How to use AI for privacy impact assessments for AI in Australia

Steps

1. Map the personal information

   Write down what goes in, who types it, which vendor and subprocessors see it, which country stores it, and what comes back out. Include prompts, documents, outputs and logs. The OAIC’s guidance on commercially available AI products is the Commonwealth reading of that flow. The hosting guide shows how to separate an Australian office from an Australian region.

2. Apply the principles that actually bind

   Australian Privacy Principles bind APP entities. A state public sector may be under that state’s information privacy principles or a privacy Act instead. Do not paste the Commonwealth principles onto an agency they do not cover. The privacy and FOI tracker lists the regime page for each state.

3. Use the NSW IPC guide where it is the right audience

   The Information and Privacy Commission NSW publishes guidance on generative AI privacy risks for the agencies it speaks to. Use it when you are in that audience. It is not a national template. Read the page, then write the assessment in the agency’s or firm’s words.

4. Record the mitigations and who owns them

   For each risk, write the change: a different region, a ban on a class of document, a shorter retention, a human check, or a decision not to use the tool. Name the person who will do it and the date you will read it again. An assessment that ends at “risk: high” has not finished.

Record the checks: Privacy tasks · Open the court note for the forum

Sources

• OAIC: commercially available AI products
• IPC NSW: GenAI privacy risks