the people affected as soon as practicable.
A timeline of which privacy changes are already law, which one starts in December 2026, and which are still only proposed
Timeline of Australian privacy law changes from 2018 to 2026, from the data breach scheme and higher penalties to the privacy tort, rules for automated decisions and the draft second stage
Consent rules may also change. Current law allows for "implied consent" in some cases. The draft second stage would add a test that any handling of personal information must be fair and reasonable, with consent as one part of that test. That is a proposal, not the law today.
For small businesses, this doesn't mean you can't use AI tools. It means you need to think about which tools you choose and how you set them up. You also need to think about what you tell customers about how their data is used.
Which Australian Privacy Laws Apply to AI Tools Right Now
The Privacy Act 1988 is the main law on how Australian businesses handle personal information. That includes when AI is involved. If your business has an annual turnover of more than $3 million, you're covered automatically. But many smaller businesses are also covered if they handle health or credit information.
Under the current Privacy Act, thirteen Australian Privacy Principles (APPs) set out how you must handle personal information. They apply whether you handle data by hand or use advanced AI systems.
The principles that matter most for AI use include:
- APP 1: Open and transparent management of personal information
- APP 3: Collection of solicited personal information
- APP 6: Use or disclosure of personal information
- APP 11: Security of personal information
State privacy laws may also apply, depending on your industry. Health service providers have extra duties under state health privacy acts. And businesses that handle staff details must think about workplace privacy laws.
A visual guide to the Australian privacy laws that apply right now to businesses that use AI tools and chatbots
Diagram of how Australian privacy laws apply when you use AI tools, including the Privacy Act 1988, the Spam Act 2003, state health privacy acts and the Consumer Data Right
The Spam Act 2003 also comes into play if you use AI to personalise marketing messages. The same goes if you use AI to analyse customer behaviour for email campaigns. The Consumer Data Right is still rolling out across industries. It may also affect how you handle customer data in AI systems.
This part is key: these laws apply no matter where your AI tools are hosted. Say you use a US-based AI chatbot service to talk with Australian customers. Australian privacy law still governs how you collect and use that data.
What Counts as Personal Information When AI is Involved
Under Australian law, personal information is "information or an opinion about an identified individual, or an individual who is reasonably identifiable." When AI is involved, this gets more complex.
Classic personal details like names, email addresses and phone numbers clearly count. But AI systems often work with personal data that is less obvious. IP addresses, device IDs, behaviour patterns and preference profiles can all count as personal information. That's the case if they relate to a person who can be identified.
Think about a cafe that uses an AI system to track what customers like. The customers may not be named. But the system might link ordering patterns to specific people (through payment cards, loyalty programs or device recognition). If it can, that's personal information under the Privacy Act.
The OAIC gives guidance on what counts as personal information. It notes that data doesn't need to name someone to be personal. You might be able to reasonably identify a person from the data, on its own or combined with other data. If so, it's personal information.
A full breakdown of what counts as personal information when AI tools are involved, including edge cases and inferences
Visual guide with examples of personal information in AI systems, from clear identifiers like names to less obvious data like behaviour patterns and scores made by AI
AI systems that make inferences or predictions about people are especially tricky. Say your business uses AI to score how likely customers are to buy, or to rate their risk. Those scores may count as personal information, even though an algorithm made them.
Sensitive information has stricter rules on how you handle it. This includes health details, biometric data, and details about racial or ethnic origin. Many AI apps collect or infer sensitive information by accident. This happens especially through voice recognition, image analysis or profiling how people behave.
What Are Your Obligations if You Use an AI Chatbot or Search Tool on Your Website
Running an AI chatbot or search tool on your website creates specific privacy duties. Many business owners miss them. These tools usually collect personal data through chats, search queries and tracking of how users behave.
First, you must have a clear privacy policy. It must explain how the AI system collects, uses and stores personal information. The policy needs to be easy to find on your website and written in plain language. Generic privacy policies often don't properly cover how AI tools handle data.
Your privacy policy should spell out:
- What data the AI system collects (including chat logs, search queries and data on what users do)
- How this data is used (to train AI models, improve services or personalise what people see)
- Whether data is shared with third parties (including the AI service provider)
- How long data is kept
- How people can access, correct or delete their data
Consent rules depend on how you use the data. If your chatbot only uses data to answer the query in front of it, you might rely on implied consent. But the system may learn from chats to personalise future visits, or share data with third parties. If so, you likely need explicit consent.
Security duties are especially important for AI tools. The Privacy Act requires you to protect personal information from misuse, interference and loss. It also requires you to protect it from unauthorised access, modification or disclosure. With AI systems, this includes securing data sent to and from AI service providers.
A detailed compliance plan for businesses that use AI chatbots or search tools on their websites
- A clear privacy policy that explains how AI collects and uses data
- The right way to get consent, based on why the data is processed
- Security that protects data sent to AI providers
- Regular checks of what data chatbots collect and keep
- Steps for handling requests to access or delete data
- Steps for reporting a breach when an AI system has an incident
- Staff training on privacy duties when they use AI
- Records of how data flows through AI systems and how long it is kept
Step-by-step compliance needs for businesses that run AI chatbots, showing privacy policy rules, ways to get consent, security duties and the steps to take after a breach
Many firms don't realise they stay responsible for privacy compliance, even when they use third-party AI services. If your chatbot provider has a data breach, you may still need to tell the people affected and the OAIC.
Some businesses use AI agents for customer service or lead generation. They have more to think about. Make sure the AI doesn't collect more data than the stated purpose needs. And set up the right access controls.
The Privacy Act Reforms Coming in 2026: What is Changing and When
The reforms are coming in two stages. The Australian Government agreed, fully or in principle, to most proposals from the Privacy Act Review. The first stage passed in December 2024. A draft of the second stage was released for public comment in August 2026. It is not law yet.
Some first-stage changes already apply. A statutory tort for serious invasions of privacy started on 10 June 2025. This means people can sue a business for a serious invasion of their privacy that was intentional or reckless.
One more first-stage change starts on 10 December 2026, and it matters for AI. Your privacy policy must explain when a computer program uses personal information to make, or help make, decisions that could significantly affect people. Some AI tools will be caught by this.
The legal meaning of personal information may expand to clearly include technical data like IP addresses and device IDs. This change would bring more AI apps clearly under privacy law. That's especially true for apps that track and profile people.
New rights for people that are being considered include:
- The right to object to automated decisions
- Stronger rights to access and correct personal data
- The right to data portability (taking your data elsewhere) in some cases
- Stronger rights to have data erased (the "right to be forgotten")
The OAIC's powers to enforce the law have already grown. For a serious interference with privacy, the maximum penalty for a company is $50 million or more. Since December 2024, lower penalty tiers and infringement notices also cover less serious breaches. So the fines are no longer reserved for the biggest cases.
Under the proposed second stage, privacy impact assessments may be required for high-risk processing, including some AI uses. Businesses may need to assess privacy risks before they start using new AI tools. This especially applies to tools that make automated decisions or process sensitive information.
The second stage has no start date yet. Public comment on the draft closed in September 2026. If it passes, some changes may be phased in over several years to give businesses time to comply.
What You Need to Have in Place Before Regulators Start Asking Questions
Regulators now have more ways to act on privacy breaches, as the reform section above explains. Having proper records and processes in place isn't just good practice. It's essential protection.
Start with a full audit of how your business uses AI tools. Write down every system that processes personal information, including:
- Customer service chatbots
- Marketing automation tools
- Analytics and tracking systems
- AI-powered search tools
- Tools that make automated decisions
For each AI system, record what personal data it collects and how it's used. Also note where it's stored, who has access and how long it's kept. These records are vital if you face a privacy complaint or investigation.
Your privacy policy must match how you actually use AI. Many firms use template policies that don't cover AI tasks. Think about having a privacy lawyer review your policy. They can check that it covers what you really do, not just general privacy principles.
Put the right security in place for AI systems. That includes securing the data you send to AI service providers and using strong sign-in checks to access systems. It also includes checking who has access on a regular basis. With cloud-based AI services, pay close attention to where data is stored and what security standards apply.
Set up clear steps for handling privacy rights requests. People can ask to access their personal data and to correct anything that's wrong. In some cases, they can also ask for it to be deleted. With AI systems, this can be complex. That's especially true if the data has been used to train machine learning models.
Staff training is vital. Staff who work with AI systems or customer data need to understand their privacy duties. That includes knowing what counts as personal information, when to ask for consent and how to handle privacy complaints.
Are you planning full SEO and AI optimisation strategies? Then build privacy compliance into your plans from the start. Don't add it as an afterthought.
Common Mistakes Australian SMBs Make with AI and Customer Data
Many Australian small businesses make the same mistakes when they start using AI tools. Often they don't realise they're creating privacy risks. Knowing these common traps can help you avoid costly compliance problems.
One common mistake is assuming privacy law doesn't apply to small businesses. Businesses with annual turnover under $3 million aren't automatically covered by the Privacy Act. But many are still covered if they handle health information or provide credit services. The same goes if they are related bodies corporate of larger entities.
Another common error is leaving privacy compliance entirely to your AI service providers. Providers may offer privacy-compliant tools. But you're still responsible for how you collect, use and disclose personal information. You need to read and understand your provider's terms.
Many businesses add AI chatbots without updating their privacy policies. Does your privacy policy mention automated processing, chatbot conversations or AI analysis? If not, you're likely not meeting the transparency rules under APP 1.
Collecting more data than you need is a common problem with AI tools. An AI system may be able to analyse detailed customer behaviour. That doesn't mean you should collect and process all the data you can. APP 3 requires that what you collect is reasonably necessary for your business functions.
Failing to secure the data you send to AI services is another common slip. You may be sending customer data to cloud-based AI tools without encryption or proper security. If so, you may be breaching APP 11.
Many firms don't understand their duties around keeping data. AI systems often keep data from every interaction with no time limit. But privacy law generally requires you to destroy or de-identify personal information once you no longer need it for the original purpose.
Poor consent practices are widespread. Pre-ticked boxes can create compliance problems. So can burying consent in terms and conditions, or failing to explain how AI systems use personal data.
When You Need a Lawyer, and When You Can Handle It Yourself
Not every privacy question needs legal advice. But knowing when to get expert help can save you from costly mistakes. How complex your AI setup is, and how sensitive your data is, should guide this choice.
You likely need legal advice if you're:
- Running health data or other sensitive data through AI systems
- Making automated decisions that significantly affect people (loan approvals, job decisions, insurance assessments)
- Working in a regulated industry with its own privacy rules
- Facing a privacy complaint or OAIC investigation
- Setting up complex AI systems that build or analyse detailed customer profiles
For simple AI setups, you may be able to handle compliance yourself. This includes basic customer service chatbots and simple website analytics. It also includes AI tools that don't store or analyse personal data.
A privacy impact assessment can help you work out whether you need legal advice. Your AI setup might carry high privacy risks or use personal data in new ways. Or it could significantly affect people. In those cases, expert advice is worth it.
Think about the cost of getting it wrong. Privacy breaches can lead to notable penalties, an investigation by the regulator and damage to your reputation. For many businesses, the cost of early legal advice is small next to the compliance costs they could face.
There are some middle-ground options. You could use privacy consultants for specific assessments, or go to industry workshops on AI privacy compliance. You could also use resources from professional bodies and the OAIC.
Remember that privacy law is complex, and it's changing fast where AI is concerned. Something that looks simple may hide compliance risks. Those risks may not be clear to you without legal training.
Where to Start This Week
Your first steps toward AI privacy compliance don't need a full overhaul of your business systems. Start with these practical actions. You can finish them this week.
First, audit the AI tools you use now. Make a simple list of every AI system your business uses. Include chatbots, analytics tools, marketing automation and any AI features in your current software. Don't miss AI that's built into platforms you already use.
For each AI tool, work out what personal data it might collect. This includes obvious data like names and email addresses. But it also includes IP addresses, data on how people behave and any data that could identify a person.
Review your current privacy policy. Does it mention AI, automated processing or decisions made by algorithms? If not, you likely need to update it. You may not be required to have a privacy policy under current law. Even so, having one shows good privacy practice.
Check your agreements with AI service providers. What do they say about data handling, security and your duties? Many businesses sign up for AI services without reading the privacy terms. Later they find they've agreed to data practices that don't fit with Australian privacy law.
Put basic security in place for any AI system that handles personal data. Use strong passwords and turn on two-factor authentication where you can. Also make sure data is encrypted when it's sent.
Start writing down how you handle data. You don't need a full data map straight away. But begin recording what data you collect, why you collect it and how long you keep it.
Think about whether you need to update what you tell customers. You may be using AI in ways that aren't obvious to them. If so, you may need to explain these practices more clearly.
Ready to take a fuller approach to AI and compliance? Professional guidance can help you work through both the technical and legal details.
The key is to start with small steps you can manage. Don't try to solve everything at once. Privacy compliance for AI is an ongoing process, not a one-time checklist.
Frequently Asked Questions
Do small businesses need to comply with AI privacy laws in Australia?
Many small businesses must comply with privacy laws when they use AI. This is especially the case if they handle health data or have turnover above $3 million. Even smaller businesses should follow privacy best practice.
What happens if my AI chatbot collects personal information without consent?
Collecting personal data without the right consent may breach the Privacy Act. You could face complaints, an OAIC investigation and penalties. Maximum penalties rose in 2022, and since December 2024 smaller fines also apply to less serious breaches.
Can I rely on my AI service provider for privacy compliance?
No. Providers may offer compliant tools. But you're still responsible for how you collect, use and disclose personal information. You must make sure your use of AI tools complies with Australian privacy law.
When do I need to update my privacy policy for AI tools?
Update your privacy policy whenever you start using AI tools that collect, analyse or store personal data. Your policy should clearly explain how AI systems handle customer data.
What's the biggest privacy risk for businesses using AI?
The biggest risk is often using AI tools without knowing what personal data they collect or how it's processed. This can lead to privacy breaches you didn't mean to cause, and to compliance failures.
