The Australian Privacy Principles in plain English, for businesses putting AI near customer data
Thirteen principles govern how Australian organisations handle personal information. Most AI questions a business has are already answered in them, in language that is more readable than its reputation suggests.
-
APP 1: be open about what you do
You need a clear, current privacy policy describing what you collect and why. If AI is now handling customer information, the policy has to say so before the AI does.
-
APP 3: only collect what you actually need
Collection must be reasonably necessary for your functions. An AI that hoovers up an entire conversation because it might be useful later is the wrong design.
-
APP 5: tell people at the time of collection
Notification happens at or before collection, not in a policy nobody reads. For a voice agent that means disclosing at the start of the call.
-
APP 6: do not quietly reuse data for something else
Information collected for one purpose cannot be used for another without consent or an exception. Training a model on customer records collected for service delivery is exactly this problem.
-
APP 8: sending data overseas keeps you responsible
Cross-border disclosure means you remain accountable for what the overseas recipient does. Every AI provider outside Australia falls under this, which is why where the model runs is a genuine question.
-
APP 11: security is an active obligation
You must take reasonable steps to protect information and destroy or de-identify it when no longer needed. Reasonable scales with sensitivity, so health and financial data carry a higher bar.
-
APP 12 and 13: people can ask to see and correct it
Individuals can request access to their personal information and require corrections. If an AI system holds data you cannot search or edit, you cannot meet this.
-
The Notifiable Data Breaches scheme sits on top
Eligible breaches likely to cause serious harm must be reported to the OAIC and to affected individuals. The clock starts when you become aware, so detection matters as much as prevention.
-
The practical version
Know where the data goes, collect less of it, say what you are doing, be able to find and delete it, and prefer arrangements where customer data is not used to train someone else's model.
Talk to us about this
Tell us what you're trying to do and we'll reply with how we'd build it - no obligation.