Data Governance for AI (Australian Privacy Act)

There's no AI exemption in the Privacy Act. If your AI touches personal information (and it almost certainly does), every Australian Privacy Principle applies. Collection and consent. Use and disclosure. Data quality and security. Individual rights. Accountability. All of it.

Most organisations I advise have a privacy framework that predates their AI deployments. They built it for human-driven data processing. AI changes the game in ways that framework doesn't cover.

Training data provenance is the first gap. Where did the data come from? Was consent valid for AI use specifically? Collection notices written 3 years ago almost certainly don't mention AI processing. That's a compliance gap right now.

Vendor data sharing is the second gap. When you send data to an AI vendor's API, that's a disclosure under the Privacy Act. If that vendor processes data offshore, you've got cross-border transfer obligations. If their terms let them use your data for model training, you've potentially disclosed personal information for a purpose your customers never consented to.

Automated processing at scale is the third gap. When AI processes thousands of records per hour, a privacy breach isn't one customer's data. It's potentially your entire customer base. The risk profile is fundamentally different from human processing.

The OAIC's recent enforcement actions confirm this isn't theoretical. They've issued determinations against organisations for inadequate privacy impact assessments and failures to meet APP obligations in automated processing. The Privacy Act reform trajectory points toward stronger individual rights, mandatory algorithmic transparency, and higher penalties. Organisations building AI data practices today need to build for where the law is heading, not just where it sits now.

The Compliance Velocity Framework (CVF) gives organisations a structured path to close these gaps. Sprint packages tackle specific compliance gaps: privacy impact assessments, vendor contract reviews, consent framework updates. Strategic programs rebuild data governance foundations for AI-era operations. The right entry point depends on your current maturity and risk exposure.

The OAIC has made AI a compliance priority. That's not speculation. They've said it publicly and they're resourcing enforcement accordingly. Organisations that assume their existing privacy compliance covers AI are the ones most likely to get caught.

The penalties are real. Under the amended Privacy Act, serious or repeated interference with privacy carries penalties up to the greater of $50 million, three times the benefit obtained, or 30% of adjusted turnover. For an ASX-listed company, that's material. For a mid-market firm, it's potentially terminal.

Beyond penalties, privacy breaches through AI are reputation killers. When an AI system exposes thousands of customer records because a vendor didn't secure their API properly, "we trusted the vendor" doesn't satisfy customers or regulators. You need documented data governance: privacy impact assessments completed, vendor contracts specifying data handling requirements, consent frameworks updated for AI use, and audit trails proving compliance.

Data governance also enables AI quality. Poor data governance means poor data quality, which means poor AI performance. Organisations that treat privacy compliance as a tax miss the point. Good data governance is good data management. It makes your AI work better.

For boards, data governance for AI is a s180 issue. Directors must exercise care and diligence. If AI data practices create Privacy Act exposure and the board hasn't ensured appropriate governance, that's a failure of oversight.

A retailer's AI customer segmentation engine used purchase history collected for transactional purposes. A privacy impact assessment (part of a CVF sprint package) revealed a purpose mismatch: the collection notices said "to process your order and improve our service." AI-driven behavioural segmentation for targeted marketing wasn't covered. The fix required updated collection notices, a re-consent campaign for existing customers, and vendor contract amendments, delivered as a single fixed-price sprint. The alternative was deploying on a non-compliant basis and hoping the OAIC didn't notice.

A financial services firm's AI credit model processed customer data through an offshore vendor. Legal review identified that this constituted overseas disclosure under APP 8. The vendor's terms allowed them to use client data for "service improvement," which included model training. Contract renegotiation removed that clause, added data localisation requirements, and established audit rights. The strategic program also rebuilt their vendor assessment framework for all AI procurements.

A healthcare provider planned to deploy an AI diagnostic support tool trained on patient records. A CVF privacy impact assessment flagged that patient consent for treatment doesn't extend to AI model training. The deployment was paused pending ethics committee review and a specific consent framework for AI use of clinical data. The pause prevented what would have been a serious compliance breach.

An insurer's AI claims processing accessed 47 data fields per claim. Data minimisation review (a fixed-price sprint) reduced this to 12 essential fields, improving both Privacy Act compliance and processing speed. Less data in means less data at risk.