Guidance for the artificial intelligence impact assessment tool: Privacy protection and security
This guidance document outlines privacy protection and security requirements for Australian Government agencies using artificial intelligence systems. It details how agencies must comply with the Australian Privacy Principles, conduct privacy threshold and impact assessments, and manage digital and cyber security risks under relevant frameworks.
Summary and content fields are drawn from the document text and are pending editorial review.
Who issued it
Who it governs
Australian Government agency officials and practitioners assessing artificial intelligence use cases for privacy and security compliance.
What the document contains
The document covers requirements for minimizing and protecting personal information under privacy laws, conducting privacy threshold and impact assessments for AI use cases, and managing security risks and data breaches.
The text does not provide technical implementation tutorials or legal definitions outside of referencing existing Australian legislation and external guidance frameworks.
- Agencies must ensure AI use cases comply with the Australian Privacy Principles (APPs) regarding personal information inputs and generated outputs.
- A privacy threshold assessment (PTA) must be completed to determine if a privacy impact assessment (PIA) is required for high privacy risk projects.
- Agencies should use privacy enhancing technologies to de-identify personal information where appropriate.
- Digital and cyber security risks must be managed in alignment with the Protective Security Policy Framework (PSPF) and Australian Signals Directorate (ASD) guidance.
· 7.1 Minimise and protect personal information · 7.2 Privacy threshold and/or impact assessment · 7.3 Security risks
How it scores
Each score is backed by a quote verified against the document text. Editorial review has not yet confirmed them.
Accountability
1/5Clear responsibility for AI outcomes
Consult your agency's privacy officer and internal privacy policy and resources.
7.2 Privacy threshold and/or impact assessment
screening score · 2026-10-24
Fairness
1/5Non-discrimination and equitable treatment
Collection must occur by fair and lawful means.
7.1 Minimise and protect personal information
screening score · 2026-10-24
Human Dignity
0/5Respect for the inherent worth of persons
screening score · 2026-10-24
Human Oversight
0/5Humans remain in control of consequential decisions
screening score · 2026-10-24
Privacy
4/5Protection of personal data and private life
Agencies should consider how the AI use case will comply with the Australian Privacy Principles ( APPs ) in Schedule 1 to the Privacy Act 1988 (Cth) .
7.1 Minimise and protect personal information
screening score · 2026-10-24
Transparency
1/5Openness about how AI systems work and are used
adding transparent information about its use of AI in its privacy policy.
7.1 Minimise and protect personal information
screening score · 2026-10-24
Enforcement
2/5Consequences and compliance mechanisms with real force
Agencies should ensure appropriate procedures are in place to address a data breach or security incident.
7.3 Security risks
screening score · 2026-10-24
Impact Assessment
4/5Required assessment of an AI system's risks/impacts before or during use
The Australian Government Agencies Privacy Code (the Privacy Code) requires Australian Government agencies subject to the Privacy Act 1988 to conduct a privacy impact assessment ( PIA ) for all 'high privacy risk projects'.
7.2 Privacy threshold and/or impact assessment
screening score · 2026-10-24