Every Australian organisation in a new Delinea survey has a written policy on what data AI tools may touch. Two in three cannot enforce it in real time. The survey, reported by SecurityBrief Australia on 30 September, found 99.6% of Australian organisations had an AI tool or agent reach sensitive data beyond its intended scope in the past year, and 64% of Australian respondents admitted they had bypassed the approval process for using AI at some point.

So the board question is no longer “do we have an AI policy?” It is “what happens to customer data when a staff member pastes it into a public chatbot, and can we prove it did not happen?” This piece sets out the questions to ask, what the privacy regulator already expects, and when a private AI setup is the cheaper answer than trying to police public tools. If you want the short version for your own business, our free AI audit maps which tools your staff actually use and where customer data is going.

Why this week changed the conversation

Two things landed within days of each other.

First, the enforcement gap. The Delinea research surveyed 2,254 IT and security leaders and 2,250 non-IT employees across eight markets including Australia. Every Australian organisation had an access policy, yet only 34% checked AI access against that policy in real time, and only 12% could detect a scope violation as it happened (19% globally). Two-thirds of Australian organisations took a full day or more to notice one. Put those numbers side by side and the picture is blunt: in roughly two of every three Australian businesses the AI policy is a document, not a control.

Second, a reminder of what “public” really means. On 25 September it emerged that OpenAI’s own experimental agents had posted 53 ChatGPT user images to image-hosting sites. TechCrunch reported that the images were user-provided content included in training data, that consumer users are opted in to data sharing unless they choose otherwise, and that OpenAI said it could not notify the people affected because its technical approach and privacy policy prevent it from reassociating the images with the original providers. SBS reported the same disclosure and noted that anonymised training data may not be fully stripped of personal information.

Read that second point again from a business owner’s chair. Nobody hacked the vendor from outside. The data left through the vendor’s own internal research. And once it was anonymised for training, even the vendor could not tell the owners it had gone. If one of your staff pasted a customer’s file into a personal chatbot account, you would have no way to find out either.

What the OAIC already expects

None of this needs new law to become your problem. The Office of the Australian Information Commissioner published guidance on privacy and commercially available AI products in October 2024, and its top takeaways are specific:

• Privacy obligations apply to any personal information put into an AI system, and to output that contains personal information.
• Under APP 6, personal information put into an AI system may only be used or disclosed for the primary purpose it was collected for, unless an exception applies.
• Businesses should update their privacy policies and notices to say clearly how they use AI.
• The OAIC recommends that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools.

That last line is as close to a rule as a regulator’s guidance gets. A customer who gave you their details to process an insurance claim did not agree to those details going into a consumer chatbot that may use them for training. That is a secondary use, and the burden sits with you.

There is a second deadline behind this one. From 10 December 2026, privacy policies must explain when software makes or substantially assists decisions about people. We covered that in our piece on the automated decision-making obligation, and it is worth doing both reviews in the same pass.

“We’re too small for the Privacy Act.” Check that first

Many owners assume the small business exemption lets them off. It might, but check before relying on it. The OAIC’s rights and responsibilities page says the Act generally exempts businesses with annual turnover of $3 million or less, then lists who is covered regardless of size. That list includes private health service providers (which the OAIC says covers allied health, naturopaths, chiropractors, gyms and weight loss clinics, child care centres and private schools), businesses that trade in personal information, credit reporting bodies, contracted service providers under government contracts and Consumer Data Right accredited businesses.

A physio clinic with two staff, a tutoring centre or a subcontractor on a government job is inside the Act. So is anyone whose client contract flows privacy obligations down to them, which is common in enterprise and government supply chains. And even where the exemption genuinely applies, your customers and your insurer will not care about the turnover test if their data turns up somewhere it should not.

Seven questions a board should ask before staff paste customer data into a chatbot

These are the questions we ask in an AI audit. Each one has a yes or no answer, which is the point.

1. Which AI tools are staff actually using? Not which ones are approved. Pull browser and network logs, check expense claims for subscriptions, and ask people directly with a no-blame amnesty. The Delinea figure of 64% bypassing approval says the approved list is not the real list.
2. Are those accounts personal or business? A staff member’s personal account is outside every contract you have. Consumer tiers can use inputs for training by default, which is exactly how the images in the OpenAI disclosure ended up in a training set.
3. What does each contract say about training, retention and location? Get it in writing for every tool that touches customer data: whether inputs train models, how long prompts are kept, where they are stored and processed, and who at the vendor can see them.
4. What data classes are banned from public tools? Write the list: customer personal information, health information, tax file numbers, card data, credentials, unreleased financials, legal advice. Then name the tool staff should use instead. A ban without an alternative just moves the behaviour to phones.
5. Can we detect a breach of the rule on the day it happens? Only 12% of Australian organisations in the survey could. Data loss prevention rules on the browser and email gateway, and an approved tool with logging, are what move you into that 12%.
6. Who signs off on each sensitive use, and can we trace it? The survey found 42% could trace sensitive AI access back to a named authoriser. If your answer is “the IT manager, probably”, write it down properly.
7. Does our privacy policy describe what we actually do? APP 1 expects it to. If staff use AI to draft customer letters or summarise files, the policy should say so.

If you get three or more “no” or “not sure” answers, you do not have an AI data problem in theory. You have one now.

Public tool, business tier or private AI: how to choose

There are three realistic setups, and the right one depends on what data is involved, not on how enthusiastic the team is.

Public consumer tools are fine for work with no personal or confidential data in it: rewriting a job ad, brainstorming a campaign, summarising a public report. Ban them for everything else and make the ban easy to follow.

Business tiers of the same tools give you a contract, admin controls and usually logging. They suit most office work once you have read the training and retention terms yourself and set the admin options. They do not, on their own, solve data location, and they still rely on staff choosing the business account over the personal one.

Private AI means the model runs in an environment you control: your own cloud tenancy in an Australian region, or dedicated infrastructure, connected to your own document stores with your own access rules and logs. It is the right call when you handle health, financial or legal data at volume, when client contracts require data to stay in Australia, or when you need to prove who saw what. Our earlier guide to private AI covers the three build options and what moves the cost.

The mistake we see most is treating this as a choice between “allow ChatGPT” and “ban ChatGPT”. Staff use these tools because they save hours. Take the tool away without giving them a better one and they go back to their phones, where you can see nothing at all.

A 30-day plan that does not stall the business

Week one: find out what is in use. Run the tool inventory in question 1 and classify each tool by the data it has already touched. Do not punish anyone for what the inventory turns up, or the next one will be empty.

Week two: write a one-page rule. List the banned data classes, the approved tool for each kind of work, and the named person who approves exceptions. One page, because nobody reads twelve.

Week three: put the controls behind it. Set up business accounts with training switched off where the contract allows, turn on single sign-on so personal accounts stand out, and add data loss prevention rules for the obvious patterns such as TFNs, card numbers and Medicare numbers. If regulated or high-volume sensitive data is involved, scope a private AI environment in parallel; our secure AI system development page sets out the controls we build in.

Week four: update the privacy policy, brief staff in person, and set a monthly check of logs against the rule. That monthly check is what turns a policy on paper into one you can defend.

How Digital One Agency helps

We start with a free AI audit. We map the AI tools your people use, where customer data is flowing, which contracts cover it and which do not, and we give you a short written list of fixes in priority order. Some businesses only need the one-page rule and a switch to business accounts. Others need a private AI environment that keeps sensitive work in Australia, connected to the systems they already run, and we design and build that too.

We do not publish fixed prices for private AI builds, because the cost depends on data volume, integrations and hosting. The audit tells you whether you need one at all before you spend anything, and what it would take if you do.

Next step: book your free AI audit. You tell us how your team works, we come back with the tool inventory questions, a risk ranking of what we find and a recommended setup. If you would rather talk it through first, book a meeting with Digital One Agency.

Frequently asked questions

Is it illegal for staff to put customer data into ChatGPT in Australia?

There is no single rule that bans a named tool, but if your business is covered by the Privacy Act, APP 6 limits using personal information for purposes other than the one it was collected for. The OAIC recommends organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools. Treat that as the standard a regulator will judge you against.

Does the small business exemption mean the Privacy Act does not apply to my AI use?

Only if your annual turnover is $3 million or less and you are not in a covered category. Health service providers, including allied health, gyms and child care centres, businesses that trade in personal information, contracted service providers under government contracts and CDR accredited businesses are covered regardless of size. Client contracts can also impose privacy obligations on you.

Is a business account for an AI tool enough, or do we need private AI?

For most office work, a business tier with training switched off, single sign-on and logging is enough once you have read the contract terms. Private AI makes sense when you handle health, financial or legal data at volume, when contracts require data to stay in Australia, or when you must prove who accessed what.

How do we find out which AI tools our staff already use?

Combine browser and network logs, expense and subscription records, and a no-blame survey of staff. Surveys alone miss a lot, since the Delinea research found 64% of Australian respondents had bypassed the approval process for AI at some point. Our free AI audit runs this inventory for you.

What should an AI acceptable use policy include?

Keep it to one page: the data classes that must never go into public tools, the approved tool for each kind of work, who approves exceptions, and how compliance is checked. A ban with no approved alternative tends to push staff onto personal phones, where you have no visibility at all.