Whether the Privacy Act binds your business turns on turnover and a short list of exceptions. The duties that matter most for AI tools are about notice, purpose, overseas disclosure and security, and they are worth following even where the Act does not reach you. Here is the text, section by section, and ten questions to put to any provider.
Who the Act covers
A business is a small business if its annual turnover for the previous financial year is $3,000,000 or less (s 6D(1)). Turnover is wider than most people think. It includes commission income, and rent, leasing and hiring income (s 6DA(1)(b) and (d)). For an agency, commission counts.
A small business is still covered in a few cases. It is not a small business operator if it discloses personal information about another individual "to anyone else for a benefit, service or advantage" (s 6D(4)(c)). It is also out if it provides a benefit, service or advantage to collect personal information about someone from another person (s 6D(4)(d)). We read selling or swapping contact lists as falling in the first category, but check that with a lawyer. Other exceptions cover health service providers holding health information (s 6D(4)(b)), Commonwealth contractors (s 6D(4)(e)), credit reporting bodies (s 6D(4)(f)), and AML/CTF reporting entities for their AML/CTF work (s 6E(1A)).
Once a business has had turnover of more than $3,000,000 in a financial year that has ended, it falls outside the small business definition (s 6D(4)(a)). A small business can also opt in (s 6EA).
The threshold is still in the Act as compiled on 4 June 2026. Removing the exemption has been discussed, but we could not find a bill or a start date. The OAIC makes the same point from its side: "As a matter of best practice though, we recommend you protect any personal information you hold."
The principles that matter for AI
APP 1, your privacy policy. The policy must say what personal information you collect and hold, how, and why. It must also say whether you are likely to disclose it to overseas recipients, and the countries if that is practicable (APP 1.3 and 1.4(f) and (g)). You must also have practices that let you deal with complaints (APP 1.2).
APP 5, notice. At or before collection, the person must be told who you are, why you are collecting the information, and the other entities or types of entities you usually disclose it to (APP 5.1 and 5.2(a), (d) and (f)). Ask whether your AI provider is one of those.
APP 6, purpose. Information collected for one purpose cannot be used for another unless the person consented or an exception applies (APP 6.1). The OAIC's guidance on commercially available AI products says that APP 6 "requires entities to only use or disclose the information for the primary purpose for which it was collected". It also says that putting personal information into an AI system "may be considered either a use of personal information (if the data stays within your organisation's control)". Either way, you need to be able to say what the purpose was.
APP 8, overseas recipients. Before you disclose personal information to an overseas recipient, you must take reasonable steps to make sure it does not breach the APPs (APP 8.1). Section 16C can make an overseas recipient's breach count as yours in some cases. Where the model runs matters here, so this is the principle to check first.
APP 11, security. You must take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure (APP 11.1). When you no longer need it, you must destroy it or de-identify it (APP 11.2).
What changed in 2024, and what is next
The Privacy and Other Legislation Amendment Act 2024 received Royal Assent on 10 December 2024. Schedule 1, Parts 1 to 7 and 9 to 14 started the next day, on 11 December 2024.
The change to note now starts on 10 December 2026. From then, APP 1 requires the privacy policy to cover computer programs that make a decision, or do something substantially and directly related to making one, where the decision could reasonably be expected to significantly affect a person's rights or interests (APP 1.7 to 1.9; Schedule 1, Part 15; commencement table item 7). An AI tool that screens tenant applications or ranks enquiries could fall within that. Check the detail before then.
Penalties went up. For a serious interference with privacy, a body corporate faces the greatest of $50,000,000, three times the value of the benefit where it can be worked out, or 30% of adjusted turnover if the benefit cannot be worked out (s 13G(3)). Section 13K also makes some APP breaches eligible for infringement notices.
Ten questions for any provider
- Which personal information goes into the tool, and which stays out? (APP 6.1)
- Do you use my inputs or outputs to train or improve your models? Read the service terms and settings. The OAIC asks whether they give the developer access to what you input, or allow it to collect that data for training.
- Name every company that touches the data, including the model provider. (APP 1.4(f), APP 8.1)
- In which countries is it stored and processed? (APP 1.4(g))
- Who can see it, at your company and at yours? (APP 11.1)
- How long do you keep it, and how is it deleted? (APP 11.2)
- Who checks the output before a person acts on it? The OAIC's checklist asks for human oversight of AI outputs, with a human user responsible for verifying the accuracy of personal information the AI produces.
- What is your complaint process, and how will I hear about a breach? (APP 1.2)
- What does the privacy policy say about all of this? (APP 1.3 and 1.4)
- If I stop, what happens to the data and who confirms it has gone? (APP 11.2)
If the answers do not fit on a page, ask why. The OAIC's guidance is written for this exact situation, and a provider that has read it should be able to answer in plain words.
Command is a private system that sets itself up around one business. It watches dates like these and the news that touches your clients, and tells you early. Give us one past deal and we'll show you the day you could have known. → First look
For the full list of questions to put to an AI firm, with what a good and a bad answer sound like, see our piece on questions to ask any AI firm. For what we say publicly about our own data handling, see the Trust page.
This is general information, not legal or financial advice. Check your own lease and get advice for your situation.
Sources
- Privacy Act 1988 (Cth), compilation dated 4 June 2026: ss 6D, 6DA, 6E, 6EA, 13G, 13K, 16C, and Schedule 1 APPs 1, 5, 6, 8 and 11. legislation.gov.au.
- Privacy and Other Legislation Amendment Act 2024 (Cth), as made: commencement table; Schedule 1, Part 15. legislation.gov.au.
- OAIC, Privacy and the use of commercially available AI products (guidance). oaic.gov.au.
- OAIC, Checklist: privacy considerations when using commercially available AI products. oaic.gov.au (PDF).
- OAIC, Small business FAQ. oaic.gov.au.