Privacy check for a planned AI use

What it does

This skill reviews one planned use of an AI product against the Australian Privacy Principles (APPs) and the Office of the Australian Information Commissioner's (OAIC) guidance on privacy and commercially available AI products. It first works out whether the Privacy Act is likely to cover the business, then checks the use step by step and gives a clear result: go, go with changes, or stop and get advice.

When to use it

• Staff want to paste customer emails, quotes or records into a chatbot.
• The business is adding an AI note-taker to meetings or calls.
• The business wants a chatbot on its website that collects enquiries.
• A customer asks how the business uses AI with their information.

What you need

• A one-sentence description of the use and the tool's name.
• What personal information goes in: names, contact details, health, financial or other sensitive information.
• Whether the tool is a free public version or a business plan, and what the vendor says about training on customer data, storage location and retention.
• The business's current privacy policy and collection notice, if it has one.
• Rough annual turnover and industry, for the coverage question.
• Optional: Google Workspace or Microsoft 365 connector to read the privacy policy. Not required.

Steps for Claude

1. Coverage. Use the OAIC's own wording. The OAIC says a small business is one with an annual turnover of $3 million or less, and that most small businesses are not covered by the Privacy Act, but some are. It lists businesses covered regardless of turnover, including health service providers, businesses that trade in personal information, Commonwealth contracted service providers, and businesses that have opted in. Point the user to the OAIC small business checklist to confirm. If the business is not covered, say so, then continue the check as good practice, because customers still expect it and the OAIC recommends protecting personal information anyway.
2. Map the data. List what personal information goes in and what comes out. The OAIC says privacy obligations apply to personal information put into an AI system and to output that contains personal information, and that AI-generated or inferred information about an identifiable person is itself personal information.
3. Check each point:
   • Purpose (APP 6). Was the information collected for this purpose? If not, is there consent, or would the person reasonably expect this use?
   • Collection (APP 3 and APP 5). Does a note-taker or chatbot collect new information? Are people told, at the time, that AI is involved?
   • Transparency (APP 1). Does the privacy policy explain the AI use? Is a public chatbot clearly labelled as AI?
   • Overseas disclosure (APP 8). Does the vendor store or process data outside Australia?
   • Security (APP 11). Who at the vendor can access inputs? Is there an option to switch off training on the business's data? How long is data kept?
   • Accuracy (APP 10). Who checks AI output before it is relied on or sent?
4. Apply the OAIC's best-practice line. The OAIC recommends that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools. Flag any plan that does this.
5. Look ahead. Amendments made by the Privacy and Other Legislation Amendment Act 2024 add APP 1 obligations about automated decisions, which the OAIC says commence on 10 December 2026. If the AI use makes or substantially helps make decisions that significantly affect people, flag that the privacy policy may need to describe it.
6. Give the result and the specific changes needed.

Output format

1. Coverage finding, with the OAIC link and any assumptions.
2. Data map: what goes in, where it goes, what comes out.
3. Table: APP, Question, Finding, Change needed.
4. Result: Go, Go with changes, or Stop and get advice.
5. Draft wording for a privacy policy paragraph and a short staff rule, if needed.

Australian rules and sources

• OAIC, Guidance on privacy and the use of commercially available AI products (published 21 October 2024, updated 17 January 2025): https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/guidance-on-privacy-and-the-use-of-commercially-available-ai-products
• OAIC, Small business (coverage and checklist): https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/organisations/small-business
• Australian Privacy Principles quick reference (APP 1 to APP 13): https://www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-quick-reference
• OAIC, Sending personal information overseas: https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/handling-personal-information/sending-personal-information-overseas
• OAIC, APP guidelines chapter 1, including the automated decisions obligations from 10 December 2026: https://www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-guidelines/chapter-1-app-1-open-and-transparent-management-of-personal-information

Limits

This is general information, not legal advice. Privacy coverage depends on facts the skill cannot verify, such as turnover history and related businesses. Health, childcare, legal and financial businesses, and anyone handling sensitive information, should get advice before going ahead.

Example requests

• "Can my receptionist paste patient enquiry emails into ChatGPT to draft replies?"
• "We want an AI note-taker on all client calls. What do we need to tell people?"
• "Check our plan to use Claude to summarise customer complaints from our CRM."