Using AI with customer data: a privacy checklist for Australian businesses

Australian businesses are rightly cautious about putting customer data into AI tools. The good news: with sensible choices, you can use AI and still respect your customers’ privacy. This checklist is general information, not legal advice — check your obligations with an adviser if you’re unsure.

Know what data you’re using

Map exactly which personal information each automation touches. If a workflow doesn’t need a field — a date of birth, a Medicare number, a full address — don’t send it.

Choose providers carefully

• Use business or enterprise plans that don’t train models on your data.

• Check where data is stored and processed, especially if it leaves Australia.

• Read the provider’s data retention settings and shorten them where possible.

Update your privacy policy

Your privacy policy should explain what you collect, why, who you share it with (including software providers) and whether data may be stored overseas. If you add AI tools, review it.

Keep humans in the loop

Use AI to draft, sort and summarise — not to make significant decisions about people on its own. Health, financial and legal matters should always be reviewed by a qualified person.

Secure access

• Give each automation only the permissions it needs.

• Turn on two-factor authentication for every connected account.

• Keep a simple record of which systems are connected and who owns them.

Have a plan if something goes wrong

Know how you’d pause an automation, who you’d notify and how you’d assess whether a data breach is notifiable under the Notifiable Data Breaches scheme.

Privacy is built into every Saggs project from the first call. If you’d like us to review an existing workflow, get in touch.