Privacy and GenAI
This guidance outlines how public service organizations must approach privacy and data protection when using generative artificial intelligence. It emphasizes applying privacy-by-design principles, conducting privacy impact assessments, classifying information properly, and complying with the Privacy Act 2020. The document also provides practical recommendations on avoiding the input of personal information into public GenAI systems unless it is already public.
Summary and content fields are drawn from the document text and are pending editorial review.
Who issued it
Who it governs
This is for public service officials and agencies considering or using generative AI tools to ensure compliance with privacy laws.
What the document contains
The document covers data protection, privacy-by-design guardrails, risk assessments, information classification, and practical scenarios for public service use of generative AI systems.
The document does not provide formal legal definitions for technical AI terms or specific regulatory enforcement mechanisms for non-compliance.
- The Privacy Act 2020 applies to GenAI just as it does to any other technology.
- Organizations must apply privacy-by-design principles and use privacy impact assessments for testing or using GenAI.
- Personal information must not be uploaded or input into public GenAI systems unless it is already public or acceptable to be made public.
- Staff must be properly trained to classify information and understand what can or cannot be used with GenAI systems.
- Agencies should maintain transparency by recording GenAI use in appropriate publicly published registers.
· Privacy by design is vital when using GenAI · What to cover in your privacy approach to GenAI · Commit to best-practice for privacy with GenAI · Classify information · Other points to follow for privacy and GenAI · Example scenario of privacy and GenAI · More information — GenAI privacy
How it scores
Each score is backed by a quote verified against the document text. Editorial review has not yet confirmed them.
Accountability
2/5Clear responsibility for AI outcomes
Actively govern and manage for the identified risks and seek support from your privacy and legal teams at all stages.
What to cover in your privacy approach to GenAI
screening score · 2026-10-24
Fairness
2/5Non-discrimination and equitable treatment
Principle 1.2: Respect for the rule of law, human rights and democratic values, including fairness and privacy
Privacy and GenAI
screening score · 2026-10-24
Human Dignity
2/5Respect for the inherent worth of persons
This guidance is aligned with the following OECD AI principle: Principle 1.2: Respect for the rule of law, human rights and democratic values
Privacy and GenAI
screening score · 2026-10-24
Human Oversight
0/5Humans remain in control of consequential decisions
Privacy and GenAI
screening score · 2026-10-24
Privacy
5/5Protection of personal data and private life
Make sure your privacy approach to GenAI meets data-protection rules and legislation, respecting people’s information.
Privacy and GenAI
screening score · 2026-10-24
Transparency
4/5Openness about how AI systems work and are used
You also record your use in the appropriate publicly published register to maintain transparency.
Example scenario of privacy and GenAI
screening score · 2026-10-24
Enforcement
0/5Consequences and compliance mechanisms with real force
Privacy and GenAI
screening score · 2026-10-24
Impact Assessment
4/5Required assessment of an AI system's risks/impacts before or during use
Using privacy impact assessments ( PIA s) for any testing or use of GenAI . This helps you identify and manage privacy risks.
Privacy and GenAI
screening score · 2026-10-24