Privacy, data and AI: what Australian businesses should sort first

The Privacy Act does not care that it is AI

If your business handles personal information, the Australian Privacy Principles apply to how you collect it, hold it, use it and disclose it. Putting a system in front of your customers does not change any of that. The obligation follows the data.

Which means the boring questions asked of any new system are the same ones you would ask of a new hire with a filing cabinet. What will it see. Where does it live. Who else gets to look at it.

Work out what the system touches

Write down the data involved before anything gets built. Names, numbers, addresses, appointment details, payment information, what gets said on a recorded call. Then where each of those goes afterwards.

Most businesses find the list longer than they expected, and it is usually because the existing paper trail was invisible. An AI system does not create this problem. It makes it worth documenting.

Disclosure and consent

Customers should know when they are dealing with a system. We take the position that anything we build identifies itself, answers accurately and hands off to a person when asked. It is better customer service and it is the safer ground to be on.

Call recording and retention carry their own obligations, and those vary. Get proper advice for your situation, put the notice in the right place, and set a retention period instead of keeping everything forever.

Where the data lives

Customer records should stay in the systems already holding them. The system works around your data rather than vacuuming it into a new place, which keeps your obligations simpler and your business portable.

Two questions to put in writing before you sign anything. Is any data sold, shared between clients, or used to train models. And if the provider disappears tomorrow, what happens to what they hold.

What good looks like before go-live

The boundaries are written down: what the system answers, what it never touches, what goes to a person and how fast. Access is limited to the people who need it. Retention is set. Someone is responsible for the whole thing after launch.

That last point is the one most often missed. Privacy is about who is watching the system in month six.

How we handle it

Every system we build runs to these rules as standard, and we will tell you plainly where our scope ends and your lawyer needs to start. If you are scoping a build and want the privacy questions settled first, that is exactly what the first conversation is for.