AI Vendor Contracts and the Privacy Act: What Australian Businesses Should Check

If you've already decided an AI tool is worth trialling and you're now looking at the vendor's contract, the Privacy Act 1988 gives you a clear framework for what to check before signing. Most AI vendor agreements are designed for a US market and don't address Australian obligations by default. Knowing which clauses to look for, and what they should say, is the difference between compliant adoption and an exposure you don't find out about until something goes wrong.

Why Standard Vendor Contracts Fall Short for Australian Businesses

Most AI vendors are headquartered in the United States and draft their standard terms against US law. That means GDPR (the EU's General Data Protection Regulation) clauses are sometimes included as an afterthought for European customers, and Australian obligations under the Privacy Act 1988 and the Australian Privacy Principles (APPs) are rarely addressed at all. The contract you receive may look thorough and still leave significant gaps from an Australian compliance perspective.

Australian businesses that collect, hold, or use personal information are covered by the Privacy Act 1988 if they have an annual turnover above $3 million, or if they fall under specific categories regardless of size (including health service providers, tax file number recipients, and others). Businesses in those categories cannot outsource their Privacy Act obligations to a vendor by signing a contract that ignores those obligations. Responsibility stays with the business.

The OAIC has issued guidance specifically on AI tools and privacy, making clear that due diligence is expected before deploying AI systems that handle personal information. The OAIC's published AI guidance indicates it will scrutinise the adequacy of pre-deployment review if a complaint or breach arises. See that guidance at oaic.gov.au. Signing a contract without checking the clauses below is the kind of gap the OAIC has flagged as inadequate.

The Six Contract Clauses to Check

Work through these in order. The first two are about what happens to your data as an input to the AI system. The next two are about what happens if something goes wrong. The final two are about where your data goes and what legal protections apply when it crosses a border.

1. Training Data Opt-Out

Look for a clause that states whether your data will be used to train or fine-tune the vendor's AI models. If the contract is silent, the vendor's default is often yes. You need either an explicit opt-out provision or a clause confirming that your data is not used for model training under any circumstances.

Why this matters under the Privacy Act: using personal information for a purpose beyond what it was collected for (original collection purpose) can breach Australian Privacy Principle 6 (APP 6), which limits secondary use of personal information. If a client's data is fed into an AI tool that then uses it to improve the vendor's model, that secondary use almost certainly was not disclosed to the client at the time of collection.

What to look for in the contract: clauses titled "Data Use," "Training Data," "Model Improvement," or "Service Improvement." The clause must either exclude your data from training, or give you an opt-out mechanism with a clear process to exercise it. A clause that says the vendor "may use aggregated and anonymised data" for improvements is a weaker protection, as de-identification standards vary.

2. Data Retention Periods

The contract should state how long the vendor retains your data after it has been processed, and what happens to it when your subscription ends. Many AI vendor contracts are vague on both points, stating only that data is "retained as necessary" or "deleted upon request" without specifying timelines or process.

Under APP 11 (Security of Personal Information), the OAIC's guidance outlines that organisations are expected to take reasonable steps to destroy or de-identify personal information that is no longer needed. See the OAIC's APP 11 guidance at oaic.gov.au. If a vendor is holding personal information beyond what the service requires and the contract does not give the customer a mechanism to require deletion, this may create exposure under APP 11 even though the data is in the vendor's hands.

What to look for: a specific retention period stated in days or months, a deletion-on-termination clause with a confirmed timeframe (30, 60, or 90 days is standard), and confirmation that backups are also purged within that window. Ask the vendor to confirm the backup purge process in writing if the contract does not address it.

3. Breach Notification Timelines

Australia's Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988 requires eligible businesses to notify the OAIC and affected individuals of eligible data breaches as soon as practicable, with guidance indicating 30 days as the outer limit for most assessments. If an AI vendor suffers a breach that exposes your data, the clock starts when you become aware of it, not when the vendor tells you.

The contract must require the vendor to notify you within a defined window, so you have time to assess, contain, and notify the OAIC and affected individuals within your own obligations. Without a contractual notification obligation on the vendor, you may not find out about a breach until well after the 30-day assessment window has passed.

What to look for: a clause titled "Data Breach Notification" or "Security Incident Notification" that specifies the maximum time the vendor has to notify you after discovering a breach. Standard practice in well-drafted vendor agreements is 72 hours for initial notification. Any contract that offers notification "promptly" or "as soon as practicable" without a defined timeframe gives you no practical protection. Push for a specific number of hours or days.

4. Data Residency

Data residency clauses specify where your data is stored and processed. Most AI vendor infrastructure is US-based, often on AWS, Google Cloud, or Azure US regions. Some vendors offer Australian region options at a higher tier or for enterprise customers. Many do not offer any Australian data residency at all.

For businesses handling sensitive personal information, such as health records, financial records, or legal matter data, data residency in Australia may be a requirement under sector-specific obligations or a condition of a professional indemnity policy. For most SMBs under the Privacy Act, data residency itself is not a hard legal requirement, but it directly affects the APP 8 analysis (see below) and can simplify your compliance position significantly.

What to look for: a clause that names the specific countries or regions where your data will be stored and processed, including backups and disaster recovery infrastructure. A clause that says data is stored "in the United States or other countries as required" gives you essentially no information. Also check whether Australian data residency is available, what tier it requires, and whether it covers all data or only certain categories.

5. Subprocessor Disclosure

AI vendors rarely operate in isolation. They typically use third-party subprocessors (companies your AI vendor uses to process data on their behalf) for infrastructure (cloud hosting), analytics, support tooling, and sometimes model inference itself. Each subprocessor that touches your data is a potential compliance gap. If the vendor's main contract meets your requirements but a subprocessor operates under weaker terms in a jurisdiction with less privacy protection, your data is exposed at the weakest link.

What to look for: a clause requiring the vendor to maintain an up-to-date list of subprocessors, to notify you before adding new subprocessors, and to confirm that all subprocessors are bound by data handling terms at least as protective as those in your main agreement. Some vendors publish this list publicly; others only provide it on request. Either is acceptable, but "we may use subprocessors at our discretion" without a disclosure mechanism is not.

When you request the subprocessor list, check the countries of operation for each subprocessor. This directly feeds into the APP 8 assessment below.

6. APP 8 Cross-Border Protections

Australian Privacy Principle 8 applies when personal information is disclosed to an overseas recipient. If your AI vendor is based overseas, or stores or processes data overseas. Which covers most vendors. APP 8 is engaged. Under APP 8, the OAIC's guidance outlines that businesses are expected to take reasonable steps to ensure the overseas recipient does not handle the personal information in a way that breaches the APPs. See the OAIC's full APP 8 guidance at oaic.gov.au.

In practice, this means the vendor's contract must include data handling obligations that are equivalent to what the APPs require. If the vendor's standard terms do not include APP-equivalent protections, you should request a Data Processing Agreement (DPA) or Privacy Addendum that does. Many vendors who operate in the EU already have GDPR-compliant DPAs; ask whether that DPA also covers Australian APP obligations, or whether a separate addendum is available.

Under APP 8.1, you may also be liable for a breach of the APPs by an overseas recipient as if you had committed the breach yourself. That accountability exception only applies where you took reasonable steps before disclosing the data. The due diligence steps in this article are what "reasonable steps" looks like in practice.

For a full explanation of how APP 8 applies to AI tools and overseas data transfers, see the Privacy Act anchor article: AI and the Privacy Act 1988: What Australian Businesses Need to Know.

What to Do If the Contract Is Silent on These Clauses

A contract that does not address these clauses is not automatically disqualifying, but it does require action before you sign. The practical steps are straightforward: prepare a written list of the clauses above, email the vendor's sales or legal contact requesting either the relevant contract provisions or a Data Processing Agreement that covers them, and document that you asked and what response you received.

If the vendor refuses to provide APP 8-equivalent protections or declines to confirm a breach notification timeline, that is a risk you need to factor into your decision. It does not mean the tool is unusable, but it does mean your residual exposure is higher and you should consider whether the business data you're feeding into the tool warrants that risk.

The OAIC's guidance on AI and privacy (released in 2024 and updated since) specifically calls out vendor due diligence as a key expectation for businesses deploying AI. Keeping a record of the due diligence steps you took, including vendor responses or non-responses, strengthens your position significantly if a complaint or breach investigation follows. For what the OAIC guidance covers in detail, see: OAIC AI Guidance for Australian Businesses: What It Means in Practice.

Quick Reference: Vendor Contract Checklist

Use this checklist when reviewing any AI vendor contract. For each item, confirm the contract addresses it explicitly, or note it as an open question to raise with the vendor before signing.

• Training data opt-out: Does the contract confirm your data will not be used to train the vendor's models, or provide a clear opt-out mechanism?
• Data retention period: Is there a specific retention period, a deletion-on-termination clause with a defined timeframe, and confirmation that backups are purged?
• Breach notification timeline: Does the contract require the vendor to notify you within a specific number of hours or days of discovering a breach?
• Data residency: Does the contract name the specific countries or regions where your data will be stored, including backups and disaster recovery infrastructure?
• Subprocessor disclosure: Does the contract require the vendor to maintain and disclose a subprocessor list, and notify you before adding new subprocessors?
• APP 8 protections: Does the contract or an accompanying DPA include data handling obligations equivalent to the Australian Privacy Principles for any overseas data transfers?

Related reading: can staff upload customer data to AI tools, AI tools with Australian data centres, HR AI compliance in Australia, free AI staff policy template, AI data breaches and the NDB scheme, Claude AI review for Australian business, Notion AI review for Australian business, and Microsoft Copilot pricing in Australia.

Related reading: our AI register template and our what an AI register is and why your business needs one.

Related reading: our best quoting software for Australian tradies and our using AI for contract drafting in Australia.

Try our free AI Privacy Risk Scorer to score your current AI tool setup against Privacy Act requirements.

Try our free AI Compliance Checker to check whether your AI tools meet your compliance obligations.

Does the Privacy Act 1988 apply to my business if it's under $3 million turnover?

The $3 million turnover threshold is the general rule, but several categories of smaller business are covered regardless of revenue. Health service providers, businesses that trade in personal information, and businesses that opt in to the Privacy Act are all covered below the threshold. If your business handles health records, runs an employee background check service, or has signed a contract that references Privacy Act compliance, check whether an exemption applies to you specifically rather than assuming the threshold applies.

What is APP 8 and why does it apply when I use an overseas AI vendor?

APP 8 (Australian Privacy Principle 8) covers cross-border disclosure of personal information. When you send personal information to an overseas recipient, including by uploading it to a cloud service hosted in another country, APP 8 is engaged. It requires you to take reasonable steps to ensure the overseas recipient handles the information in a way that is consistent with the APPs. If they don't, you can be held accountable as if you committed the breach yourself. Using an overseas AI vendor without checking their data handling terms does not satisfy APP 8.

Can I rely on a vendor's GDPR compliance to cover my Australian Privacy Act obligations?

Not automatically. GDPR and the Privacy Act share some common principles, but the APPs have specific requirements, particularly around cross-border disclosure (APP 8), that are not identical to GDPR equivalents. A vendor with a GDPR-compliant Data Processing Agreement is a better starting position than one with no DPA at all, but you should ask the vendor specifically whether their DPA covers Australian APP obligations or whether an Australian-specific addendum is available. Some vendors, particularly those with significant APAC customer bases, offer this; many do not.

How quickly does a vendor need to notify me of a data breach under an AI vendor contract?

The contract, not the law, determines when the vendor tells you. Australian law sets your obligation to notify the OAIC and affected individuals, but it only starts the clock once you are aware of an eligible breach. If your vendor takes two weeks to tell you about a breach, your 30-day assessment window is already partially consumed. A well-drafted contract requires vendor notification within 72 hours of the vendor becoming aware of a breach. Accept nothing vaguer than a specific number of hours or days.

What if the AI vendor refuses to negotiate contract terms?

Many vendors, particularly smaller SaaS companies, will not negotiate standard terms for SMB customers. In that case, your decision is whether the tool's compliance profile is acceptable given the data you intend to use with it. One practical approach is to limit the personal information you feed into the tool to what is genuinely necessary, reducing your exposure without requiring the vendor to change their terms. For tools that handle significant volumes of sensitive personal information, a vendor unwilling to provide APP 8-equivalent protections is a meaningful risk that warrants considering an alternative tool, even if it is less capable.