Clause · Privacy, Data Protection & Cyber
Data protection clause for service providers, including AI vendors (no training, retention, offshore disclosure)
An Australian-law data protection clause for a services or SaaS agreement that controls how a supplier, including an AI provider, uses, stores, moves and deletes customer data, with no-training and breach-cooperation terms that fit the Privacy Act.
- Kind
- Clause. Wording to drop into a longer document.
- Where it applies
- Australia
- AI use
- Yellow AI can help in set ways. A lawyer checks specific points before use.
- Law stated as at
- 17 October 2026
- Status
- Maintained. Checked against the cited sources on 17 October 2026.
- Version
- 1
- Source
- Written for this library
When to use it
Use as the customer's position when buying a service that will hold personal or confidential information, especially one with AI features. Not suitable as is where the supplier is the controller of its own data or where the GDPR's article 28 terms are mandatory; adapt for those.
How AI may be used
AI may compare a vendor's terms with this clause and list gaps. Negotiated positions and acceptance of residual risk are for the lawyer and the client.
AI may
- Extract the vendor's terms on training, retention, sub-processors, locations and incident notice into a table against each clause here.
- Prepare a first mark-up of the vendor's paper using this clause as the playbook, for lawyer review.
- Track the vendor's sub-processor list and model-change notices against clauses 7 and 10.
AI must not
- Must not accept a vendor position or decide that residual risk is acceptable.
- Must not upload the client's confidential drafts into a tool whose terms allow training on inputs.
- Must not treat a vendor's marketing or trust-centre statements as contractual commitments.
The lawyer checks
- The vendor's online terms, data processing addendum and AI terms have all been read, including the order of precedence.
- Locations and sub-processors match what the client's privacy policy says about overseas disclosure.
- The incident notice period lets the client meet s 26WH and s 26WK.
Method: how the Green, Yellow and Red levels are decided. This is guidance for planning, not legal advice.
Official form
Open the official form. Always use the current version from the issuer.
Read the full text
The full text is for signed-in accounts. It is free. When you sign in you can:
- read the whole precedent, with its drafting notes beside it;
- copy it, or download it as a Word file or Markdown;
- add it to your firm’s knowledge base, so colleagues can find it;
- let the AI tools you connect read it from that knowledge base.
The summary, the law it rests on and the AI-use guidance above stay public. Privacy.
More in Privacy, Data Protection & Cyber
- Data breach response plan (Notifiable Data Breaches scheme, with cyber reporting clocks)
- Notifiable data breach statement to the OAIC: completion guide for the online form
- APP privacy policy with AI and automated-decision disclosures (APP 1.4 and APP 1.7 to 1.9)
- Serious invasion of privacy (statutory tort, Privacy Act Sch 2): claim assessment checklist
- AI and automated decisions clause for privacy policies and collection notices
- Privacy impact assessment checklist for an AI tool (supplement to the OAIC PIA tool)
All precedents for Privacy, Data Protection & Cyber · Tasks and AI use in this area