AI and Privacy: What Australian Businesses Must Know in 2026
Updated privacy regulations affect how you can use AI tools with customer data. Here's your compliance checklist.
The updated Privacy Act has real teeth. Businesses found misusing customer data with AI face fines up to $50 million or 30% of turnover. The good news: compliance isn't complicated if you follow basic principles around consent and data handling.
Australia's updated Privacy Act includes specific provisions for AI use. Here's what you need to know.
Key Changes Effective 2026:
- **AI Disclosure Requirement**: You must tell customers when AI makes decisions affecting them
- **Training Data Restrictions**: Customer data can't be used to train AI without explicit consent
- **Right to Human Review**: Customers can request human review of AI decisions
- **Data Minimisation**: Only collect data necessary for the AI function
Compliance Checklist:
**For Customer Service AI:** - [ ] Disclose AI use in chat interfaces ("You're chatting with our AI assistant") - [ ] Provide option to speak with a human - [ ] Don't use conversation data to train AI without consent - [ ] Review AI decisions that significantly affect customers
**For Marketing AI:** - [ ] Get consent before using customer data for personalisation - [ ] Allow opt-out of AI-driven recommendations - [ ] Document your AI decision-making process - [ ] Conduct annual AI audit for bias
**For Financial/HR AI:** - [ ] Never let AI make final decisions alone - [ ] Document AI involvement in decisions - [ ] Provide explanation when requested - [ ] Regular bias testing
Safe AI Tools:
These major AI providers have Australian data agreements: - Microsoft Copilot (Azure Australia) - Google Gemini (Sydney data centre) - OpenAI via Azure (Australia East region) - Salesforce Einstein (Sydney region available)
Tools Requiring Caution:
These may process data overseas: - Many free AI tools - Newer startups without Australian presence - Open-source models self-hosted overseas
Penalties:
| Violation | Maximum Penalty |
|---|---|
| Minor breach | $110,000 (individual) / $555,000 (company) |
| Serious breach | $2.5 million or 10% turnover |
| Repeated/intentional | $50 million or 30% turnover |
Practical Steps:
- **Audit current AI use**: List every AI tool and what data it accesses
- **Update privacy policy**: Include AI disclosure statement
- **Review vendor agreements**: Ensure data processing meets requirements
- **Train staff**: Everyone should understand AI privacy obligations
- **Document decisions**: Keep records of AI-assisted business decisions
Resources:
- OAIC AI guidance: oaic.gov.au/privacy/guidance/ai
- Privacy Act updates: legislation.gov.au
- Free compliance template: Download from our resources page