Privacy Policies and the Australian Privacy Act: What AI Gets Wrong

If you’ve asked an AI tool to write a privacy policy for your business, the result probably looked professional. It likely covered data collection, cookies, third-party sharing, and individual rights. It also probably resembled a GDPR-compliant European policy more closely than one that meets Australian law. The two frameworks are different, and the differences matter.

The Australian Privacy Act basics

The Privacy Act 1988 (Cth) governs how Australian organisations handle personal information. It operates through 13 Australian Privacy Principles (APPs), which cover collection, use, disclosure, data quality, security, and individuals’ access and correction rights.

There is a small business exemption that AI tools consistently mishandle. Most businesses with annual turnover under $3 million are currently exempt from the Act. This is a significant carve-out: if your business falls under that threshold, a lengthy GDPR-style privacy policy may be unnecessary for compliance purposes, though commercial reasons (payment processors, B2B clients, Google Ads) often still require one.

The exemption does not apply to health service providers, businesses that trade in personal information, credit reporting bodies, or operators of certain online platforms. If you collect health information, handle employee records in certain ways, or fall into one of these categories, the full weight of the Act applies regardless of turnover.

Where AI-generated policies fall short

The most common problem is GDPR contamination. AI models are trained heavily on European data protection material, and policies generated for Australian businesses routinely include GDPR concepts that don’t have direct equivalents under Australian law: the right to erasure, data portability, and supervisory authority complaints. Including these can create obligations you didn’t intend and confuse customers about their actual rights.

Cross-border data disclosures are treated differently in Australia. Under APP 8, before disclosing personal information to overseas recipients, an Australian business must take reasonable steps to ensure the recipient handles it consistently with the APPs. The specific obligations depend on where the data is going and what arrangements are in place. Generic AI policies either ignore this entirely or copy European adequacy language that doesn’t apply in the Australian context.

The mandatory data breach notification scheme is another gap. Under the Notifiable Data Breaches scheme, businesses covered by the Privacy Act must notify the Office of the Australian Information Commissioner (OAIC) and affected individuals when an eligible data breach occurs. The threshold, timeframes, and notification process are specific. A privacy policy that omits or misrepresents these obligations is a liability in the event of an incident.

The 2024 Privacy Act Review

The Australian Government has been working through recommendations from the 2022-23 Privacy Act Review since the Attorney-General’s response in September 2023. Proposed changes include strengthening individual rights, introducing a right to erasure, and removing the small business exemption. Not all changes have been enacted, but the direction is clear.

If your business currently sits under the $3 million threshold, building privacy practices that would meet the Act’s requirements now makes sense. Waiting for the changes to pass before acting puts you in catch-up mode, and the compliance work is similar either way.

What to do instead

The OAIC publishes free guidance specifically for small businesses, including a privacy policy tool that generates documentation suited to Australian conditions. This is a better starting point than asking an AI tool to write one from scratch.

Use AI to review and explain your draft policy, to identify gaps against the APPs, and to help draft specific sections once you have an Australian-compliant structure. The research role suits AI well. The base template should not come from AI alone.

This is part of the Legal AI series for Australian small business. Browse all Legal & Privacy posts.

More practical guides: How-To Hub →

📊 Compare AI tools side by side | 💼 Free resources & AI prompt packs

Sources

• The Privacy Act, OAIC
• Australian Privacy Principles, OAIC
• Privacy guidance for small business, OAIC
• Notifiable Data Breaches scheme, OAIC
• Privacy Act Review, Attorney-General’s Department

More on AI, law and compliance: AI, Law & Privacy Hub →