AI agent development in Australia
Autonomous agents for Australian teams, built against the Privacy Act 1988 and the thirteen Australian Privacy Principles — including the one about overseas recipients that a hosted model endpoint quietly triggers.
Get my free blueprintThe Privacy Act 1988 and its thirteen Australian Privacy Principles apply to the organisation deploying an agent, not to the agent itself, and they apply as soon as it handles information about an identifiable person. Obligations bite hardest at three points: the privacy policy under APP 1, the purpose limit under APP 6, and any disclosure to an overseas recipient under APP 8.
The regulator is the Office of the Australian Information Commissioner. Organisations under the small-business turnover threshold may sit outside the Act entirely — several exceptions apply.
Australian buyers ask a sharper version of the privacy question than most: not "is it secure" but "which principle does this fall under, and who wears it if it goes wrong". That is a better question, because the Privacy Act allocates accountability to the entity, and no amount of vendor assurance moves it.
So this page maps agent components to the principles they touch, and is explicit about the one that catches nearly every deployment: the model call to an overseas provider.
An agent is not a special legal category. It is a system that collects, uses, discloses and stores personal information faster than a person would, which means the ordinary principles apply with less slack in them:
| Principle | What it requires | Where an agent trips |
|---|---|---|
| APP 1 | Open and transparent handling, with a current privacy policy | The policy predates the agent and never mentions automated processing |
| APP 3 & 5 | Collect only what is reasonably necessary; notify at collection | An enrichment step pulls far more than the workflow needs, because it can |
| APP 6 | Use or disclose only for the primary purpose, or a permitted secondary one | Support transcripts collected for service get reused as sales signals |
| APP 8 | Take reasonable steps before disclosing to an overseas recipient | Every prompt sent to a foreign model endpoint |
| APP 11 | Secure the information; destroy or de-identify it when no longer needed | Agent memory and run logs accumulate indefinitely with no retention rule |
| APP 12 & 13 | Give access on request; correct what is wrong | Personal data sits in a vector store nobody can search by individual |
The pattern is consistent: agents rarely create a new obligation, they remove the friction that was quietly enforcing an old one. Manual processes limited collection because collection was tedious. An agent has no such limit, so the limit has to be designed in.
This is the clause that applies to almost every agent built today. When personal information is disclosed to a recipient outside Australia, APP 8 requires reasonable steps to ensure that recipient does not breach the principles, and section 16C can leave the disclosing organisation accountable for what the recipient then does. A prompt containing a customer's name, history and circumstances, sent to a model API operated abroad, is that disclosure.
There are three defensible responses, and pretending the clause does not apply is not one:
| Rows in the master pipelineassembled by one agent across four market segments | 5,231 |
|---|---|
| Australia segmentthe second-largest segment after the US | 1,270 |
| Reached contact-verifiedof 5,231 — the filtering is the product | 145 |
| Collection cadencescheduled job, no human trigger | daily |
Source: Our own production host — the lead-generation agent in that 19-agent Hermes fleet. Observed .These rows describe our own prospecting system, not a client deployment or an outcome. They are here because they are the honest illustration of the point above: an agent that assembles 1,270 records about Australian people is handling personal information, and the retention and security questions under APP 11 start the moment the first row lands.
Under the Notifiable Data Breaches scheme, an entity covered by the Privacy Act that suspects an eligible data breach — unauthorised access, disclosure or loss likely to cause serious harm — must assess it promptly and, if it qualifies, notify the OAIC and the individuals affected.
With an agent, the hard part is the assessment. Answering "what did it disclose, to whom, and about how many people" requires run logs that record the tool calls and the records touched, retained long enough to be useful and structured enough to be read under pressure. A system that logs only the final output cannot answer the question, and an entity that cannot answer it has to assume the worse case. Build the audit trail for the bad week, not the demo. The same logic driveshow our own lead engine records every filtering step between 5,231 raw rows and 145 verified contacts.
There is no Australian Privacy Principles certification, no accreditation body issuing one, and no product that makes an organisation compliant by being installed. Compliance is an entity-level assessment of practices, procedures and systems. What a build can honestly deliver is the engineering half: a documented data path, a retention rule that executes, approval gates on consequential actions, and logs that survive an investigation. The privacy policy, the assessment and the accountability stay with you.
Controls mapped to principles
The primary purpose each agent serves, written down before the build, so an APP 6 question later has an answer that was not invented retrospectively.
An explicit list of fields the agent may collect and enrich. Agents scale collection effortlessly, which is exactly why the ceiling has to be stated rather than assumed.
Onshore model, pseudonymised prompts, or a documented APP 8 assessment. One of the three is chosen in the scope, and the choice is recorded with its reasoning.
A retention period for memory, logs and intermediate artefacts, with the deletion job scheduled — APP 11 asks for destruction or de-identification, not intention.
A way to find and amend one individual across the agent state, so APP 12 and APP 13 requests do not require a developer and a weekend.
Tool calls and records touched, retained and searchable, so an NDB assessment can establish scope in hours rather than assuming the worst.
Being straight about this is more useful than dressing up a generic build in local vocabulary. The following is identical for a Brisbane team and a Boston one:
The Australian part of this page is the principles mapping, the APP 8 decision and the NDB readiness. The rest is the same engineering, which is the reason it can be delivered from anywhere.
Often not, and that surprises people. The Act generally exempts organisations with an annual turnover of three million Australian dollars or less, but the exemption falls away for health service providers, businesses that trade in personal information, contracted service providers to the Commonwealth, credit reporting bodies and tax file number handling. Many small businesses also accept APP obligations contractually through an enterprise customer.
Four carry most of the weight. APP 1 requires an open, current privacy policy describing how information is handled. APP 6 limits use to the purpose it was collected for. APP 8 governs disclosure to overseas recipients. APP 11 requires active security and destruction or de-identification once the information is no longer needed — which agent memory stores routinely fail.
No. There is no APP certification scheme and no regulator-issued badge a vendor can hold; compliance is an assessment of an entity and its practices, made by that entity and tested by the OAIC if something goes wrong. A vendor can supply the architecture, the documented data path and the controls. The accountable party remains the organisation deploying the agent.
Treat it as one unless you have advice saying otherwise. APP 8 applies when personal information is disclosed to a recipient outside Australia, and a hosted LLM endpoint operated by a foreign provider is a recipient. The practical consequence is that under section 16C the disclosing organisation can remain accountable for how that overseas recipient handles the information.
The same obligation as any other breach. If unauthorised access, disclosure or loss of personal information is likely to result in serious harm, the entity must assess it promptly and notify both the OAIC and the affected individuals. An agent makes assessment harder rather than different, because the evidence lives in run logs — which is why those logs need to be readable by a human under pressure.
Delivery is remote and asynchronous, with an overlap window agreed in the engagement scope rather than a claim of local coverage. The deployed agent is unaffected either way: it runs on scheduled jobs and interval loops, so an overnight run in Perth or Sydney is the normal operating mode, not a special arrangement.
Tell us the workflow and the information it touches. You get a written scope naming the purpose, the collection ceiling, the overseas-disclosure decision, and the retention rule — before anything is built.
Goes straight to hello@iamagentman.com — we read every message ourselves. Prefer to answer three questions instead?Build your blueprint.
One message · reply within one business day