There is no special "AI section" in the Privacy Act 1988 (Cth). The existing rules simply apply to a new kind of tool. That's good news, because most practices already know the basics, and bad news, because those basics are easy to forget when a chatbot is one tab away.
This guide covers the parts that matter most for a small medical, legal or professional practice.
First: does the Act apply to you?
Most businesses with annual turnover of $3 million or less are exempt from the Privacy Act. There are important exceptions, and the big one for our readers is that any organisation providing a health service and holding health information is covered regardless of size. A two-doctor GP clinic, a physio or a psychologist in solo practice is bound by the Australian Privacy Principles (APPs).
Victorian health providers also have the Health Records Act 2001 (Vic) and its Health Privacy Principles, which cover similar ground. Law firms under the threshold may be outside the Privacy Act, but they are never outside their professional duty of confidentiality.
The principles that matter for AI
| Principle | What it says, roughly | Where AI touches it |
|---|---|---|
| APP 1 | Manage personal information openly, with a clear privacy policy. | If you use AI on personal information, your policy should say so. |
| APP 3 and 5 | Only collect what you need, and tell people about it. | AI scribes and transcription collect a lot, including things said in passing. |
| APP 6 | Use and disclose information only for the purpose it was collected, with limited exceptions. | Sending a patient file to a third-party AI provider is a disclosure. |
| APP 8 | Take reasonable steps before sending information overseas; you may remain accountable for it. | Most consumer AI tools process data offshore. |
| APP 10 | Take reasonable steps to keep information accurate. | AI output can be confidently wrong. Someone has to check it. |
| APP 11 | Protect information from misuse and unauthorised access, and destroy it when no longer needed. | Chat histories on personal accounts are hard to secure or delete. |
What the OAIC has said
In October 2024 the Office of the Australian Information Commissioner published two pieces of guidance: one on using commercially available AI products, and one for developers training generative AI models. For practices, the first is the relevant one. Its main points, paraphrased:
- Privacy obligations apply to personal information you put into an AI tool and to personal information the tool generates.
- As a matter of best practice, don't enter personal information, and particularly sensitive information such as health information, into publicly available generative AI tools.
- Do your due diligence on any AI product before using it with personal information, including where data is stored and whether it is used for training.
- Be transparent with the people whose information it is.
It is worth reading in full. It is short, practical and written for organisations rather than lawyers.
The 2024 reforms
The Privacy and Other Legislation Amendment Act 2024 was the first tranche of a long-running overhaul. Two parts are worth knowing about:
- A statutory tort for serious invasions of privacy, which commenced in June 2025. Individuals can now sue directly for serious, intentional or reckless invasions of privacy, including misuse of information.
- Transparency about automated decisions, which starts in December 2026. If a computer program is used to make, or substantially help make, decisions that significantly affect people, your privacy policy will need to say what kinds of personal information and decisions are involved.
A second tranche of reforms has been foreshadowed. Removing or narrowing the small business exemption has been discussed for years; nothing is settled, but it would be unwise to plan on the exemption lasting forever.
A short checklist
- List the AI tools in use, approved or not.
- For each, find out where the data goes, how long it's kept and whether it trains models.
- Decide what kinds of information may go into which tool, and write it down.
- Update your privacy policy and, where relevant, your patient or client information.
- Make sure a qualified person reviews AI output before it is relied on.
- Revisit this when the automated decision-making rules commence.
This is general information, not legal advice, and the law described here may change. For your own obligations, speak to a privacy lawyer or check the OAIC's website.
