Australia: compliance overview
2 regulations, 12 mapped obligations and 0 data-transfer routes, organised by when they start to bind you and what you have to do.
Regulatory timeline: what comes next
2025-06-10
Schedule 2, the statutory tort for serious invasions of privacy, commences
Australia Privacy Act 1988 and the 2024 reforms2026-12-10
Schedule 1 Part 15 (automated decisions and privacy policies) commences, inserting APP 1.7–1.9
Australia Privacy Act 1988 and the 2024 reforms2026-12-10
The APP 1.7 automated-decision disclosure duty commences, completing the chain with this guidance
OAIC Australia AI privacy guidance
Applicable regulations (2)
Australia Privacy Act 1988 and the 2024 reforms
A Chinese AI company should watch the Australian regime where it: (1) establishes an entity or employs staff in Australia; (2) supplies apps, SaaS or model APIs to Australian individuals or businesses and thereby handles Australian personal information; (3) trains or fine-tunes models on Australian personal information, on which OAIC has issued dedicated guidance (see au-oaic-ai-guidance); or (4) as an APP entity discloses personal information to an overseas recipient, including an affiliate in China, triggering APP 8 and its extension of accountability. From 10 December 2026, where a product contains an automated step in which a computer program makes, or does a thing substantially and directly related to making, a decision that could reasonably be expected to significantly affect an individual’s rights or interests, the privacy policy must disclose it.
7 obligations · reviewed 2026-09-12
OAIC Australia AI privacy guidance
A Chinese AI company falls directly within this guidance when it: (1) scrapes web data containing Australian personal information for pre-training or fine-tuning; (2) uses Australian user data it already holds for training, which requires the secondary-purpose test of reasonable expectation plus relatedness, failing which consent or a meaningful opt-out is needed; (3) procures and deploys commercially available AI products, including third-party model APIs, in Australia, requiring vendor due diligence, purpose definition and control of what is entered under the use guidance; or (4) operates a product that may output incorrect or artificially generated information about an identifiable individual — OAIC treats such output as personal information, so the accuracy, access and correction obligations follow.
5 obligations · reviewed 2026-09-12
What you can use right now
Relevant standards
- ISO/IEC 42001 Artificial Intelligence Management System (AIMS) · ISO/IEC 42001:2023 (edition 1, dated 2023-12); European adoption EN ISO/IEC 42001:2026
- ISO/IEC 42006:2025 Requirements for bodies providing audit and certification of AI management systems · ISO/IEC 42006:2025 (edition 1, dated 2025-07)
- ISO/IEC 23894:2023 Artificial intelligence — Guidance on risk management · ISO/IEC 23894:2023 (edition 1, dated 2023-02)
- ISO/IEC 42005:2025 Artificial intelligence — AI system impact assessment · ISO/IEC 42005:2025 (adopted identically in Australia as AS ISO/IEC 42005:2025)
Sources (4)
- Privacy Act 1988 (Cth), Australia — current compilation C2026C00227Federal Register of Legislation, Australia · published 1988-12-14 · retrieved 2026-09-12
- Privacy and Other Legislation Amendment Act 2024 (No. 128, 2024), AustraliaFederal Register of Legislation, Australia · published 2024-12-10 · retrieved 2026-09-12
- OAIC (Australia) — Guidance on privacy and developing and training generative AI modelsOffice of the Australian Information Commissioner (OAIC) · published 2024-10-21 · retrieved 2026-09-12
- OAIC (Australia) — Guidance on privacy and the use of commercially available AI productsOffice of the Australian Information Commissioner (OAIC) · published 2024-10-21 · retrieved 2026-09-12
Content as of 2026-09-12 · corpus 2026.09|Compiled from public official sources with links and review dates for compliance decision support. Rules change; have licensed professionals review before external disclosure, regulatory filing or contractual commitments.