Yes, for records the business owns, if personal information is de-identified or the Privacy Act's secondary-use rules are met. The OAIC's October 2024 guidance on training generative AI says that in many cases it will be difficult to show that using existing personal information for AI training was within people's reasonable expectations. Consent, or at least an opt-out, is the safer route, and sensitive information such as health data generally needs consent. A small business under the $3 million turnover threshold loses its exemption if it discloses personal information for a benefit. Sending personal information to an overseas buyer brings in APP 8. US tax withheld on the fee is generally 5% with a W-8BEN-E treaty form.
- De-identify first: information that no longer identifies anyone is not personal information under the Act.
- Relying on "reasonable expectations" for AI training is hard; the OAIC points to consent or an opt-out.
- Small businesses that disclose personal information for a benefit lose the small business exemption.
What an Australian business can realistically license
AI buyers want records that show how work gets done. How much privacy work each kind of record needs varies widely.
| Record | Privacy Act position |
|---|---|
| Procedures, templates and checklists | Usually no personal information; licensable as they are |
| Job histories, tickets and CRM notes | Contain personal information; de-identify or get consent |
| Staff chat and email | Staff personal information; the employee records exemption is unlikely to cover licensing |
| Call recordings | A voice identifies people; consent or effective de-identification needed |
| Health information | Sensitive information: consent generally required, plus state health records laws |
| Tax agents' and lawyers' client files | Client permission under professional rules |
APP 6: using existing records for a new purpose
Personal information can be used or disclosed for the purpose it was collected for. A secondary use such as AI training needs consent or an exception, the most common being that the use is related to the original purpose and the person would reasonably expect it. The OAIC's guidance, published 21 October 2024, says that given the characteristics of AI and community concern about it, in many cases it will be difficult to establish that such a secondary use was within reasonable expectations. It also says the same considerations apply when an organisation provides information to a developer to build a model.
- Do not rely on a broad consent in your privacy policy.
- Seek consent for the AI use, or at least offer people a way to opt out.
- Update your APP 1 privacy policy and APP 5 notices before the new use starts.
- Leave out sensitive information unless you have consent.
Source: OAIC: Guidance on privacy and developing and training generative AI models (October 2024)
De-identify before anything leaves
Under the Act, information is de-identified when it is no longer about an identifiable or reasonably identifiable individual, and de-identified information is not personal information. The OAIC cautions that de-identification is context dependent and may be difficult to achieve, and that removing identifiers may not always be effective. Where there is doubt, treat the records as personal information. See how to de-identify company data.
Source: OAIC: Guidance on privacy and developing and training generative AI models (October 2024)
The small business exemption
Businesses with annual turnover of $3 million or less are generally outside the Privacy Act. The exemption is lost by a business that discloses personal information about another individual for a benefit, service or advantage, unless the individuals consent or the disclosure is required or authorised by law. The OAIC's example is selling a list of personal information for direct marketing. A paid data license that includes personal information falls in the same territory, so a small business licensing identifiable records should assume the APPs apply.
Source: OAIC: APP Guidelines, Chapter B (key concepts, including small business operators)
APP 8: sending personal information overseas
Before disclosing personal information to an overseas recipient, a business must take reasonable steps to make sure the recipient does not breach the APPs, usually through contract terms. In most cases the business remains accountable for the recipient's handling of that information. De-identified data avoids this.
Source: OAIC: APP Guidelines, Chapter 8 (cross-border disclosure)
The statutory privacy tort
Since 10 June 2025, individuals can sue for serious invasions of privacy, including misuse of information about them, where the invasion was intentional or reckless and they had a reasonable expectation of privacy. Licensing identifiable records without consent adds this risk, which is one more reason to de-identify.
Source: OAIC: Statutory tort for serious invasions of privacy
Professional rules
- Tax agents and BAS agents: the Tax Practitioners Board Code of Professional Conduct bars disclosing information about a client's affairs to a third party without the client's permission, unless there is a legal duty to do so.
- Solicitors: the conduct rules require keeping client information confidential unless the client consents or an exception applies.
- Health providers: health information is sensitive information, and state laws such as Victoria's Health Records Act 2001 and NSW's Health Records and Information Privacy Act 2002 also apply.
- Firm-authored templates, procedures and checklists without client details are the realistic starting point.
Source: Tax Practitioners Board: Code of Professional Conduct
Legal questions by situation
The rules that decide what can be licensed, by situation and country:
Next step
See which buyers accept Australian businesses in the Australia country guide, and check the terms to negotiate in the data licensing agreement checklist.
Origin Data Partners is independent and is not affiliated with any AI data buyer. We help owners compare buyers and find the best fit for their records. See what your data is worth.
Common questions
Is it legal for an Australian business to sell its data to AI companies?
Yes, for records the business owns, if personal information is de-identified or the secondary use is allowed under APP 6, usually with consent. Client contracts, professional rules and sector laws such as state health records acts can add limits.
Can we use customer or staff records for AI training without consent?
Only if the use is related to the original purpose and within people's reasonable expectations, and the OAIC says that in many cases this will be difficult to establish for AI training. A broad consent in a privacy policy is not enough. Seek consent or offer an opt-out, or de-identify the records.
Does the small business exemption apply if we license data?
Not if personal information is involved. A business with annual turnover of $3 million or less is generally exempt, but it loses the exemption if it discloses personal information about someone for a benefit, service or advantage, unless the people concerned consent or the law requires or authorises it.
Can we send the data to a US AI company?
De-identified data can be sent without APP 8 applying. For personal information, APP 8 requires reasonable steps, usually a contract, to make sure the overseas buyer does not breach the APPs. In most cases your business stays accountable for what the buyer does with it.
Is US tax withheld when an Australian business licenses data to a US buyer?
Under the Australia-US tax treaty, withholding on royalties is generally 5% if you give the buyer a W-8BEN-E, and it may be creditable against Australian tax. Ask a tax adviser how your fee is characterised.
Can a tax agent or law practice license client files?
Generally not without client permission. The Tax Practitioners Board Code of Professional Conduct bars disclosing information about a client's affairs to a third party without the client's permission unless there is a legal duty to do so, and solicitors owe client confidentiality under the conduct rules. Firm-authored procedures and templates are the realistic scope.
Sources and further reading
Origin Data Partners is independent and not affiliated with any buyer named on this page.
- OAIC: Guidance on privacy and developing and training generative AI models (October 2024)
- OAIC: APP Guidelines, Chapter B (key concepts, including small business operators)
- OAIC: APP Guidelines, Chapter 8 (cross-border disclosure)
- OAIC: Statutory tort for serious invasions of privacy
- Tax Practitioners Board: Code of Professional Conduct