Checklist: Privacy considerations when developing or training generative AI models
This checklist from the Office of the Australian Information Commissioner assists developers in considering privacy obligations when developing or training generative artificial intelligence models. It outlines key privacy considerations spanning privacy management, data accuracy, collection, use, disclosure, and transparency. The document is designed for organizations subject to the Privacy Act that design, build, train, adapt, or combine AI models.
Summary and content fields are drawn from the document text and are pending editorial review.
Who issued it
Who it governs
Developers of generative AI models or systems subject to the Privacy Act.
What the document contains
The checklist covers privacy compliance, data accuracy, data collection methods, use and disclosure rules, and transparency obligations for generative AI developers.
The document does not provide a comprehensive legislative text, specific penalty structures, or technical mitigation code.
- Developers should adopt a privacy-by-design approach and complete privacy impact assessments.
- Organizations must take reasonable steps to ensure training data accuracy and manage limitations.
- Data minimisation, de-identification, and lawful collection practices should be integrated.
- Use and disclosure must align with primary collection purposes, reasonable expectations, or consent.
- Transparency requires clear privacy policies and notifications regarding AI training data use.
· Privacy practices, procedures, and systems compliance · Accuracy at the planning stage · Collection obligations · Use and disclosure obligations · Transparency obligations
How it scores
Each score is backed by a quote verified against the document text. Editorial review has not yet confirmed them.
Accountability
4/5Clear responsibility for AI outcomes
Have reasonable steps been taken to ensure accuracy at the planning stage?
Privacy issue Have reasonable steps been taken to ensure accuracy at the planning stage?
screening score · 2026-10-23
Fairness
2/5Non-discrimination and equitable treatment
Is the means of data collection lawful and fair?
Privacy issue Can obligations in relation to collection be met?
screening score · 2026-10-23
Human Dignity
0/5Respect for the inherent worth of persons
Checklist
screening score · 2026-10-23
Human Oversight
0/5Humans remain in control of consequential decisions
Checklist
screening score · 2026-10-23
Privacy
4/5Protection of personal data and private life
Has a privacy by design approach been adopted?
Privacy issue Can obligations to implement practices, procedures and systems to ensure APP compliance be met?
screening score · 2026-10-23
Transparency
4/5Openness about how AI systems work and are used
Have transparency obligations been met?
Privacy issue Have transparency obligations been met?
screening score · 2026-10-23
Enforcement
0/5Consequences and compliance mechanisms with real force
Checklist
screening score · 2026-10-23
Impact Assessment
4/5Required assessment of an AI system's risks/impacts before or during use
Has a privacy impact assessment been completed?
Privacy issue Can obligations to implement practices, procedures and systems to ensure APP compliance be met?
screening score · 2026-10-23