Checklist · Privacy, Data Protection & Cyber
Privacy impact assessment checklist for an AI tool (supplement to the OAIC PIA tool)
A structured PIA checklist for deploying an AI product: project description, information flows (prompts, outputs, logs, training), an APP-by-APP analysis including APP 1.7, AI-specific risks, vendor checks, a risk register and sign-off.
- Kind
- Checklist. Steps or checks to work through and tick off.
- Where it applies
- Australia, European Union
- AI use
- Yellow AI can help in set ways. A lawyer checks specific points before use.
- Law stated as at
- 17 October 2026
- Status
- Maintained. Checked on 17 October 2026 against the 9 authorities it cites, for Australia and European Union.
- Version
- 1
- Source
- Written for this library
When to use it
Use before an organisation deploys, or materially changes, an AI tool that handles personal information, alongside the OAIC's PIA tool and guide. It is a working document for the project team and the privacy officer, not a substitute for legal advice on high-risk uses.
How AI may be used
AI may pre-fill the project description and data-flow map from vendor documents and the project brief, and suggest risks. Risk ratings, mitigations and sign-off are human decisions.
AI may
- Extract data flows, retention periods, locations and sub-processors from the vendor's documents into Part B and Part E, with page references.
- Suggest candidate risks for Part D from the use case, for the team to accept or reject.
- Check that every risk in the register has an owner, a mitigation and a due date.
AI must not
- Must not assign final risk ratings or decide that a risk is acceptable.
- Must not be given real personal information to "test" the tool before the PIA is approved.
- Must not treat the vendor's documents as verified without the vendor's contractual commitment.
The lawyer checks
- The APP 6 analysis of any secondary use (including training) is reasoned and supported by notices or consent.
- Any decision that could significantly affect individuals is flagged for APP 1.7 and the privacy policy is updated.
- Sign-off is by people with authority, and review triggers are set.
Method: how the Green, Yellow and Red levels are decided. This is guidance for planning, not legal advice.
Official form
Open the official form. Always use the current version from the issuer.
Read the full text
The full text is for signed-in accounts. It is free. When you sign in you can:
- read the whole precedent, with its drafting notes beside it;
- copy it, or download it as a Word file or Markdown;
- add it to your firm’s knowledge base, so colleagues can find it;
- let the AI tools you connect read it from that knowledge base.
The summary, the law it rests on and the AI-use guidance above stay public. Privacy.
More in Privacy, Data Protection & Cyber
- Data breach response plan (Notifiable Data Breaches scheme, with cyber reporting clocks)
- Notifiable data breach statement to the OAIC: completion guide for the online form
- APP privacy policy with AI and automated-decision disclosures (APP 1.4 and APP 1.7 to 1.9)
- Serious invasion of privacy (statutory tort, Privacy Act Sch 2): claim assessment checklist
- Data protection clause for service providers, including AI vendors (no training, retention, offshore disclosure)
- AI and automated decisions clause for privacy policies and collection notices
All precedents for Privacy, Data Protection & Cyber · Tasks and AI use in this area