Every request to an AI personal assistant is a round trip, and both ends are yours.
What you hand it, where it goes, what comes back, and what you do with it next. This site does not name, compare or rank any assistant.
General information from Australian Government guidance on AI tools, not legal advice. The duties described are those of a business the Privacy Act covers. The Australian Privacy Principles do not apply to an individual's handling of personal information only for the purposes of, or in connection with, their personal, family or household affairs, and the OAIC notes that, generally, the Privacy Act doesn't apply to an individual acting in a personal capacity.
In
Out of your hands
Back
What you do with it
Every station is numbered to its guide.
The loop's length and the spacing of its stations carry no meaning. The four legs run in the order the guidance gives them.
Before you connect it to your email
Not a scorecard for any product. The National AI Centre's advice is not to work through every question, but to pick the ones that matter most for the task at hand, especially where the risk or impact is higher. Each section of its supplier guide sets out the questions to put to a supplier, the signs of a good answer, and the points to record in writing. The questions it sets on data, asked about your own account:
- Could any of the data you give it go into training AI models, either now or later on?
- Can the AI features be limited or switched off to restrict how data is used? One caution from IP Australia: while certain AI models allow you to opt out of having your data used for training, your data may still be stored.
- What happens to your data if you stop using this solution? The questions on exit also ask whether your data can be exported in a usable format, and how data is deleted after exit.
Who the rules reach
A person acting in a personal capacity is generally outside the Act: the OAIC's definition of an organisation carries its parenthesis that, generally, the Privacy Act doesn't apply to an individual acting in a personal capacity.
A business can be outside it too. The OAIC's page on rights and responsibilities under the Privacy Act says organisations with an annual turnover more than $3 million have responsibilities under the Privacy Act, subject to some exceptions. It also says the Act covers some small business operators (organisations with an annual turnover of $3 million or less), and lists which.
What changes on 10 December 2026 when AI helps decide about people