Not for personal or sensitive information. Australia's privacy regulator, the OAIC, recommends as best practice that organisations do not enter personal information, and especially sensitive information, into publicly available generative AI tools. For confidential company data, the safer path is a governed AI platform that runs where you decide and logs every use.
- The OAIC recommends not entering personal or sensitive information into publicly available generative AI tools.OAIC, Guidance on privacy and the use of commercially available AI products (Oct 2024)
- From 10 December 2026, privacy policies must explain certain uses of personal information in automated decision-making.Gilbert + Tobin, Automated decision-making transparency under the Privacy Act
- 36% of Australian employees have entered confidential data into AI tools that may lack formal oversight.IT Brief Australia, One in three Australians upload sensitive data to AI tools (Sept 2025)
- About one in three Australian workers use AI without their employer's knowledge.HRD Australia, Australian workers still hiding AI use from employers (Employment Hero research)
What does Australian law say?
The Privacy Act 1988 applies to any use of AI that involves personal information. In October 2024 the Office of the Australian Information Commissioner (OAIC) published guidance for organisations using commercially available AI products, including free, publicly accessible chatbots. Its headline advice is simple: as a matter of best practice, don't put personal information, and particularly sensitive information, into public generative AI tools.
The OAIC also says AI products should not be used simply because they are available. You are expected to ask whether using personal information with an AI system is necessary and the best solution.
What about confidential company data that isn't personal?
Board packs, contracts, pricing, source code and tender responses aren't always personal information, but they are the data competitors and attackers want most. When staff paste them into a public chatbot, the data leaves your environment and is handled under the provider's terms, not yours.
In Australia this is already happening at scale. A 2025 survey of 500 Australian technology decision-makers found 36% of employees had entered confidential data, including strategic plans and financials, into AI tools that may not have formal oversight. Separate Employment Hero research found about one in three Australian workers use AI without their employer knowing.
What changes on 10 December 2026?
New Australian Privacy Principles 1.7 to 1.9 come into force. If your organisation uses personal information in automated decisions that could significantly affect people, your privacy policy must say so. That covers AI systems built into everyday workflows, approved or not, so knowing where AI is used across your organisation becomes a compliance task, not just an IT one.
So what should an Australian enterprise do?
Give people a better option than a public chatbot: a governed assistant connected to your own systems, deployed where you decide, with every use logged. Write a clear AI policy, keep an AI register, and map where AI touches personal information before 10 December. Our team in Sydney does exactly this through the AI Governance service, and BLDR provides the platform.
Questions people also ask
Is ChatGPT Enterprise different from free ChatGPT?
Can we just block ChatGPT?
Who can help in Sydney?
One governed layer across every system you own.
Deploy where you decide, connect to SAP and your local systems, and make every agent action approved and logged. See how the pieces fit.
- OAIC, Guidance on privacy and the use of commercially available AI products (Oct 2024)
- Gilbert + Tobin, Automated decision-making transparency under the Privacy Act
- IT Brief Australia, One in three Australians upload sensitive data to AI tools (Sept 2025)
- HRD Australia, Australian workers still hiding AI use from employers (Employment Hero research)