OAIC guidance on privacy and AI

What it is

On 21 October 2024 the Office of the Australian Information Commissioner (OAIC) published two guidance documents on privacy and AI.

• Guidance on privacy and the use of commercially available AI products is for organisations that adopt AI products, including freely available tools such as public chatbots. It was updated on 17 January 2025.
• Guidance on privacy and developing and training generative AI models is for developers, including organisations fine-tuning models on data they hold.

Both are regulator guidance on how the existing Privacy Act 1988 and the Australian Privacy Principles (APPs) apply to AI. They add no new law, but they set out how the regulator reads the law it enforces.

Who it applies to

APP entities, meaning Australian Government agencies and organisations covered by the Privacy Act, that use AI products or develop AI models involving personal information. The OAIC says the guidance applies to all AI systems involving personal information, and is especially relevant to generative AI, general-purpose AI tools and other uses with a high risk of adverse impact.

What it expects

Selecting an AI product. Consider whether using personal information with AI is necessary and the best solution. AI products should not be used just because they are available. Do due diligence on whether the product has been tested for your intended use, how human oversight can be built in, its privacy and security risks and who will have access to the personal information. Due diligence is not “set and forget”. Review performance, train staff and monitor across the product’s lifecycle.

Privacy by design. Take a privacy by design approach, including a privacy impact assessment.

Transparency. Update privacy policies and notices with clear information about your use of AI. Make sure public-facing AI tools such as chatbots are identified as AI. Set policies and procedures for AI use to support transparency and good privacy governance.

Inputs and outputs. Privacy obligations apply to personal information input into an AI system and to output that contains personal information. Inferred, incorrect or artificially generated information about an identifiable person, including hallucinations and deepfakes, is personal information. Generating or inferring it is a collection, which must be reasonably necessary and done by lawful and fair means under APP 3.

Use and disclosure. Under APP 6, personal information put into AI must only be used for the primary purpose of collection unless an exception applies, such as consent or a related secondary use the person would reasonably expect. The OAIC notes this may be hard to establish for AI purposes. Where it is unclear, it suggests seeking consent or offering a meaningful opt-out.

Sensitive information and accuracy. Take particular care with sensitive information, which generally requires consent. Many images and recordings of people contain it. Under APP 10, take reasonable steps for accuracy in proportion to the higher risk in an AI context, including disclaimers and watermarks where appropriate. The OAIC treats AI used in decisions with a legal or similarly significant effect on a person as likely high privacy risk.

Public generative AI tools. As best practice, do not enter personal information, and particularly sensitive information, into publicly available generative AI tools.

For developers. Take reasonable steps for accuracy through high-quality datasets and testing. Publicly available data is not automatically available for training. Check it for personal information and take extra steps, such as deletion, where needed. Take particular care with sensitive information, which often cannot be scraped or taken from third-party datasets without consent.

Key dates

Both documents were published on 21 October 2024, and the commercial products guidance was updated on 17 January 2025. Each comes with checklists for selecting and using AI products. The OAIC’s separate guidance on the new automated decision-making duty in APP 1 was finalised on 30 September 2026, ahead of that duty commencing on 10 December 2026.

How it relates to other frameworks

This guidance covers the APPs in general as they apply to AI. The Privacy Act ADM transparency rules add a specific disclosure duty for automated decisions from 10 December 2026. The DTA policy lists the commercial AI products guidance among related frameworks for Commonwealth agencies. Its due diligence and monitoring expectations line up with practices in the Guidance for AI Adoption, and it is a practical checklist for AI vendor due diligence.