Privacy Act sensitive information in the files your staff give AI
· Updated · Written and maintained by Joaquín Trapero, Nonimo
Sensitive information under Australia’s Privacy Act is a short list in section 6(1): health, union and professional memberships, religion and philosophical belief, political views, racial or ethnic origin, sexual orientation, criminal record, some genetic information, and biometrics. The list is familiar. What is less familiar is how much of it sits in the ordinary paper of an office far removed from health care.
A payslip names the union the fee goes to. A sick leave certificate names a condition. A CV lists professional memberships, and a recruitment file holds the police check.
When staff put any of those into an AI tool to check a calculation or draft a reply, the tool receives Privacy Act sensitive information, and the rules that apply to it are stricter than the ones for a name and an email address. This guide covers where those categories hide, what changes when they reach AI, and what to take out first.
What Privacy Act sensitive information covers, limb by limb
The definition is one of the general ones the Act collects in section 6(1). We read it in the compilation in force since 4 June 2026, number 104. It has five limbs, and the first one carries a condition the other four do not.
Limb (a) reaches information or an opinion about an individual’s political opinions, membership of a political association, religious beliefs or affiliations, philosophical beliefs, racial or ethnic origin, membership of a professional or trade association, membership of a trade union, sexual orientation or practices, and criminal record. The Act adds “that is also personal information”. So an opinion about a religion in general is not sensitive information. An opinion about a named employee’s religion is.
Limbs (b) to (e) are health information, genetic information that is not already health information, biometric information used for automated verification or identification, and biometric templates. Health information has its own section, 6FA, and it is wide. It takes in information about a person’s illness, disability or injury at any time, and other personal information collected while providing a health service.
That width is why the health professions have their own rules on top. Clinics drafting patient letters with AI will find that side in the Ahpra AI guidelines explained. This page is about the rest of the list, in offices that do not think of themselves as holding any of it.
Two limits the OAIC draws
The regulator narrows the first limb in its guidance on key concepts. Information may be sensitive where it clearly implies one of the listed matters. Its example is the surname: many surnames have a particular ethnic origin, but a surname alone does not tell you a person’s origin, so it is not sensitive information on that basis.
Biometrics are narrower than people expect. A photo on a staff card does not fall under limb (d) unless it is used for automated verification or identification. The OAIC’s AI guidance does warn, though, that photographs or recordings from which race or health can be inferred may contain sensitive information in their own right.
The office paper each category turns up in
Most of the categories arrive through documents that were written for another purpose. Nobody collects a union membership on purpose in a payroll run. It arrives as a deduction. The table pairs each category with the place it usually turns up in an Australian office, a practice or a payroll bureau.
| Category in section 6(1) | Where an office usually meets it |
|---|---|
| Union, professional or trade association membership | the deduction line on a payslip, the memberships on a CV |
| Health | a medical certificate, a workers compensation claim, a return to work plan |
| Criminal record | the national police check in a recruitment file |
| Religious beliefs or affiliations | a leave request for a religious holiday, a will’s funeral wishes |
| Racial or ethnic origin | a diversity survey, a visa file, a photo |
| Political opinions or association | a complaint, a social media screenshot in a conduct file |
| Sexual orientation or practices | a family law affidavit, a complaint to HR |
Categories: section 6(1) of the Act, compilation of 4 June 2026. The paper column is our own survey of ordinary office documents.
The last column is where the risk sits for AI. The document goes into a chatbot because of its other content, the pay calculation or the leave dates, and the sensitive line travels with it unnoticed. A family law practice meets almost every row in a single affidavit, which is part of why our page for law firms treats matter files as a category of their own.
The ones an office does not read as sensitive
Health is the category everyone recognises, and it gets the attention. The categories that catch an office out are the ones that arrive as administration. They look like numbers and dates, and nobody in the room thinks of them as private.
Four of them come up in almost every business with staff. Each has a specific rule behind it, and each can end up in a prompt that was only ever about arithmetic.
The deduction line on a payslip
Regulation 3.46 of the Fair Work Regulations 2009 sets out what a payslip must contain. Subregulation (2) is the one that matters here. Where an amount is deducted from pay, the payslip must show the amount and the name, or the name and number, of the fund or account it went to.
So a union fee is not hidden in a total. In the invented payslip above it reads AMWU, $38.50. It appears by name, fortnight after fortnight, next to the employee’s name. That line is information about membership of a trade union, and on the payslip it is plainly about an identified person.
The same regulations already treat one kind of leave as too sensitive for the payslip. Regulation 3.47 forbids an employer to show that a payment or a period of leave was paid family and domestic violence leave, or the balance of that entitlement. Parliament decided that one line should never be on the document at all. The union line stays, and the payslip travels.
A professional membership on a CV
Limb (a) lists membership of a professional or trade association separately from union membership. That covers the line on a CV that says a candidate is a member of CPA Australia, Chartered Accountants ANZ or a state law society, and the same line on a staff profile.
It is rarely harmful on its own. But a recruitment agency or an HR consultant that puts a stack of CVs through an AI tool to shortlist them is handling sensitive information about every candidate. How long the tool then keeps those CVs depends on the account, as our look at what ChatGPT stores explains.
The rules for collecting it, in APP 3, apply whether or not anyone thought of the membership as private.
The medical certificate behind three days of personal leave
Section 107 of the Fair Work Act 2009 lets an employer ask for evidence that paid personal leave was taken for a reason in section 97, such as illness or injury. The note under that section says the information “may be regulated under the Privacy Act 1988”. In practice the evidence is a medical certificate, and many name a condition.
The certificate is health information. It usually ends up scanned into a payroll or HR system, and from there it can end up in a question to a chatbot about whether the leave was paid correctly.
The dates of the leave and the hours.
The diagnosis on the certificate.
The pay question needs dates and hours. It does not need the diagnosis, and a certificate that names one brings the diagnosis along with the dates.
The police check in a recruitment file
Criminal record is on the list, and a national police check is the ordinary way it enters an office. Many employers ask for one before they make an offer. The result sits in the recruitment file, often next to the CV and the reference notes.
For the candidate who was hired, that file may later fall under the employer’s exemption, discussed below. For the candidate who was not, it does not, and a file of unsuccessful applicants is exactly the kind of bulk material someone will one day ask an AI tool to summarise.
Why Privacy Act sensitive information changes the rules for AI
Everything in the Australian Privacy Principles applies to personal information. Sensitive information carries extra conditions at two points: when it is collected, and when it is put to a new purpose. Both points arise when a document goes into an AI tool.
| Ordinary personal information | Sensitive information | |
|---|---|---|
| Collecting it (APP 3) | reasonably necessary for your activities | consent as well, unless an APP 3.4 exception applies |
| A second purpose (APP 6) | related to the first, and reasonably expected | directly related, and reasonably expected |
| What counts as consent (Chapter B) | may be implied in some cases | should generally be express |
APP 3.3, APP 6.2(a), and paragraphs B.40 to B.44 of the OAIC’s key concepts chapter.
On 21 October 2024 the OAIC published its guidance for businesses using AI products they buy rather than build. Its best practice advice is that organisations “do not enter personal information, and particularly sensitive information, into publicly available generative AI tools”. It is a recommendation, not a ban. The reasons behind it are the rules below. The wider question of handing client material to a chatbot at all is the subject of which AI tools the Privacy Act allows.
Consent has to be express, and a notice is not consent
APP 3.3 says an organisation must not collect sensitive information about an individual unless the individual consents and the information is reasonably necessary for its functions or activities, or an exception in APP 3.4 applies. The exceptions cover things such as a legal requirement, a court order or a permitted health situation. Convenience is not among them.
The OAIC’s key concepts chapter adds, at paragraph B.44, that an entity should generally seek express consent before handling sensitive information. Paragraph B.42 says consent cannot be inferred simply because the entity gave notice. The AI products guidance says the same. A sentence about AI tools in a privacy policy is a notice, not consent.
A related purpose is no longer enough
APP 6 decides when information gathered for one reason can serve a second. For ordinary personal information, one route combines a reasonable expectation with a new purpose that is related to the old one. For sensitive information, APP 6.2(a)(i) tightens that to directly related.
The OAIC’s worked example involves insurance staff who type a customer’s claim into a public chatbot, with the health details in it. Typing it in, the regulator says, discloses it to whoever owns the chatbot. It also says that reasonable expectations may be hard to establish unless customers were told specifically about disclosures to AI providers.
When the AI answer is the collection
There is a third point that offices miss. The same OAIC guidance says that if you use AI to generate or infer sensitive information about a person, you will usually need that person’s consent under APP 3. A model’s output about a person can itself be a new collection.
Ask a chatbot whether an employee’s pattern of Monday absences suggests a health or drinking problem, and the answer, whatever it says, is an inference about health. No document held that fact before the prompt. After it, one does.
The employee records exemption belongs to the employer alone
Section 7B(3) exempts an act or practice of an organisation that is or was the employer of an individual, where it is directly related to the employment relationship and to an employee record held by the organisation. An employee record, in section 6(1), expressly includes health information and trade union membership.
Many businesses stop reading there. For a private employer handling its own staff files, the Australian Privacy Principles may not apply to those files at all. But the exemption is built around the employer, and much of the paper in this guide is held by somebody else. The turnover threshold and the other ways a business comes under the Act at all are explained alongside the AI tools question.
Payroll bureaus, HR consultants and the firm’s own advisers
The OAIC’s guidance on the exemption is direct. It does not cover contractors and subcontractors when they handle the personal information of another organisation’s employees, whatever the contract says. The regulator gives recruitment, human resource management, medical, training and superannuation services as examples. It adds workers compensation insurers that are not the employer.
| Who holds the payslip or the certificate | Exempt under section 7B(3)? |
|---|---|
| The employer, for its own current or former staff | Yes, for acts directly related to the employment |
| A bookkeeper or payroll bureau running the payroll | Generally not: a contractor to the employer |
| An HR consultant or recruitment agency | Generally not: named in the OAIC guidance |
| A workers compensation insurer | Not, unless it is the employer |
| The employer, for an applicant it did not hire | No: no employment relationship ever existed |
Privacy Act 1988, s 7B(3), read with the OAIC’s page on the employee records exemption.
For accountants and bookkeepers this is the practical point. The payslips a client sends over are not your employee records. If the practice is covered by the Act, sensitive information on them is held under the full principles, and the rules for tax practitioners using AI sit on top of that.
The applicant you did not hire
The OAIC also says the exemption does not reach future employment relationships. Personal information about job applicants who are not then employed falls outside it. Once someone is hired, the checks done before the offer become part of an exempt record. The rest of the pile does not.
That leaves the police checks, CVs and health questionnaires of unsuccessful candidates under the ordinary rules, with sensitive information throughout. They are also the documents most likely to be handed to a tool in bulk.
Does the prompt still point to a person? Four checks
The Privacy Act protects information about an individual who is identified or reasonably identifiable. Sensitive information is a subset of that. So the practical question before a prompt goes in is not whether it mentions a diagnosis or a union. It is whether the reader at the other end could tie that fact to someone.
The four checks below run in order. The first “yes” tells you what to fix before the text goes anywhere.
Does the text name the person, or carry a number that belongs to them, such as a TFN, an employee ID or a member number?
YesTake those out first. The facts are still sensitive, but they are no longer about someone named.
NoGo to the next check.
Does it carry an address, a date of birth, a phone number or an email?
YesTake them out. None of them helps with a pay or leave question.
Could a colleague work out who it is from the role, the dates or the size of the team?
YesGeneralise: "an employee", "early September", "a small team". This part is yours to do.
Is the sensitive fact itself needed for the answer?
YesKeep it, with the person removed. If not, leave it out as well.
Four "no" answers: the text still holds a sensitive fact, but it is no longer about anyone the reader can find.
For material that must be made safe to share more broadly, the Act’s own test and what the OAIC expects are explained in de-identified vs pseudonymised.
Keeping the fact while losing the person
The pay question about a union fee needs the fee. The leave question needs the dates and the type of leave. A question about a religious holiday under an award needs to know it is a religious holiday. In most of these prompts, the sensitive fact is the useful part and the person is not.
That is why the answer is rarely to leave the fact out. It is to strip what makes the fact belong to someone, in this order: names, then identifying numbers, then addresses and dates of birth, then the detail that only a colleague would recognise.
The same question, asked without the person
Take the payroll query further down this page. What the bookkeeper needs to know is whether three days of personal leave were paid at the right rate under an award. Written for the tool, the question can carry everything the answer depends on and nothing it does not:
A full time employee under the Manufacturing Award took three consecutive days of paid personal leave in September, supported by a medical certificate. Their ordinary rate is $X an hour. Were those days paid correctly, and does anything change if one of them was a public holiday?
That version keeps the award, the leave type, the certificate and the dates in outline. It drops the name, the address, the tax file number, the union and the diagnosis, none of which changes the arithmetic. It is also a better prompt: the model is not distracted by detail it has no use for, and the answer is easier to check.
The award, the leave type, the certificate, the dates in outline.
The name, the address, the tax file number, the union, the diagnosis.
Not every question can be rewritten so cleanly. A dispute about whether a religious holiday is covered by an enterprise agreement needs the religion in it. There, the fact stays and the person goes, which is the harder half of the job.
The detail that names without a name
The last step is where software and checklists run out. “The only woman in the Ballarat warehouse” identifies a person without a single name or number. So does a job title in a firm of eight, an uncommon illness in a country town, or leave dates that everyone in the office remembers.
Nothing in the definition requires a name. The test is whether the individual is reasonably identifiable, and the people best placed to judge that are those who know the workplace. It is also the last step in what to remove from an NDIS case note, and for the same reason.
A payroll query run through Nonimo 0.2.8
This is a query of the kind a payroll officer or a bookkeeper might put to an AI tool. Every person, number and place in it is invented. The AFTER is what Nonimo 0.2.8 for Mac returned on 25 September 2026, unedited.
BEFORE Employee: Mr Dimitri Papadakis, 14 Carrington Street, Thornbury VIC 3071
DOB: 03/11/1981 TFN: 579 110 424 Employee ID: NS-0417
Deductions: AMWU union fees $38.50 (account 20431)
Medical certificate from Dr Anjali Rao, Brunswick Medical Centre:
anxiety, unfit for work.
He has asked for the Greek Orthodox Easter Friday off again next year.
AFTER Employee: [PERSON_1], [ADDRESS_1], [ADDRESS_2]
DOB: [BIRTH_DATE_1] TFN: [TFN_1] Employee ID: NS-0417
Deductions: AMWU union fees $38.50 (account 20431)
Medical certificate from Dr [PERSON_2], Brunswick Medical Centre:
anxiety, unfit for work.
He has asked for the Greek Orthodox Easter Friday off again next year.The payroll officer marks out the lines, presses a single key, and each identifier Nonimo picks up is swapped for a placeholder before anything leaves the desk. It works the same on Mac and Windows. The AI tool’s reply comes back with the placeholders in it, and Nonimo puts the original details back on that screen.
The map that puts them back stays on that computer, encrypted. Once a day we get a usage count from it, and never any of the text.
What comes out is the person, not the facts. The union, the diagnosis and the religious holiday are still in the AFTER, and the original on your side is still sensitive information under section 6(1). The security page lists what is kept where, and where the engine stops.
The last check, made on the text itself
Before a document goes into an AI tool, read it as a colleague of the person in it would. If they could tell who it is about, the Privacy Act sensitive information rules are still in play: express consent, a directly related purpose, and no help from an exemption that belonged to someone else.
If they could not, the fact can usually go, and it is often the only part of the document the question needed. This page is general information about the Privacy Act, and it does not advise on any particular set of files. Whoever is responsible for privacy in your office should decide how it applies to them, and our guide to AI clauses in engagement letters covers what to tell clients.
Sources
- Privacy Act 1988 (Cth), Compilation No. 104, 4 June 2026 (Federal Register of Legislation): s 6(1) definitions of sensitive information, personal information and employee record; s 6FA health information; s 6D small business; s 7B(3) employee records exemption; APP 3.3 and 3.4; APP 6.1 and 6.2(a)(i).
- OAIC, Guidance on privacy and the use of commercially available AI products, 21 October 2024 (oaic.gov.au): the recommendation not to enter personal and particularly sensitive information into publicly available generative AI tools; the insurance company example; consent not implied from notice; generating or inferring sensitive information needs consent under APP 3; photographs from which race or health can be inferred.
- OAIC, APP guidelines, Chapter B: Key concepts (oaic.gov.au): B.42 consent not inferred from notice; B.44 express consent for sensitive information; B.142 the surname example; B.144 why sensitive information is protected more.
- OAIC, Employee records exemption (oaic.gov.au): the exemption does not cover contractors, recruitment, human resources, medical, training or superannuation services, or workers compensation insurers that are not the employer; it does not cover applicants who are not employed.
- Fair Work Regulations 2009, compilation of 20 June 2026 (Federal Register of Legislation): reg 3.46(2) deductions shown with the name of the fund or account; reg 3.47 family and domestic violence leave kept off payslips.
- Fair Work Act 2009, compilation of 7 July 2026 (Federal Register of Legislation): s 107(3) evidence for personal leave, and its note on the Privacy Act.
- Nonimo 0.2.8 for Mac: the before and after above, run on 25 September 2026 on invented data.
Nonimo is the software that does this on your own computer: it masks client names and IDs before your text reaches ChatGPT . No account, and your client's details never leave your machine.
Common questions
What counts as Privacy Act sensitive information?
Section 6(1) lists it: health information, racial or ethnic origin, party membership or political opinions, religious beliefs, philosophical beliefs, membership of a professional or trade association or a trade union, sexual orientation or practices, criminal record, some genetic information, and biometrics used for automated identification. The first group only counts when it is also personal information. Nonimo does not sort text into these categories; it covers the identifiers that tie a fact to a person.
Does a union deduction on a payslip reveal sensitive information?
Usually, yes. Regulation 3.46 of the Fair Work Regulations makes a payslip name the fund or account each deduction goes to, so a union fee line shows the employee is a member, and trade union membership is on the section 6(1) list. With the employee's name beside it, that line is sensitive information about them. Take the name and identifiers off before a payslip goes into a chatbot.
Is a medical certificate for personal leave sensitive information?
Yes, once it is tied to the employee. Section 107 of the Fair Work Act lets an employer ask for evidence of personal leave, and a certificate that names a condition is health information, which the Privacy Act counts as sensitive. Whether the Act applies depends on who holds it: the employer may be exempt for its own staff records, but the payroll bureau or adviser it sends them to generally is not.
Does the employee records exemption cover a bookkeeper or payroll bureau?
Generally not. Section 7B(3) exempts an organisation that is or was the employer, for acts directly related to the employment relationship and its employee records. The OAIC says the exemption does not cover contractors handling another organisation's employees, naming recruitment, human resources, medical and superannuation services. If the Act covers the practice, a bookkeeper running a client's payroll holds those payslips under the Australian Privacy Principles, sensitive information included.
Is membership of CPA Australia or a law society sensitive information?
It can be. Membership of a professional or trade association is on the Privacy Act list in section 6(1), next to union membership. A CV that says a candidate is a member of CPA Australia, or a staff profile that names a law society, carries it. It is rarely harmful, but for a business the Act covers, the consent rules in APP 3 still apply to collecting it, and an AI tool reading the CV is receiving it.
Does a line about AI in the privacy policy amount to consent?
No. The OAIC's guidance for businesses using AI products says consent cannot be implied merely because an individual was notified of a proposed collection, and its key concepts chapter says an entity should generally seek express consent before handling sensitive information. A privacy policy line helps the notice obligations in APP 5. It does not turn silence into agreement for a health or union detail.
Can an AI summary generate health details about an employee?
It can, and the OAIC treats that as a collection. Its AI guidance says that if you use AI to generate or infer sensitive information about a person, you will usually need that person's consent under APP 3. Asking a chatbot whether an employee's absences suggest a health problem is the textbook case. Ask the question about the pattern with the employee's identifiers removed, or do not ask it.
Does removing the name take a payslip outside these rules?
Only if nobody can reasonably work out who it is about. Personal information covers a person who can reasonably be identified, not just one who is named. In a firm of twelve, a union fee and three days off in early September may be enough for a colleague. Take out the name, the numbers and the dates you do not need, then read what is left as someone in that workplace would.
Does Nonimo decide which text is sensitive?
No. Nonimo swaps identifiers for placeholders on your own computer, ahead of the AI tool: names found by position, addresses, dates of birth, and numbers such as a TFN whose check digit adds up. Whether a passage counts as sensitive information is your call, not its, and it leaves the facts themselves, a diagnosis or a union, exactly where they are. What it produces is pseudonymised text, not anonymous text.