Sensitive information and AI: Australia's Privacy Act rules

Sensitive information is the Privacy Act’s short list of things about a person that carry extra rules: health, beliefs, memberships, sexuality, criminal record, genetics and some biometrics. If it isn’t on the list in section 6(1), it isn’t sensitive information, however private it feels.

This guide sorts the borderline items, then covers what the label changes once a document heads for an AI tool. Whether the Act reaches your business at all is its own question, answered in which AI tools the Privacy Act lets you use.

What is considered sensitive information in the Privacy Act

The definition sits in section 6(1) and has five paragraphs. Paragraph (a) holds nine matters, from racial or ethnic origin to criminal record, and each counts only when it’s also personal information. Paragraphs (b) to (e) cover health, genetics and biometrics.

Health has its own section, 6FA, and it reaches far: any illness, disability or injury at any time, wishes about future care, and anything collected while providing a health service. Clinics carry professional rules on top, set out in the Ahpra AI guidelines explained.

The condition in paragraph (a) does most of the work in an office. A training note about religious holidays isn’t sensitive information. A roster note saying which named nurse observes them is.

Personal vs sensitive information: ten examples from office files

Personal information is anything about a person who is identified or reasonably identifiable. Sensitive information is a subset of it, and in an office it rarely arrives labelled. It turns up inside paper written for another reason.

Payslips show it best. Regulation 3.46(2) of the Fair Work Regulations makes a payslip name the fund or account behind each deduction, so a union fee usually shows the union’s name. Bookkeepers see that line every pay run, part of the AI rules for accountants.

Of the ten below, the CV line surprises people most. A CPA membership harms nobody, yet it’s on the list, and a shortlisting tool reading fifty CVs collects it fifty times.

The affidavit row carries one more rule in NSW. An affidavit filed in the Supreme Court generally has to state that generative AI wasn’t used to generate its content, as the Court’s AI practice note explains.

Is biometric data sensitive information?

Only in two forms. Paragraph (d) covers biometric information that is to be used for automated verification or identification, and paragraph (e) covers biometric templates, the stored measurements a matching system compares against.

Those paragraphs came from the ALRC’s report For Your Information. Recommendation 6-4 limited them to automated matching, since consent for every piece of biometric information may be impracticable. The OAIC’s consumer page on biometric scanning puts it more broadly, telling readers their biometric information is sensitive information.

So a photo in an onboarding folder, such as a scanned NSW licence, sits outside (d) while nothing matches it. Run the folder through face-matching software and that changes. Treat every staff photo as one purchase away from sensitive.

Is income sensitive? Money, location and other borderline data

The list is closed, and that cuts both ways. Salary, debts and a home address feel private, but none is on it. Dataplace, the Commonwealth’s data sharing portal, says the definition doesn’t include income, while noting many people reasonably regard it as sensitive.

Other items move the other way. A one-line diary note can be health information with no diagnosis in it, because s 6FA covers an injury at any time. The selector runs through the cases an office tends to argue about.

This one annoys me: the law treats a union fee as more sensitive than a salary. Don’t let that decide what you paste.

What is considered sensitive information for AI

AI adds no categories. It changes how fast the list gets touched. Pasting a document into a chatbot is a use or disclosure under APP 6. Without consent, a new purpose for sensitive information has to be directly related to the original one, not merely related.

The OAIC’s guidance on commercially available AI products, published 21 October 2024 and updated 17 January 2025, adds the point offices miss. If a tool generates or infers personal information, that’s a collection. For sensitive information, APP 3.3 then requires consent unless an exception applies.

Asking a chatbot whether someone’s Monday absences point to a drinking problem is the prompt I’d ban outright. Whatever it answers, you now hold a health guess, and it stays in the account until you clear the history and the saved memories.

A line about AI in a privacy policy is notice, nothing more. If clients should hear how their files meet AI, tell them where they’ll read it, which is the job of an AI clause in the engagement letter.

What AI can I use for confidential information?

The OAIC’s best practice advice is that organisations shouldn’t enter personal information, and particularly sensitive information, into publicly available generative AI tools. It’s a recommendation, not a ban. Expect it to be the yardstick after a complaint.

The same guidance asks businesses to review terms and settings, because some products let the owner use inputs for further training. The account type changes retention too, as our look at what ChatGPT shares sets out.

A leave question with the person taken out

My preference is blunt. If a prompt can work without the person in it, write it without them, and most payroll and leave questions can.

A scanned medical certificate is a picture of the page, so searching it or drawing a box over it proves little. Retype the parts the question needs instead.

In a Word file the name also hides in places nobody reads, like footnotes and text boxes. The made-up example below shows the same question twice.

The second version loses the name, the address, the TFN, the diagnosis and the union, and the arithmetic doesn’t change. Send it as text, not as an attachment whose file properties still carry an author’s name.

The small business exemption, and who it never covers

A business with annual turnover of $3,000,000 or less is usually a small business operator under section 6D and outside the APPs. The exceptions are where sensitive information lives, and the turnover test looks at any financial year since the business started.

Health is the big one. Paragraph 6D(4)(b) catches anyone who provides a health service and holds health information outside an employee record. Under s 6FB(3)(b), health-directed work done in disability care counts. Not every NDIS support is a health service, but many are, which is why our page for NDIS providers begins there.

Ticking nothing below isn’t the end of it. A client contract may bind you anyway, and councils answer to a state privacy law instead of the federal Act.

Employee records belong to the employer, not its contractors

Section 7B(3) exempts an employer’s handling of its own employee records, and those can include health and union membership. The OAIC says the exemption is unlikely to apply to contractors handling another organisation’s staff, naming recruitment, HR, medical, training and superannuation services.

Nor does it cover applicants who weren’t hired. Their police checks and ID copies stay under the ordinary rules, which gives a candidate good reason to send a passport copy watermarked for that one role.

Taking the person out of sensitive information before a prompt

The deciding test sits in the definition of personal information: identified or reasonably identifiable. Leave one detail a colleague would recognise, like the only night-shift forklift driver, and the fact still points to someone. A list of Australian personal identifiers puts those clues beside the numbers.

The box below finds TFNs, Medicare numbers, ABNs, ACNs, NDIS numbers, phones and emails. It won’t flag a union, a diagnosis or a religion, because those are words, not formats. I wouldn’t trust any tool, ours included, to decide whether a passage is sensitive.

For staff who paste payslips, certificates or case notes into AI tools each week, Nonimo on Mac and Windows takes names and ID numbers out on the computer before the text goes, and puts them back in the reply.

Your text never reaches us; the security page explains how. This is my reading of the Act and the OAIC’s pages, and a real set of files deserves advice from someone who has seen them.

Sources

• Privacy Act 1988, compilation No. 104. s 6(1) sensitive information; s 6D small business; s 6EA; s 6FA, s 6FB; s 7B(3); APP 3.3, 3.4 and 6.2(a).
• Fair Work Regulations 2009. Reg 3.46(2): deductions shown with the fund or account name.
• OAIC, Guidance on privacy and the use of commercially available AI products. Best practice advice, inferences as collections, photographs, terms and training.
• OAIC, APP guidelines Chapter B: Key concepts. B.42 and B.44 on consent; B.142 surnames and “clearly implies”.
• Dataplace, Sensitive data, personal information and biometric data. Income isn’t in the definition.
• ALRC, For Your Information (Report 108), Sensitive information. Recommendation 6-4 on biometrics.
• OVIC, IPP 10: Sensitive information. Victoria’s nine categories.

Accessed 7 November 2026.