A physio clinic on the Gold Coast wants AI to draft appointment reminders. A tradie in Brisbane wants it to turn voice notes into quotes. A property manager wants it to summarise tenancy applications before the weekly meeting. Each of these is a sensible use of the technology, and each of them involves feeding real people's information into a tool the business did not build.
That second part is where many owners stop thinking. Privacy feels like a problem for banks and big retailers, not for a business with eight staff and a shared inbox. Yet the rules on personal information apply to AI tools in much the same way they apply to a filing cabinet or an email account, and in some cases the obligations are stricter than owners expect.
This guide walks through what the Office of the Australian Information Commissioner has said about AI, how to work out whether the Privacy Act covers your business, and how to set up automation so that it saves time without putting clients' details somewhere they should not be. None of it requires a lawyer to understand, although a lawyer is the right person for specific questions.
Does the Privacy Act cover your business?
Most small businesses are not covered by the Privacy Act 1988, but some are. The OAIC defines a small business as one with an annual turnover of $3 million or less, and that turnover includes all income from all sources. If you sit under that line, the Australian Privacy Principles may not apply to you, but the exemption has important exceptions.
Regardless of turnover, the Act covers any business that provides a health service, trades in personal information, operates a residential tenancy database or is a reporting entity under anti-money laundering law, among others. The OAIC's definition of a health service provider is broad. It lists medical practitioners, pharmacists, allied health professionals and complementary therapists, which captures a large share of small clinics.
Even where the exemption applies, it is worth behaving as if it did not. Clients do not check your turnover before deciding whether to trust you, and a data mishap costs reputation regardless of the legal position. Turnover also changes: a business that grows past the threshold takes on the obligations, and it is far easier to build good habits early than to retrofit them later.
What the OAIC says about using AI products
In October 2024 the OAIC published guidance on privacy and the use of commercially available AI products, covering products a business pays for as well as freely available chatbots. Its starting point is direct: the Privacy Act applies to all uses of AI involving personal information. Under APP 6, details entered into an AI system should generally be used only for the purpose they were collected for, unless the client has consented or would reasonably expect the secondary use.
The guidance also makes a clear best-practice recommendation. The OAIC recommends that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools, because of the significant and complex privacy risks involved. For a clinic, sensitive information includes health details, which means a patient's notes should never be pasted into a public chatbot to tidy up the wording.
The practical reading for a small business is straightforward. Free, general-purpose tools are fine for work that contains no personal details: drafting a newsletter, rewording a policy, brainstorming a promotion. Anything involving clients' names, contact details, health information or identity documents needs either a business-grade tool with appropriate settings or a step that removes those details first.
Identity documents need special care
Plenty of Australian small businesses collect identity documents. Real estate agencies take them with rental applications, employers sight them when onboarding staff, and businesses that hire out equipment often keep a copy of a driver licence. These scans contain far more information than most tasks need, including dates of birth, addresses and document numbers.
They are also the files staff are most tempted to drop into a chatbot so it can fill in a form. If a workflow needs only a name and a licence number, take those two fields through a controlled process and leave the rest of the image alone. Better still, ask whether you need to keep the copy at all once identity has been checked.
The same logic applies to anything containing bank details, tax file numbers or Medicare numbers. The less of it that travels, the less there is to lose. Automation can actually help here, because a well-designed workflow can remove or mask those fields automatically before any AI model sees the document, rather than relying on staff to remember every time.
Setting up automation the careful way
A careful setup starts by mapping what the task needs. An appointment reminder needs a first name, a time and a location. A quote needs the job details, not the client's history. Write down the minimum information for each step, then configure the tools so they receive only that, ideally through connections to the software you already use.
This is where a specialist can earn their fee. Aivy, which provides AI automation services in Australia from teams in Melbourne and Sydney, works across accounting, healthcare, NDIS, real estate, professional services and e-commerce. It connects AI to the tools a team already has and starts with a free 30-minute diagnostic call, and building on existing systems is usually cheaper than replacing them.
Whoever builds it, ask where data will be processed and stored, which staff and contractors can access it, and how long it is kept. The OAIC's guidance asks businesses to do due diligence before adopting a product, including how human oversight can be embedded into the process. Get the answers in writing and keep them with your privacy documents.
Keep a person in the loop
The OAIC's point about human oversight has a very practical side. A model drafting reminders cannot see that a patient rang yesterday to cancel, or that a tenant has already paid. Keep a person responsible for anything that affects a client directly, such as a refund, a rejected application or a clinical message, and have them check a sample of automated output every week.
Staff also need to know where the line sits. Tell them which tools are approved for client work, which are fine only for general drafting, and who to ask before trying something new. Check the settings again whenever a product changes its terms or adds features, because what it does with the information it receives can change too.
Automation that clients can trust
Australian small businesses have every reason to use AI to win back time spent on admin. The Privacy Act and the OAIC's guidance do not stand in the way of that. They ask businesses to think about what information they hand over, to whom, and why, which is good practice whether or not the law strictly applies.
The businesses that get this right will automate the dull work and keep their clients' trust while doing it. Being able to tell a client exactly how their details are handled is worth having, and it may prove as valuable as the hours the automation saves.
