An AI Privacy Act checklist for small organisations

Many people assume that using online tools is always safe. It is not.

Using an AI Privacy Act checklist helps small organisations understand how personal information is handled when they use new technology. This is general information and not legal advice. It is a way to look at the daily tasks that keep an organisation running, and to see where the risk lies.

The daily handling of personal details

Staff in small organisations handle personal details every day. They write down names, phone numbers, email addresses and stories about the people they support. This information is often typed into databases, spreadsheets or shared documents. When a team member wants to summarise a long meeting or draft a response to an email, they might think about pasting these notes into an online tool.

Before doing this, it is important to think about what is actually happening to that information. Once text is pasted into an online tool, it is no longer just on the local computer. It is shared with another system. This is the work that has changed: the simple act of drafting a note now involves sending data to an external server. The task of writing a summary used to happen entirely within the office walls, but now it connects to a wider network of servers and systems.

The cost of fixing a leak

Fixing a leak takes time away from core services.

What is collected

Ask what information you are about to share. Does the tool need a person's full name, address or medical history to do its job? Often, a tool can write a summary or draft an email without those specific details. Removing names and replacing them with general terms before pasting text is a simple way to protect people.

It is also useful to read the terms of service to see if the tool saves the text to train its models. Some tools allow users to opt out of this training. Knowing what is collected helps an organisation keep its data safe. When staff understand exactly what details are being entered, they can make better decisions about which parts of a document are safe to process and which parts must be kept private.

Where the data goes

Ask where the tool sends and stores the information, and whether you can choose. Many tools process information on servers located outside Australia. If the data leaves Australia, it may be subject to different rules. Checking the settings of the tool can show where the data is stored and whether it can be kept on local servers.

Knowing the physical location of the data is an important part of managing risk. When an organisation knows where its files are stored, it can better answer questions from clients and supporters about how their private details are handled. This step is about keeping track of the digital path that information takes once it leaves the office computer.

Who can see it

Ask who has access to the information. This includes the people who run the tool, other users and the public. Some tools make the input public by default, while others keep it private to the account. Checking these settings before pasting personal information prevents unauthorised people from seeing sensitive details.

It is also worth checking if the tool allows team administrators to control user permissions. If multiple staff members use the same account, there should be clear rules about who can view past searches and saved drafts. Restricting access to only those who need it for their daily work helps protect sensitive information from being seen by the wrong people.

What people are told

Ask what the organisation tells the people whose information is being used. Transparency is a key part of managing personal details. People have a right to know if their information is being processed by an online tool. Updating the organisation's privacy policy is one way to make this clear. You can read more about setting up clear guidelines in our AI policy template for not-for-profits.

When organisations are open about the technology they use, it builds trust with the community. This involves explaining in plain language how tools are used to assist with administrative tasks, and what steps are taken to keep personal details secure. Clear communication ensures that everyone is on the same page regarding data handling practices.

Deciding what is worth doing

Using technology can make daily tasks faster, but the decision to use it remains with the person. A machine can draft a summary, but a person must check it for accuracy and decide if it is safe to send. The person keeps the responsibility for protecting the privacy of the people they support.

When choosing between different systems, organisations often face the choice of whether to build their own secure tools or buy existing ones. For more information on this choice, read our guide on how to build vs buy AI software. Deciding how to handle data safely is a human task that cannot be handed over to a machine.

Checking these privacy questions before using new tools helps protect everyone.

If your business would like help to put AI to work, see AI consulting at aXai: AI and a person building together, so you leave with a working system you understand well enough to evolve.

aXai is a disability-led studio that turns ideas into software and content with AI. AI takes the glue work — the chasing, the forms, the fourteenth retelling. People keep the part that was always theirs: deciding what is worth doing, and making it. New ideas. A different way of working. Read how AI-supported work works.