Insights
Insights into AI governance and the Australian laws that apply to AI use in business.
Data Privacy Regulations in Australia: The Full Picture
Australia's data privacy regulations aren't one law - they're the Commonwealth Privacy Act plus separate state laws, with a new disclosure requirement landing 10 December 2026.
Privacy Principles Australia: All 13 APPs Explained
Australia's 13 privacy principles govern how organisations handle personal information, with four that matter specifically when a business uses AI.
Privacy Act NSW: What Actually Applies to Your Business
For most private NSW businesses, the privacy act that applies is the Commonwealth Privacy Act 1988, not any NSW state law.
PPIP Act (NSW): Who It Actually Covers
NSW's privacy law covers public sector agencies only - a private business picks up obligations under it only through a specific government contract.
Privacy and Data Protection Act 2014 (Vic): Who It Covers
Victorian public sector privacy law that binds government departments, councils and statutory authorities - not private business directly.
Information Privacy Act 2009 (Qld): Who It Covers Now
Queensland public sector privacy law running a single set of Queensland Privacy Principles since July 2025 - not covering private business directly.
APP 10 Privacy: Keeping AI Data Accurate
APP 10 requires reasonable steps to keep personal information accurate - and the OAIC warns that generative AI can produce confidently wrong output.
Privacy and Confidentiality: What AI Changes
Privacy and confidentiality are legally different things, and AI tools can trigger either.
APP 12 Privacy: Access to Personal Information
APP 12 gives individuals the right to access personal information an organisation holds about them, on request.
Voluntary AI Safety Standard: What Replaced It in 2025
The Voluntary AI Safety Standard was replaced in October 2025 by the National AI Centre's Guidance for AI Adoption, condensing 10 guardrails into 6 practices called AI6.
APP 1.7: What to Disclose Before 10 December 2026
From 10 December 2026, APP 1.7 requires disclosure in privacy policies when computer programs make or substantially support decisions affecting people.