Skip to content

Regulation Tracker / Australia

Guidance on privacy and the use of commercially available AI products

Office of the Australian Information Commissioner

last revised 2025-01-17last verified 2026-09-042 versionscountry page →

GuidanceIn forceConfidentialityClient consentCompetenceRecord-keeping

map categories:Data protection and legal AIVendor due diligenceClient data in AI tools

OAIC guidance applying the Privacy Act 1988 and the Australian Privacy Principles to organisations that deploy commercially available AI products. Privacy obligations attach to personal information input into an AI system and to output containing personal information, and the OAIC advises against putting personal information into publicly available generative AI tools.

Applies to
firms, providers, all
Effective
21 Oct 2024
Current version
Updated · 17 Jan 2025
Last verified
04 Sept 2026
Official text
www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-governm…

What the document requires

  • Due diligence is required on AI product selection, covering training data, security and third-party access.
  • APP 6 limits use of personal information input into AI systems to the primary purpose of collection absent consent or a reasonable-expectations exception.
  • AI-generated or inferred personal information is a collection under APP 3, requiring necessity, lawful and fair means, and consent for sensitive information.
  • APP 10 requires reasonable steps to ensure the accuracy of AI-generated personal information.
  • Privacy policies must disclose AI use and public-facing AI tools must be identified as such.
  • Best practice is not to enter personal information, especially sensitive information, into publicly available generative AI tools.

Version history

VersionDateWhat changedSource
Updatedcurrent2025-01-17Update to the October 2024 guidance.official
Original2024-10-21First version recorded.official

Sources

Cite this record

SafeLegalAI Legal AI Regulation Tracker, "Guidance on privacy and the use of commercially available AI products" (Office of the Australian Information Commissioner, Updated, 2025-01-17), safelegalai.com/regulation/australia/au-oaic-guidance-commercially-available-ai-products (accessed 2026-09-04). Data: CC BY 4.0.

More official documents in Australia