Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallIf the Privacy Act 1988 covers your business, using AI does not remove your existing privacy obligations: personal information entered into an AI system, generated by it, or used to inform a decision must be handled under the Australian Privacy Principles (APPs). Before deploying an AI workflow, establish whether the Act applies, justify and minimise the data use, check the provider and data flows, assess privacy impacts, explain the practice to people, and put accuracy, oversight and review controls in place. From 10 December 2026, additional privacy-policy disclosures will apply to certain significant decisions made or substantially assisted by computer programs.
This is a general guide to OAIC guidance, not a determination of an individual business’s legal position. The OAIC’s AI guidance is not a complete account of every privacy issue or other regulatory regime.
As an Amazon Associate I earn from qualifying purchases.
Does the Privacy Act apply to my small business if I use AI?
Work out whether the relevant legal entity is an APP entity before deciding what privacy work is required. Australian Government agencies and organisations with annual turnover above $3 million generally have Privacy Act responsibilities. Most small businesses at or below that threshold are exempt, but the exemption has important exceptions.
OAIC small-business guidance identifies exceptions and special cases including private-sector health service providers, businesses that trade in personal information, certain Commonwealth contractors, credit reporting bodies, residential tenancy database operators, and some businesses covered by anti-money-laundering and counter-terrorism financing requirements. The $3 million figure is the general threshold in the OAIC guidance, not a guarantee that a particular business is exempt. Check the entity’s activities and circumstances against the OAIC’s small-business guidance and checklist; get professional advice if coverage is unclear.
#1 Best Overall
If the Act does not cover your entity, that does not establish that an AI use is unrestricted: other laws or obligations may still apply. This article focuses on Privacy Act and OAIC guidance, not employment, discrimination, consumer, surveillance, sector-specific, or state and territory rules.
What counts as personal information in an AI workflow?
The Privacy Act definition is broad: personal information is information or an opinion, whether true or false, about an identified or reasonably identifiable individual. The OAIC’s AI use guide explains that this can include inferences, incorrect outputs, or artificially generated material if it concerns an identifiable person.
Map more than the prompt itself. Potential handling points include uploaded documents, records retrieved for a prompt, generated summaries, scores, logs, and information passed to a person who makes or reviews a decision. Information can be personal even when it is produced by the system rather than supplied by the individual.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Can I put customer information into ChatGPT or another AI tool?
There is no blanket yes or no based only on the tool’s name. An APP entity should establish that the use is necessary and permitted, understand what happens to the information, and apply safeguards appropriate to the information and consequences. The OAIC’s guidance is that AI products should not be used simply because they are available.
Before staff enter personal information, answer these questions for the specific product, configuration, and task:
- Purpose and necessity: What business activity does the AI support, and can the task be done effectively with less personal information or without AI?
- Information: What personal or sensitive information would be entered, retrieved, generated, or logged? Can identifiers or unnecessary fields be removed?
- Provider handling: Who at the provider, including relevant subprocessors, may access prompts and outputs? How long are they retained, how can they be deleted, and may they be used for another purpose?
- Use and disclosure: If the information is already held by the business, is sending it to this tool consistent with the purpose for which it was collected, or is there another permitted basis under APP 6?
- Risk and control: Is the system suitable and tested for this use? Can a person check and correct its output before it affects someone?
Do not assume that information being public, or a vendor making a product available, makes every use of it unrestricted. A product’s settings and terms can affect its data flows, so assess the arrangement actually being used rather than relying on a generic description of the service.
What should the business do before deploying AI automation?
1. Define the task and map the data flow
Record the intended business function and why AI is an appropriate solution. Trace what enters the system, what it generates, where the information goes, who can access it, and whether a provider retains or further uses it. Include human review points and any point where an output informs an action or decision.
2. Limit collection and take extra care with sensitive information
For an APP entity, APP 3 permits collection of ordinary personal information only where it is reasonably necessary for the entity’s functions or activities. Sensitive information has stricter conditions; collection generally requires consent unless an exception applies. The OAIC’s APP 3 guidance, updated 13 May 2026, emphasises data minimisation and includes contemporary AI examples. Collect or send only what the task reasonably needs, and identify sensitive information before choosing a workflow.
3. Check the purpose, disclosure, and provider arrangements
For information already held, identify the original collection purpose and assess whether using or disclosing it through the AI workflow is allowed under APP 6. Review provider access, retention and deletion arrangements, security, and any secondary use of inputs or outputs. Product selection should account for who can access personal information and the privacy and security risks of that access.
4. Complete a proportionate privacy impact assessment
The OAIC recommends privacy by design, including a privacy impact assessment (PIA), when considering AI products. Its PIA tool describes a PIA as a systematic assessment of a project’s effects on people’s privacy, with recommendations to manage, minimise, or eliminate impacts. Scale the work to the project’s size, complexity, and risk; document mitigations and residual risks. A PIA is a practical risk-management tool, not a certificate that a system complies with every legal duty.
5. Make notices and policies describe the real practice
The OAIC recommends clear information about AI use in privacy policies and collection notices, and clear identification of public-facing AI tools such as chatbots. Explain what the business actually does with personal information, including relevant uses, disclosures, and generation of information. The organisation needs enough understanding of the system to describe those practices accurately; a notice should not promise controls the business has not verified.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minute6. Check output accuracy and keep human review meaningful
AI can produce inaccurate or false information. APP 10 requires an APP entity to take reasonable steps to ensure personal information it collects, uses, or discloses is accurate, up to date, and complete, having regard to the circumstances. Match checking to the risk: a mistaken internal draft and an incorrect score that affects a person are not equivalent consequences.
Rank #4
Where a significant decision is involved, the OAIC advises particular care. Understand how the tool produces its output, assign a person responsibility for checking accuracy, and ensure that person can overturn the result. Be able to explain how the decision was reached and how AI contributed; merely placing a nominal human step after an automated recommendation may not provide meaningful scrutiny.
7. Maintain governance after launch
Set permitted-use rules for staff, train users, and monitor the system rather than treating launch approval as permanent. Review whether the product remains suitable as its configuration, data, business purpose, or decision role changes. Keep oversight and review proportionate to the privacy and accuracy risks identified for the workflow.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What changes for computer-assisted decisions on 10 December 2026?
APP 1.7–1.9 are scheduled to commence on 10 December 2026. Where the statutory conditions are met, an APP entity’s privacy policy must state specified information about computer programs used in decisions. The conditions are that the entity has arranged for a computer program to make a decision, or do something substantially and directly related to making one; the decision could reasonably be expected to significantly affect an individual’s rights or interests; and the individual’s personal information is used in the program’s operation.
Recommended Free Tools
The required policy information includes the kinds of personal information used in the program’s operation and the kinds of decisions made solely or partly through the program. The OAIC’s APP 1 guidance says “computer program” is broad, covering rule-based programs, AI, machine learning, apps, and generative AI tools.
Best Value
A human reviewer does not automatically remove a workflow from scope
A program’s output may still be covered when it is a key factor in, and directly connected to, the human decision. Relevant considerations in the OAIC guidance include how much the decision-maker relies on the output, whether it is likely to be overridden, what kind of output the program produces, how explainable it is, and how it is integrated into the workflow. The test is not simply whether a person touches the file before the outcome is final.
Examples to assess, not automatic triggers
The OAIC gives examples including AI-assisted performance assessments affecting promotion, automated refund approval or refusal, job application screening and ranking, complaint escalation, loan risk scores relied on by loan officers, and scholarship rankings considered by a panel. These examples illustrate possible cases; they do not mean every AI use or every decision-support tool triggers the new disclosure duty. The statutory conditions must be assessed for the actual workflow.
Prepare the policy assessment before commencement
- Inventory the AI-assisted decisions used by the business, including decisions where a person reviews an output.
- Identify which decisions could reasonably be expected to significantly affect an individual’s rights or interests.
- For those workflows, record what personal information the program uses and how its output relates to the decision.
- Where the conditions apply, update the APP privacy policy before 10 December 2026 with the required kinds of information.
- Document how staff check, question, and, where appropriate, override outputs so human involvement is substantive.
The OAIC says the transparency obligation generally remains with the APP entity that uses personal information to make the decision, even where a third-party system operates the program.
How to compare AI products or workflows
When more than one approach could perform the task, compare them against the same privacy and operational criteria rather than choosing on convenience alone.
| Comparison area | Questions to answer |
|---|---|
| Data required | Does the workflow need personal or sensitive information? Could less data, de-identification, or a non-AI process achieve the task? |
| Provider handling | Are prompts, outputs, or logs retained or accessed by the provider or subprocessors? Is information reused for another purpose? |
| Suitability and accuracy | Has the system been tested for this intended use? Can staff understand and check its outputs? |
| Consequences and oversight | What happens if an output is wrong? Can an accountable person review and overturn it? |
| Transparency | Can the business explain its actual handling clearly and keep its notices and privacy policy accurate? |
| Ongoing governance | Can the organisation support staff training, monitoring, and review as the system or use changes? |
OAIC guidance to consult
The OAIC’s AI use guide was published on 21 October 2024 and its page records an update on 17 January 2025. The OAIC’s APP 3 guidance was updated on 13 May 2026, and its APP 1 guidance states the 10 December 2026 commencement date for APP 1.7–1.9. Its privacy impact assessment tool provides a method for assessing and managing project privacy impacts. Privacy materials can change, so check the current OAIC guidance when applying it to a live deployment.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
