AI · Privacy
Using AI tools with personal information: privacy rules in Australia
How the Privacy Act applies when you put personal information into AI tools, or use it to train AI models, based on the OAIC’s guidance.
By the ITLAW Team · Last reviewed November 2026 · General information, not legal advice
Guides › AI & Automated Decisions › AI and privacy
The OAIC has published two guides on AI: one for businesses using commercially available AI products, and one for developers training generative AI models. Both confirm that the Privacy Act 1988 (Cth) applies to AI in the same way it applies to any other technology. For the wider regulatory picture, see our AI law guide.
Key takeaways
- Entering personal information into an AI tool is a use or disclosure under the APPs.
- AI-generated information about a person, including inferences and errors, can be personal information.
- Training AI on personal information is a separate purpose that may require consent.
Using commercial AI products
- Purpose: use personal information in AI tools only for the purpose it was collected, or a related purpose the person would reasonably expect (APP 6).
- Best practice: the OAIC recommends not entering personal information, particularly sensitive information, into publicly available generative AI tools.
- Due diligence: understand how the product works, its limitations, and how the provider handles and retains your data.
- Transparency: update your privacy policy and collection notices so people know how AI is used with their information (APP 1 and APP 5).
Accuracy of AI outputs
Generative AI can produce plausible but wrong statements about real people. Under APP 10 you must take reasonable steps to ensure information you use or disclose is accurate, up to date, complete and relevant. That means human review before AI output about an individual is relied on, plus a way to correct errors.
Training and fine-tuning AI models
Using customer data to train or fine-tune a model is likely to be a secondary purpose. Unless people would reasonably expect it, consider obtaining consent or using de-identified data. Scraping publicly available personal information from the internet does not avoid the APPs: collection must still be lawful, fair and reasonably necessary.
Overseas providers
Many AI providers process data offshore. Before disclosing personal information to them, consider APP 8 and whether you remain accountable for their handling.
Automated decisions
From 10 December 2026, if AI is used to make, or substantially help make, significant decisions about individuals, your privacy policy must explain it. Read our automated decision-making article.
Ask a lawyer a quick question
Not sure how this applies to you? Send a short question and an ITLAW lawyer will get back to you, usually within one business day.
Frequently asked questions
Can I put customer data into ChatGPT?
Only if the use is consistent with why you collected the data and the risks are managed. The OAIC recommends not entering personal information, especially sensitive information, into publicly available generative AI tools.
Is AI-generated information personal information?
It can be. Information or opinions generated by AI about an identified or reasonably identifiable person, including inferences and errors, can be personal information.
Do I need consent to train AI on customer data?
Often, unless the training is a related purpose customers would reasonably expect. De-identifying data first reduces the risk.
Talk to a lawyer
Speak to an ITLAW lawyer about your situation.
Need advice on AI and privacy?
Our guides are general information. For advice on your circumstances, send us an enquiry and an ITLAW lawyer will get back to you, usually within one business day.