Privacy and data

Using AI assistants with HR data

AI assistants can draft letters, summarise policies and answer HR questions, but putting employee information into them engages the Privacy Act, state surveillance laws and anti-discrimination rules. The OAIC recommends, as best practice, that organisations don’t enter personal information, especially sensitive information, into publicly available AI tools.

Updated 5 November 2026. General information, not legal advice.

Which privacy rules apply when staff enter employee data into an AI tool?

For organisations covered by the Privacy Act, APP 6 (use and disclosure), APP 8 (overseas disclosure), APP 10 (accuracy) and APP 11 (security) are the main principles. The employee records exemption covers only some of the information HR handles.

APP 6: use personal information only for the purpose it was collected for, unless the person consents or would reasonably expect the secondary use and it is related to that purpose (directly related, for sensitive information).
APP 8: before disclosing personal information to an overseas recipient, take reasonable steps to make sure the recipient doesn’t breach the APPs. Know where the tool processes and stores what is entered.
APP 10: outputs can be wrong. Check accuracy before relying on a summary or draft about a person.
APP 11: protect what you hold, including prompts, uploaded files and outputs.

The section 7B(3) exemption covers acts directly related to a current or former employee’s employment and an employee record. It does not cover job applicants, contractors or volunteers, and tax file numbers are regulated by the TFN Rule regardless. See employee records: privacy and security.

What does the OAIC say about commercially available AI products?

The OAIC’s guidance, published 21 October 2024, says privacy obligations apply to personal information entered into AI products and to outputs that contain personal information, and recommends not entering personal information into publicly available generative AI tools.

Guidance on privacy and the use of commercially available AI products also says organisations should:

do due diligence before adopting a product and keep reviewing it, rather than ‘set and forget’
take a privacy-by-design approach, such as a privacy impact assessment
update privacy policies and collection notices with clear information about AI use
make sure people oversee outputs and can override them.

Do workplace surveillance laws apply to AI tools?

In NSW and the ACT, tools that log or monitor staff computer use are regulated surveillance and need at least 14 days’ written notice and a notified policy. Victoria has no equivalent notice law as at 5 November 2026.

Surveillance rules relevant to monitoring computer use, as at 5 November 2026
Jurisdiction	Key rule
NSW	Workplace Surveillance Act 2005: computer surveillance includes monitoring emails and websites. It needs written notice at least 14 days beforehand (s 10) and must follow a computer surveillance policy employees have been told about (s 12).
ACT	Workplace Privacy Act 2011: data surveillance needs written notice at least 14 days beforehand (s 13), good-faith consultation (s 14) and a notified policy saying what is logged and who can access it (s 16).
Victoria	Surveillance Devices Act 1999 s 9B bans optical and listening devices in workplace toilets, washrooms, change rooms and lactation rooms. The government has supported reform in principle but has not legislated a dedicated workplace surveillance law.

If an AI feature records, analyses or reports on staff emails, chats, meetings or activity, treat it as surveillance and give notice before switching it on.

Can AI-assisted HR decisions be discriminatory?

Yes. The employer is responsible for the decision whichever tool helped make it. The Fair Work Act bans adverse action against employees and prospective employees because of protected attributes such as age, sex, disability, pregnancy or race.

The Fair Work Ombudsman’s discrimination page lists the protected attributes and includes not hiring someone as adverse action. A tool that summarises sick leave, ranks performance or screens CVs can pick up a protected attribute indirectly. Don’t use AI output as the sole basis for discipline, dismissal, promotion or hiring.

From 10 December 2026, privacy policies must also disclose decisions made or substantially assisted by computer programs. See automated decisions and privacy disclosure.

Do I need to consult staff before rolling out AI tools?

If the change is major and likely to significantly affect employees, award consultation clauses require you to notify and discuss it with affected employees and their representatives. Enterprise agreements must contain a consultation term.

According to the Fair Work Ombudsman’s consultation guide, award clauses generally apply once you’ve decided to introduce major changes in production, programming, organisation, structure or technology. You must give written information about the change and its likely effects and promptly consider employees’ responses. Consent isn’t required. An AI rollout that changes roles, workloads or hours is likely to count.

What should I record about AI use in HR?

Record which tools are approved, what kinds of information may be entered, and which outputs were relied on for decisions about people, so you can explain decisions, answer complaints and assess a breach.

Outputs about a person are personal information too: an AI summary of a grievance or performance history sits in your records like any other document. If a tool exposes employee information, the 30-day assessment rule under the Notifiable Data Breaches scheme applies.

What rules should an HR AI policy include?

Approve specific tools, ban personal and sensitive information in public tools, require human review of anything about a person, and say who is accountable.

List approved tools, with business accounts that don’t use your inputs for training and keep data where your privacy policy says it is held.
Don’t enter health, TFN, bank, union membership or disciplinary details into any tool that isn’t approved for them.
Remove names and identifiers when a task doesn’t need them.
Require a person to check accuracy and tone before any output is sent or filed.
Never let a tool make a final decision about hiring, discipline, pay or termination.
Give notice under state surveillance laws before enabling features that monitor staff.
Consult staff when the rollout is a major change, and review the policy every 6 months.

Secure the accounts too: multi-factor authentication and limited admin access matter as much for AI tools as for payroll. See Essential Eight for HR data.

Questions

Can HR staff paste employee information into a public AI chat tool?

The OAIC recommends, as best practice, that organisations don’t enter personal information, especially sensitive information, into publicly available generative AI tools. Use an approved business tool, and remove identifiers where possible.

Is using an AI tool on employee emails workplace surveillance?

In NSW and the ACT, software that monitors or records computer use, including emails, is regulated surveillance. It needs written notice at least 14 days before it starts and a notified policy.

Does the employee records exemption cover AI tools?

It can cover acts directly related to a current or former employee’s employment and an employee record. It does not cover job applicants, contractors or tax file numbers, and it doesn’t exempt you from surveillance or discrimination laws.

Sources

Checked against these sources on 5 November 2026. Spotted something out of date? Tell us.