Can you upload your entire customer list to ChatGPT and ask it to write personalised marketing emails?
Short answer: maybe. Get it wrong, and you're looking at penalties starting at $50 million.
That's the real maximum fine for serious privacy breaches in Australia since 2022. And the laws are only getting stricter. If you're using AI tools anywhere near customer data, you need to know the rules.
Here's what we'll cover: what counts as personal information when AI is involved, the recent Privacy Act reforms that changed the game, and six practical rules you can apply today. I'm a marketer, not a lawyer, so take this as practical guidance. It's the same advice I give my own clients at Salt Agency.
Let's get into it.
The Privacy Act 1988 is your starting point
If your business is based in Australia, the Privacy Act 1988 sets the ground rules. It's built around 13 Australian Privacy Principles, or APPs. These cover everything from how you collect data to how you store, use, and disclose it.
Here's the kicker. Those APPs apply just as much to AI tools as they do to your spreadsheet.
When you feed customer names, emails, or purchase history into an AI platform, you're handling personal information under the law. Whether that AI is a chatbot, a content generator, or an ad platform's optimisation algorithm, the same obligations apply.
Australia also doesn't have a "legitimate interests" catch-all like Europe's GDPR. If you're relying on consent, it has to be real, informed, and collected before you use the data.
What counts as personal information when AI is involved
This is where things get tricky.
Personal information is any information that could reasonably identify someone. That definition has been around forever. But AI changes the game, because it can combine data points way faster than a human ever could.
Let me give you a real example. You upload a spreadsheet with 500 customer emails and postcodes to ChatGPT to find trends. That's personal information. You didn't include names, but the combination of email and postcode can identify a person.
The Office of the Australian Information Commissioner, or OAIC, has made it clear that de-identification isn't a free pass. If data can be re-identified, it's still regulated.
Here's why this matters now. OpenAI had 100 million weekly users within months of launching ChatGPT. McKinsey then found that 65% of organisations were using generative AI in at least one business function. The technology is everywhere, and most businesses never stopped to ask whether their data use was legal.
So before you ask an AI tool to "find your best customers", ask yourself: could the output identify someone? If yes, the Privacy Act applies.
The recent reforms you can't ignore
Australia's privacy laws have been evolving fast. Here's what you need to know.
In 2022, the government raised maximum penalties for serious breaches to the higher of $50 million, three times the benefit gained, or 30% of your adjusted turnover. For small and medium businesses, that's game-changing exposure.
Then in 2024, the Privacy and Other Legislation Amendment Act passed. It introduced a statutory tort for serious invasion of privacy, which means individuals can now sue you directly. It also established a Children's Online Privacy Code and gave the OAIC more power to write binding rules.
And there's more coming. The government has flagged further changes around automated decision-making. If you're using AI to decide who gets a loan, who gets a job, or who gets a discount, you'll need to explain those decisions to the people affected.
The pattern is clear: AI and data rules are moving from "best practice" to "compulsory". If you're behind, now's the time to catch up.
Six practical rules for using AI with customer data
Let's get practical. Here's what I tell businesses when they want to use AI without ending up in legal trouble.
1. Get proper consent before you use data in AI tools
Consent has to be collected up front, and it has to be specific. Don't bury it in a 40-page terms and conditions document. Make it easy to understand and easy to withdraw.
2. De-identify data wherever possible
Strip out names, emails, phone numbers, and anything else that could identify a person. If you don't need it, don't feed it into the AI. Less data means less risk, and it means better data hygiene for your website.
3. Check where your data is being processed
Most AI tools are hosted overseas, often in the US. That triggers cross-border disclosure rules under APP 8. You need to make sure the overseas provider is held to a standard similar to Australian law. If they're not, just clicking upload could be a breach.
4. Remember direct marketing has its own rules
APP 7 covers direct marketing separately. You can't use personal information for direct marketing if the person wouldn't reasonably expect it, or if you haven't offered a clear opt-out. Feeding customer lists into AI to generate ads doesn't change that.
5. Update your privacy policy
If you're using AI to process customer data, say so. The OAIC expects transparency, and your customers have a right to know. A clear privacy policy is also your best defence if a complaint lands on your desk.
6. Keep a human in the loop
AI makes mistakes. It hallucinates. It can produce outputs that are discriminatory, wrong, or just embarrassing. You're responsible for what the AI produces on your behalf. Review everything before it goes anywhere near a customer.
What this means for your marketing
Here's the good news.
You can absolutely still use AI for marketing. You can use it to write content, run Google Ads, optimise Meta Ads, and predict customer behaviour. You just need to build your data flows correctly from the start.
AI is also changing the channels themselves. Generative Engine Optimisation, or GEO, is the practice of getting your brand featured in AI-generated answers on platforms like ChatGPT and Google's AI Overviews. That's where your customers are increasingly looking for recommendations. And it relies on clean, structured data.
The same logic applies to local SEO. If you're a Brisbane business collecting data to power local campaigns, you need clear consent flows on your site and in your ads. Do it right, and you get better results plus a stronger reputation.
And don't forget where most data collection happens: your website. If your site isn't optimised for mobile, you're probably collecting data poorly and losing conversions. Here's why Brisbane businesses need a mobile-first website in 2026.
The bottom line
Using customer data with AI tools is legal in Australia, but only if you follow the rules. Get consent. De-identify where you can. Be transparent. Keep a human in the loop.
The businesses that treat data compliance as a marketing advantage, not a legal burden, are the ones that will win. Trust is becoming the most valuable currency in the AI economy. And in Brisbane, where the business community is tight, reputation travels fast.
If you're not sure whether your current setup is compliant, or you want to build a marketing engine that uses AI properly, let's talk. At Salt Agency, we handle strategy and execution under one roof: branding, websites, design, content, SEO, GEO, Google Ads and Meta Ads. We're based in Albion, Brisbane, and we'd love to help.
Book your free marketing audit today. No obligation, just honest advice on where you stand.
