Precedents: Privacy, Data Protection & Cyber
7 starting-point precedents for this area. Each one names the law it rests on and says how far AI may help.
- Precedents in this area
- 7
- Full text
- For signed-in accounts
- Newest law stated as at
- 17 October 2026
- Guidance for this area
- Tasks and AI use in Privacy, Data Protection & Cyber
| Precedent | Kind | Where it applies | AI use | Law stated as at |
|---|---|---|---|---|
| Data breach response plan (Notifiable Data Breaches scheme, with cyber reporting clocks)A ready-to-tailor plan that tells the response team how to contain, assess, notify and review a data breach under Part IIIC of the Privacy Act, and lists the other reporting clocks that may run at the same time. | Policy | Australia, New Zealand, European Union, United Kingdom (England and Wales) | Yellow | 17 October 2026 |
| Notifiable data breach statement to the OAIC: completion guide for the online formPractical guide to completing the OAIC's online Notifiable Data Breach form: what goes in the mandatory statement (Part one), what to add in the optional Part two, what to attach, and the traps that lead to a non-compliant statement. | Form | Australia | Red | 17 October 2026 |
| APP privacy policy with AI and automated-decision disclosures (APP 1.4 and APP 1.7 to 1.9)A complete APP privacy policy for an Australian organisation that covers every APP 1.4 heading and the automated-decision disclosures required from 10 December 2026 under APP 1.7 to 1.9, with plain-English AI and chatbot sections. | Policy | Australia | Yellow | 17 October 2026 |
| Serious invasion of privacy (statutory tort, Privacy Act Sch 2): claim assessment checklistChecklist for assessing a claim, or a threatened claim, under the statutory tort for serious invasions of privacy: limitation, exemptions, each element, defences, remedies and the damages cap, forum, evidence and AI-specific scenarios such as deepfakes. | Checklist | Australia | Yellow | 17 October 2026 |
| Data protection clause for service providers, including AI vendors (no training, retention, offshore disclosure)An Australian-law data protection clause for a services or SaaS agreement that controls how a supplier, including an AI provider, uses, stores, moves and deletes customer data, with no-training and breach-cooperation terms that fit the Privacy Act. | Clause | Australia | Yellow | 17 October 2026 |
| AI and automated decisions clause for privacy policies and collection noticesModular privacy policy wording on AI: how AI is used, chatbot labelling, the APP 1.7 to 1.9 automated-decision disclosure required from 10 December 2026, AI-inferred information, training and overseas AI providers, plus a short chatbot collection notice. | Clause | Australia | Yellow | 17 October 2026 |
| Privacy impact assessment checklist for an AI tool (supplement to the OAIC PIA tool)A structured PIA checklist for deploying an AI product: project description, information flows (prompts, outputs, logs, training), an APP-by-APP analysis including APP 1.7, AI-specific risks, vendor checks, a risk register and sign-off. | Checklist | Australia, European Union | Yellow | 17 October 2026 |
AI use levels: Green means AI can do most of the drafting and a lawyer reviews it. Yellow means AI helps in set ways and a lawyer checks specific points. Red means a lawyer does the work and AI stays out of the decisive steps.