Selling company data to AI labs in Australia
Before company data goes to an AI lab, the privacy law where the people in it live asks one question: can anyone still be identified from it? This page explains the main laws in Australia, what counts as no longer personal, and what to check first. General information as of 2026-10-27, not legal advice: your counsel confirms what applies to your company.
At a glance
| Main laws | The Privacy Act 1988 and its 13 Australian Privacy Principles (APPs) cover most businesses. Health records, the Consumer Data Right and state health laws add rules for some data. The Privacy and Other Legislation Amendment Act 2024 changed the Privacy Act in stages. |
|---|---|
| What counts as de-identified | The Privacy Act says personal information is de-identified if it is no longer about an identifiable individual or an individual who is reasonably identifiable. The OAIC says the test is that there is no reasonable likelihood of re-identification in the setting where the data will be held. |
| Who enforces | The OAIC enforces the Privacy Act. For a serious interference with privacy by a company, a court can set a penalty of up to the greatest of AUD 50 million, three times the benefit obtained, or 30 percent of adjusted turnover when the benefit cannot be worked out. |
| Moving data abroad | Before personal information goes to an overseas recipient, APP 8 expects the company to take reasonable steps to make sure the recipient handles it in line with the APPs. In many cases the company stays accountable for what the recipient does. |
The main laws, and what each means for selling data
Privacy Act 1988 and the Australian Privacy Principles (APP 6: use and disclosure)
The Act covers Australian Government agencies and most private organisations, including a business with annual turnover above AUD 3 million. APP 6 says personal information can be used or disclosed only for the purpose it was collected for, unless an exception applies.
Handing records to an AI lab is a disclosure. If the records still identify people, the company needs the person's consent, or the person must reasonably expect it and the new purpose must be related (directly related for sensitive information). For example, support tickets collected to fix a customer's problem do not automatically become something the customer expects to be passed to a third party for model training.
Source: OAIC, APP guidelines Chapter 6
APP 8 and section 16C (cross-border disclosure)
APP 8 applies when an organisation covered by the Privacy Act discloses personal information to a recipient outside Australia. Section 16C can make the Australian company accountable for the overseas recipient's acts.
If a buyer is overseas and the data still contains personal information, the company must take reasonable steps first, usually an enforceable contract covering APP compliance, subcontractors, complaints and breach response. There are exceptions, such as the recipient being bound by a substantially similar law the person can enforce, or the person giving informed consent after being told the company will no longer be accountable. For example, a files archive sent to a buyer in another country needs that contract in place before it is sent.
Source: OAIC, APP guidelines Chapter 8
APP 11 (security, destruction and de-identification)
APP 11 requires an organisation to take reasonable steps to protect personal information it holds from misuse, interference, loss and unauthorised access. When it no longer needs the information for any permitted purpose, it must take reasonable steps to destroy it or make sure it is de-identified.
A company that moves a dataset to a buyer or a service provider still has to think about how it travels and who can open it. The OAIC says de-identification suits data that still has value, but the re-identification risk must be assessed and managed, and if it cannot be reduced enough, destruction is the better option. For example, a ticket archive with names and phone numbers left in the free text is not yet safe to treat as de-identified.
Source: OAIC, APP guidelines Chapter 11
Privacy and Other Legislation Amendment Act 2024
This Act changed the Privacy Act in stages after Royal Assent on 10 December 2024. The statutory tort for serious invasions of privacy commenced on 10 June 2025 and can reach people and organisations that are not covered by the Privacy Act. The rule that privacy policies must describe certain automated decisions starts on 10 December 2026, and the Children's Online Privacy Code is due by the same date.
The tort means a person who suffers a serious invasion of privacy may be able to sue, even where the Privacy Act does not apply to the organisation. The automated decision rule is about privacy policy wording for entities that use personal information in automated decisions that could significantly affect people. It does not itself regulate a data sale. For example, a company that sells a dataset still holding people's private details has a court risk in addition to the OAIC risk.
Source: OAIC, statutory tort page and ADM transparency consultation page
Small business exemption (sections 6C and 6D of the Privacy Act)
A business with annual turnover of AUD 3 million or less is generally outside the Privacy Act. It is still covered if it is a health service provider, a Commonwealth contracted service provider, or if it trades in personal information.
The OAIC describes trading in personal information as collecting or disclosing personal information in exchange for a benefit, service or advantage, without consent and without being required or authorised by law. A small company that sells records that identify people may therefore lose the exemption for that activity. For example, a small clinic or a small firm selling a customer list does not escape the Act just by being small.
Source: OAIC, small business guidance
My Health Records Act 2012 and state health records laws
The My Health Records Act 2012 covers the national My Health Record system. Victoria has the Health Records Act 2001 (11 Health Privacy Principles) and NSW has the Health Records and Information Privacy Act 2002 (15 Health Privacy Principles). The ACT also has its own health records law.
Health information is sensitive information under the Privacy Act and state health laws add their own principles for health providers and others who hold health information. For example, a clinic software vendor in Victoria or NSW may have to meet both the Privacy Act and the state health principles for the same patient notes.
Source: Victorian Health Complaints Commissioner and NSW legislation
Consumer Data Right (Competition and Consumer Act 2010 and the CDR Rules)
The Consumer Data Right lets consumers have designated data shared securely with accredited providers. It applies to banking, energy and non-bank lending, and is regulated by the ACCC and the OAIC.
If a company holds CDR data that it received through the scheme, the CDR rules and privacy safeguards apply to it in addition to the Privacy Act. The rules on what can be done with that data are separate from the APPs. For example, banking data received through the scheme is not just another dataset that can be passed to a buyer.
How Australia decides data is no longer personal
The Privacy Act says personal information is de-identified if the information is no longer about an identifiable individual or an individual who is reasonably identifiable. The OAIC explains that the aim is no reasonable likelihood of re-identification in the data access environment. The risk does not have to be zero. It does have to be low in the place where the data will actually sit.
The OAIC says the organisation sharing or releasing the data is responsible for assessing and reducing the risk. It says entities may need to engage an expert for a statistical or scientific assessment, and recommends specialist help for rich datasets. The assessment looks at the data itself and at who can access it, what other data is available to them and how practical identification would be.
A re-identification check, in the OAIC's terms, uses at minimum the motivated intruder test. That means asking whether a determined person with reasonable resources could pick out individuals from the data. The OAIC also says to reassess over time, because new data or technology can change the answer. The OAIC and CSIRO Data61 published the De-Identification Decision-Making Framework as a companion to this guidance. For example, removing names from emails but leaving signatures, phone numbers and job titles in the text may still leave people identifiable.
Sources: Privacy Act 1988 (Federal Register of Legislation), section 6 definition of de-identified, OAIC, De-identification and the Privacy Act, OAIC, APP guidelines Chapter 11
Records that carry extra rules
Health records
Health information is sensitive information under the Privacy Act, and APP 6 needs a directly related purpose or consent to use it for something new. Victoria (Health Records Act 2001) and NSW (Health Records and Information Privacy Act 2002) add their own health privacy principles, and the My Health Records Act 2012 governs data in the national system.
Other sensitive information
The Privacy Act lists racial or ethnic origin, political opinions, religious beliefs, sexual orientation, criminal record, genetic information and some biometric information as sensitive information. The OAIC says sensitive information gets a higher level of protection.
Children's data
A Children's Online Privacy Code is being finalised for online services that collect children's personal information, with a final version due by 10 December 2026. The OAIC page still called it a draft when checked, so the final content is not yet known.
Indigenous data
The Maiam nayri Wingara principles call for Aboriginal and Torres Strait Islander ownership and control of Indigenous data across its life cycle, and the CARE principles (Collective Benefit, Authority to Control, Responsibility, Ethics) are used alongside them. The Australian Government's Framework for Governance of Indigenous Data applies to government-held data, so it is guidance for a private seller to weigh, not a Privacy Act rule.
Consumer Data Right data
Data received through the Consumer Data Right in banking, energy or non-bank lending carries the CDR rules and privacy safeguards in addition to the Privacy Act.
Sending data to an AI lab in another country
APP 8.1 says that before an organisation discloses personal information to an overseas recipient, it must take reasonable steps to make sure the recipient does not breach the APPs (other than APP 1). The OAIC says this is usually done with an enforceable contract. Under section 16C the Australian organisation can stay accountable for the recipient's acts that would breach the APPs, even where it took reasonable steps.
The exceptions in APP 8.2 include a recipient bound by a law or scheme that is overall at least substantially similar to the APPs and that the person can enforce, and informed consent where the person is told the organisation will not be accountable. If the data has been properly de-identified so that it is no longer personal information, these personal information rules do not apply to it. Because the legal answer depends on the facts, a company should check the dataset and the destination before sending.
Sources: OAIC, APP guidelines Chapter 8, Privacy Act 1988 (Federal Register of Legislation)
Who enforces it
Questions about selling data from Australia
Is it legal to sell company data to an AI company in Australia?
Often yes, but it depends on what is in the data. If the data contains no personal information, or has been properly de-identified, the Privacy Act's rules on personal information do not apply to it. If it still identifies people, the company needs a basis under APP 6, such as consent or a reasonable expectation with a related purpose, and APP 8 applies if the buyer is overseas. This is general information, not legal advice, and it does not promise compliance.
What counts as anonymised or de-identified data under the Australian Privacy Act?
The Act says personal information is de-identified if it is no longer about an identifiable individual or an individual who is reasonably identifiable. The OAIC explains this as no reasonable likelihood of re-identification in the setting where the data will be held. The company sharing the data is responsible for the assessment and may need an expert. This is general information, not legal advice.
Does the Privacy Act apply to a small business with under AUD 3 million turnover?
Generally no, but there are exceptions. A small business is still covered if it provides a health service, is a Commonwealth contracted service provider, or trades in personal information. The OAIC describes trading as collecting or disclosing personal information for a benefit, service or advantage without consent and without legal authority. The exemption was still in the Act when checked, and proposed reforms have not set a date for removing it. This is general information, not legal advice.
Can I send customer data to an AI lab overseas from Australia?
If the data is personal information, APP 8 expects reasonable steps before it leaves, usually an enforceable contract with the recipient. The Australian company can remain accountable for what the recipient does with it. There are exceptions, such as a substantially similar overseas law the person can enforce, or informed consent. This is general information, not legal advice.
What recent changes to Australian privacy law should I know about?
The statutory tort for serious invasions of privacy has applied since 10 June 2025. From 10 December 2026, privacy policies must describe certain automated decisions made using personal information, and a Children's Online Privacy Code is due by the same date. A further round of reform, including questions about the small business exemption, had no confirmed timetable when checked. This is general information, not legal advice.
Didn't find your question? Ask us directly.
What we do about it
We find and remove the personal information in your company data, test whether anyone could still be identified, and write down how it was done for your counsel. If you license the data through us, the AI lab usually pays for that work, and the AI lab pays our broker fee, only after the deal closes. See how de-identification works and how licensing your data works.
Rules in other regions
- United States: HIPAA, California and other state laws, the FTC, and the records that carry extra rules.
- Canada: PIPEDA, Quebec Law 25, the provincial acts, and health information laws.
- United Kingdom: The UK GDPR, the Data Protection Act 2018, the 2025 Act and the ICO anonymisation guidance.
- European Union: The GDPR, the EDPB on anonymisation and AI models, and the EU AI Act.