Skip to content

Business knowledge preparation guide · By Yes AI

Privacy Act checks for AI search over business files

Published 5 min read

Policies and procedures rarely contain personal information, but the folders around them often do. Before an AI search tool reads customer files, staff records or patient notes, check what the Privacy Act requires and what the OAIC recommends. This guide is administrative guidance only and is not legal advice.

Plan a privacy-aware knowledge search scopeCall (03) 9003 0111Book a free knowledge search consultation

Quick answer

If your business is covered by the Privacy Act, the Australian Privacy Principles apply to personal information put into an AI system and to AI output that contains it. The OAIC expects due diligence on the product, use limited to the purpose the information was collected for, reasonable security steps and clear privacy policy wording about AI. Start with documents that hold no personal information, and add personal records only after a privacy assessment.

Clinic practice manager and adviser reviewing a privacy checklist beside a filing cabinet in a Sydney office
Decide which folders holding personal information stay out of the first scope.

Does the Privacy Act apply to your business?

The OAIC says most small businesses, meaning those with an annual turnover of $3 million or less, are not covered by the Privacy Act, and that turnover includes all income from all sources. Some businesses are covered regardless of turnover, including health service providers, businesses that trade in personal information and contractors providing services under a Commonwealth contract. If you are covered, the Australian Privacy Principles apply to how an AI system handles personal information. If you are not, the OAIC's guidance is still a sensible standard to work to.

Are staff HR files exempt?

A private sector employer's handling of employee records is exempt from the Australian Privacy Principles where the act or practice is directly related to a current or former employment relationship. The OAIC notes limits. The exemption does not cover unsuccessful job applicants, contractors handling the personal information of another organisation's employees, or volunteers. Whether a particular AI search use falls inside the exemption depends on the facts, so get advice before relying on it. HR files rarely belong in a general staff knowledge search in any case, because most staff should not see them.

Can customer or patient records go into AI search?

The OAIC says APP 6 applies when personal information is put into an AI system. Information can be used for the purpose it was collected for. A secondary use needs the person's consent, or must be one they would reasonably expect that is related to the original purpose (directly related, for sensitive information). Staff searching job files to answer that customer's question may fit the original purpose. Feeding the same files into a tool for an unrelated purpose may not. Record your reasoning for each document set before it is indexed.

What does the OAIC expect before you adopt an AI product?

The OAIC's guidance on commercially available AI products asks organisations to do due diligence on whether a product suits its intended use. That includes whether it has been tested for that use, how human oversight will work, the privacy and security risks, and who will have access to personal information that is entered or generated. The OAIC recommends a privacy by design approach that includes a Privacy Impact Assessment, and updating privacy policies with clear information about the use of AI. Put these questions to any vendor.

  • Has the product been tested for answering questions from your kind of documents?
  • Who at the vendor and its subprocessors can access passages, questions and answers?
  • Where are passages, questions and logs stored, and for how long?
  • How will a person check answers that affect a customer, patient or employee?

What security steps does APP 11 require?

APP 11 requires reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. The OAIC asks organisations to take active steps to make sure an AI system will not expose their personal information holdings. For knowledge search, exposures to check include an index that ignores source permissions, question logs that record personal details and copies of passages held by a model provider. Filter retrieval by each user's access, limit who can read the logs, set a retention period and confirm in writing what the provider stores.

Why not use public AI chatbots for this?

The OAIC recommends, as best practice, that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools, because of the significant and complex privacy risks involved. It also says that AI output about an identified or reasonably identifiable person, including incorrect or artificially generated information, is personal information. Staff pasting a customer complaint into a free chatbot to draft a reply create exactly that risk. Give staff an approved tool and a short written rule about what may be entered.

Privacy starting points by document set

Document setPrivacy angleStarting position for a first project
Policies, procedures and manualsUsually little or no personal informationInclude once current versions are confirmed
Staff HR and payroll filesThe employee records exemption may apply, so get adviceExclude
Recruitment filesUnsuccessful applicants are outside the exemptionExclude
Customer job files and contractsAPP 6 purpose test and APP 11 securityAdd later, after a privacy assessment
Health or other sensitive informationHealth service providers are covered regardless of turnover, and secondary use must be directly relatedExclude unless assessed and approved
Question and answer logsCan contain personal information that staff typedRestrict access and set a retention period

Practical checklist

  • You have confirmed whether the Privacy Act covers your business, including the turnover test and the groups covered regardless of turnover.
  • Each document set in scope has a recorded decision on personal information and purpose.
  • A Privacy Impact Assessment has been done before any customer, patient or staff records are indexed.
  • The vendor has stated in writing where passages, questions and logs are stored, and for how long.
  • Retrieval filters each answer by the asking user's access to the source document.
  • Your privacy policy describes the use of AI where personal information is involved.
  • Staff have a written rule on what may be entered into public AI tools.

Common questions

Is this legal advice?

No. This guide summarises published OAIC guidance for administrative planning. Your obligations depend on your business, the information involved and any industry or state rules that apply to you. For a decision about a specific document set, speak to a privacy lawyer or adviser, or read the OAIC guidance in full.

Do question logs count as personal information?

They can. Staff may type names, account numbers or details of a customer's situation into a question. If a log entry is about an identifiable person, it is personal information, and the Australian Privacy Principles apply where your business is covered. Treat logs with the same care as the documents, limit who reads them and delete them on a schedule.

Do we need to tell customers we use AI search internally?

The OAIC recommends that organisations update their privacy policies and notifications with clear and transparent information about their use of AI. For an internal tool that searches customer records, review whether your privacy policy and collection notices describe that use, and get advice on the wording if the use goes beyond what customers would expect.

What if we are a small business under $3 million?

You may not be covered by the Privacy Act, unless you fall into a group covered regardless of turnover, such as health service providers. Customers and partners may still expect the same care, and some contracts require it. Following the OAIC's recommended steps also puts you in a better position if your obligations change.

What does a Privacy Impact Assessment involve?

The OAIC says a Privacy Impact Assessment helps you understand how your use of an AI product may affect individuals' privacy and identify ways to manage, minimise or eliminate those impacts. For an internal knowledge search, it can focus on which document sets hold personal information, who will see answers drawn from them, where data is stored and how long logs are kept.

Sources and further reading

Continue planning

Plan a useful knowledge-search pilot

Describe the documents your staff use, the questions they need answered and how uncertainty should be reviewed. We can discuss preparation and a bounded pilot. Keep source documents, customer records and confidential information out of this enquiry.

Plan a privacy-aware knowledge search scopeCall (03) 9003 0111Book a free knowledge search consultation