Can staff put client data into ChatGPT under Australia's Privacy Act?

Usually not, and the safe answer for any Australian business is to keep personal information out of public AI tools altogether. The Office of the Australian Information Commissioner (OAIC) recommends that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools. If your business is covered by the Privacy Act, typing a client's details into ChatGPT is a use or disclosure of that information, and it has to fit the purpose you collected it for. Most businesses with an annual turnover of A$3 million or less are exempt, but not all: health service providers are covered at any size.

This piece is for the owner or office manager of a small or medium business who has found staff pasting emails, invoices or client notes into ChatGPT and wants to know where the line is. It is general information, not legal advice.

Does the Privacy Act apply to my business?

It depends on turnover and what you do. The Privacy Act 1988 covers businesses with an annual turnover above A$3 million. Below that, most small businesses are exempt, but the OAIC lists exceptions that are covered whatever their size, including:

• health service providers, which takes in GP, dental, physiotherapy and allied health practices;
• businesses that trade in personal information;
• contractors that provide services under a Commonwealth contract;
• operators of residential tenancy databases;
• businesses that have chosen to opt in.

Even an exempt business usually has clients, suppliers or contracts that expect the same care. The OAIC's guidance is the benchmark a client will hold you to.

What does the OAIC say about putting personal information into ChatGPT?

The OAIC's guidance on privacy and the use of commercially available AI products was published on 21 October 2024. For a small business, four points matter:

1. Best practice is not to enter personal information into publicly available generative AI tools, and especially not sensitive information such as health details.
2. Entering personal information is a use or disclosure under APP 6. It is only allowed for the purpose the information was collected for, or a related purpose the person would reasonably expect, unless they consent.
3. Where the tool sends data offshore, APP 8 applies. Cross-border disclosure rules depend on where the provider processes the data.
4. APP 11 requires reasonable steps to protect personal information, which means checking a tool's security and whether the vendor uses your inputs to train its models before staff start using it.

The guidance also says AI outputs should be checked for accuracy before you rely on them, because they are probabilistic rather than fact.

Is a paid ChatGPT plan enough?

It helps, but it does not hand your duties to OpenAI. A business workspace with admin controls, where the vendor says business data is not used for training by default, is a much better place for client work than staff's personal free accounts. It does not change three things:

• staff still decide what goes into a prompt;
• the information may still be processed outside Australia, so APP 8 still needs thinking about;
• every output still needs a person to check it before it reaches a client.

What changes on 10 December 2026?

From 10 December 2026, businesses covered by the Act must say in their privacy policy when a computer program uses personal information to make, or substantially help make, decisions that could significantly affect people. The OAIC published resources on this transparency duty on 30 September 2026. If an AI tool helps you approve applications, set prices for individuals or screen people, check your privacy policy before that date.

Separately, a statutory tort for serious invasions of privacy has applied since 10 June 2025, so individuals can now sue over serious invasions of their privacy.

What should a small business do this month?

1. Pick one approved tool and a business plan for it, and close the gap where staff use personal accounts for work.
2. Write a one-page staff rule: no names, contact details, account numbers, health information or client documents in public AI tools; remove identifying details first; a person checks every output before it is sent.
3. Check your sector's own rules. Tax agents have the Tax Practitioners Board's TPB(GS) 55/2026 on AI and the Code of Professional Conduct; health practitioners have Ahpra's guidance on AI in healthcare; NSW lawyers have Supreme Court Practice Note SC Gen 23.
4. Train the people who use it most. Rules on paper do not change what someone pastes at 4:55 pm on a Friday; practice on their own work does.

Square1 Ai trains small business teams in Australia on exactly this, live online in your working hours, with sector pages for accounting firms, health practices and real estate agencies, and a ChatGPT for staff course. Prices are on the small business page.