Most small businesses did not plan their AI rollout. Someone started pasting emails into a chatbot to tidy up replies, someone else tried an AI note-taker in client meetings, and now customer names, phone numbers and job details are flowing through tools nobody has checked. An AI privacy checklist for small business gives you a short, repeatable way to answer three questions: does the Privacy Act apply to you, what information is going into each AI tool, and what do your customers need to be told.
To use AI safely under the Australian Privacy Act, a small business should confirm whether it is covered by the Act, keep personal and sensitive information out of public AI chatbots, check each vendor's data terms, limit the data each tool can reach, keep a person on decisions that matter, and update its privacy policy before 10 December 2026.
This guide explains who the Privacy Act covers, what the Office of the Australian Information Commissioner (OAIC) says about AI tools, what changes in December 2026, and a ten-point checklist you can work through in an afternoon. It is general information, not legal advice; if your situation is complex, talk to a privacy lawyer.
Does the Privacy Act apply to a small business using AI?
The Privacy Act 1988 and its 13 Australian Privacy Principles (APPs) apply to "APP entities". A business is generally exempt as a small business operator if its annual turnover is $3 million or less, but the exemption has important exceptions. According to the OAIC's guidance for small businesses, you are covered regardless of turnover if, among other things, you:
- provide a health service and hold health information, which includes GPs, allied health, dentists, psychologists and many wellness providers;
- trade in personal information, such as buying or selling customer lists;
- hold a Commonwealth contract as a contracted service provider;
- are a credit reporting body or hold accreditation under the Consumer Data Right;
- have opted in to the Privacy Act voluntarily.
Turnover counts income from all sources, not just one business line. If you are near the threshold, check with your accountant.
Even if you are exempt, the checklist below is still worth following. Larger clients increasingly write privacy terms into supplier contracts, a data breach damages trust whether or not a regulator is involved, and an exempt business that grows past $3 million will need these controls anyway. Separately, a statutory tort for serious invasions of privacy commenced on 10 June 2025, allowing individuals to take action over serious invasions of privacy that are intentional or reckless. Ask a lawyer how it applies to you.
What does the OAIC say about using AI tools?
In October 2024 the OAIC published guidance on privacy and the use of commercially available AI products. It is written for organisations that buy or use AI tools rather than build them, and it covers free public chatbots as well as paid business products. The main points for a small business are:
- Privacy obligations apply to what goes in and what comes out. Personal information you type or upload into an AI tool is covered, and so is AI output that contains personal information.
- Generated information can be personal information. If an AI tool infers or invents something about an identifiable person, including an incorrect "hallucinated" detail, that output is treated as personal information.
- Keep personal information out of public chatbots. As a matter of best practice, the OAIC recommends not entering personal information, and particularly sensitive information, into publicly available generative AI tools.
- Do due diligence before you choose a product. Check that the tool suits the task, and whether the vendor can access your inputs or use them to train its models.
- Be open about it. Update your privacy policy and notices to explain how you use AI, and make it clear to customers when they are dealing with an AI chatbot rather than a person.
The OAIC also publishes short checklists for selecting and using AI products alongside the guidance, which are worth printing for whoever approves new software in your business.
What changes on 10 December 2026?
From 10 December 2026, APP entities must explain automated decision-making in their privacy policies. The change was made by the Privacy and Other Legislation Amendment Act 2024, and the OAIC has published resources on transparency for AI and automated decision-making to help organisations prepare.
Automated decision-making, in this context, is where a computer program uses personal information to make a decision, or to do something substantially and directly related to making one, that could reasonably be expected to significantly affect a person's rights or interests. Your privacy policy will need to describe the kinds of personal information used and the kinds of decisions involved.
For a small or medium business that is an APP entity, examples worth reviewing include:
- software that automatically screens, ranks or rejects job applicants;
- credit, payment-risk or account checks that approve or decline customers without a person reviewing them;
- tools that automatically set prices, terms or eligibility for an individual customer.
An AI that drafts a routine email reply for a staff member to check is a different thing from a system that decides whether someone gets a service. If you are unsure which side of the line a workflow falls on, list it anyway and get advice.
The AI privacy checklist: 10 checks before you switch a tool on
Work through these for every AI tool or workflow that touches customer, patient, client or staff information. Most businesses can do the first pass in an afternoon.
- Confirm whether you are an APP entity. Check your turnover and the exceptions above, and write the answer down with the date you checked.
- List every AI tool in use. Include free chatbots, browser extensions, meeting note-takers and AI features switched on inside software you already pay for, such as your email, CRM or practice management system. Ask staff what they actually use.
- Map the personal information each tool touches. For each tool, note whose information it sees (customers, patients, staff), what kind (contact details, health, financial) and where it comes from.
- Keep personal and sensitive information out of public chatbots. Use business accounts with admin controls, and where the vendor offers it, a setting that stops your inputs being used for model training.
- Read the vendor's data terms. Check where data is stored, whether it leaves Australia, how long it is kept, who can access it and how you delete it. Sending personal information overseas brings APP 8 into play.
- Check the purpose matches. Under APP 6, personal information is generally used for the purpose it was collected for. Ask: would the customer reasonably expect their details to be used this way?
- Give each tool the minimum access it needs. One inbox folder, one set of CRM fields or one appointment type is better than the whole mailbox or database.
- Keep a person on decisions that matter. Define which outputs are sent automatically and which are held for review, such as complaints, refunds, clinical matters and anything about price or eligibility.
- Update your privacy policy and customer notices. Explain how you use AI, label AI chatbots and AI receptionists, and from 10 December 2026 cover any automated decisions if you are an APP entity.
- Secure it, log it and plan for mistakes. Turn on multi-factor authentication, keep a record of what the AI did, and know who acts if something goes wrong. If you are covered by the Act, a data breach likely to cause serious harm must be reported under the Notifiable Data Breaches scheme.
Finish by writing a one-page AI use policy for staff that says which tools are approved, what must never be entered into them, and who to ask. Review the list every six months, because vendors add AI features to existing software all the time.
Public chatbot, business AI tool or connected AI workflow?
Not all AI tools carry the same privacy risk. The table compares the three ways small businesses usually use AI. Exact features depend on the product and plan, so confirm the details in each vendor's terms.
| Factor | Free public chatbot | Business AI tool | Connected AI workflow |
|---|---|---|---|
| Who controls access | Each staff member's personal account | Business admin manages users | Access set per system, folder or field |
| Use of your inputs for training | Often possible unless switched off | Commonly excluded by business terms; check | Chosen when the AI service is selected |
| Record of what happened | Chat history in a personal account | Admin logs on some plans | Each action logged against the record |
| Human review | Depends on the individual | Depends on staff habits | Built into the workflow as approval rules |
| Suitable for personal information | No, by OAIC best practice | With checks and a staff policy | Yes, when designed with minimum access |
A connected workflow is the approach behind most of our AI Agents: the AI does one defined job, such as sorting an inbox or replying to routine SMS enquiries, and fixed rules control where information goes and when a person takes over.
Which businesses need to take extra care?
Some industries handle information where a privacy mistake does more harm.
- Healthcare and allied health. Health service providers are covered by the Privacy Act regardless of turnover, and health information is sensitive information. Be especially careful with AI scribes, note-takers and patient messaging. See our notes on automation for healthcare and allied health.
- Professional services. Accountants, lawyers and advisers hold financial and identity documents and often have professional confidentiality duties on top of privacy law.
- Any business hiring staff. AI screening of job applicants is one of the clearest examples of a decision that significantly affects a person.
- Not-for-profits. Donor, client and volunteer records can include sensitive information, and trust is the organisation's main asset.
Is there a government framework for safe AI use?
Yes. The National AI Centre's Guidance for AI Adoption, released in October 2025, sets out six essential practices for responsible AI use: decide who is accountable, understand impacts and plan accordingly, measure and manage risks, share essential information, test and monitor, and maintain human control. It includes a Foundations version written for small and medium businesses and not-for-profits. The Department of Industry, Science and Resources explains the update in its announcement of the guidance. The guidance is voluntary, but it lines up closely with the checklist above.
How IT Your Service builds AI with privacy in mind
Every AI project we deliver starts by defining the job the AI will do, the data it may access and the point where a person takes over. Our AI integration services include limited access to only the data each workflow needs, approvals and stopping rules for sensitive or unusual work, testing against real examples before go-live, and clear handover to your team. We do not provide legal advice, but we document the systems involved and the information passed between them so you can update your privacy policy accurately.
On pricing, a single AI workflow starts from $500, AI across several systems starts from $1,500, and every project includes 30 days of post-launch support, with the final price confirmed in writing after a free audit. See our pricing page for details. If you are still working out where AI fits at all, our guide to AI for small business covers suitable first use cases. When you are ready to review the tools you already use, book a Free Audit.