Privacy Act duties for AI systems
Personal information in prompts, retrieval indexes or training data is covered by the APPs. Sending it to a model hosted overseas is a cross-border disclosure under APP 8, and the OAIC recommends against entering personal, and especially sensitive, information into publicly available AI tools. We default to models in Australian regions where the model you need is available, redact identifiers before indexing and keep logs on a defined retention schedule.
The Privacy and Other Legislation Amendment Act 2024 requires privacy policies to explain when computer programs make, or substantially help make, decisions that could significantly affect individuals, from 10 December 2026. We keep an inventory of the automated decisions in your system, the data each one uses and its human review path, so the policy and any challenge can be answered accurately.
