If anyone in your business uses ChatGPT or a similar tool, someone has probably pasted in something they should not have: a customer email, a résumé, a spreadsheet of contacts. That raises real privacy questions.

The core problem

Personal information is any information about an identifiable person. When it goes into a public AI tool, you may have disclosed it to an overseas provider without telling the person. The Office of the Australian Information Commissioner (OAIC) has published guidance on this, and its general advice is to avoid entering personal information into publicly available AI tools.

Where the Privacy Act comes in

  • You need to say in your privacy policy how you use personal information and whether it goes overseas
  • You should only use personal information for the purpose it was collected, or a related purpose people would reasonably expect
  • You are responsible for the security of personal information you hold
  • From 10 December 2026, if you use automated decision-making that significantly affects people, you need to disclose it in your policy

Practical steps

  1. Decide which AI tools staff may use, and write it down in half a page
  2. Ban pasting in customer names, contact details, health or financial information unless the tool is approved
  3. Check the terms of any tool you approve, including whether your data is used for training
  4. Update your privacy policy to mention the tools and any overseas disclosure
  5. Check any chatbot on your own website for what it collects

Not a reason to avoid AI

Used carefully, AI tools are fine. The risk is using them without a rule and without telling customers.

This is general information, not legal advice. For advice on your own use of AI tools, speak with a qualified privacy lawyer.