Determine scope before assuming an exemption
Start by asking counsel whether the supplier and activity fall within the Privacy Act and Australian Privacy Principles. Do not infer that a small team, a business-to-business dataset, or publicly visible content is automatically outside privacy obligations. Build an inventory of information about identifiable people, including free-text narratives and indirect identifiers, and distinguish permission to provide the existing service from permission to license data for a buyer’s training programme.
Understand the overseas recipient
OAIC guidance explains that APP 8 generally requires reasonable steps before an APP entity discloses personal information overseas and can leave the disclosing entity accountable for recipient conduct. It also distinguishes a separate overseas company from an overseas office of the same entity. Obtain the lab’s legal-entity and subcontractor map rather than accepting a brand name. The guidance connects APP 8 with APP 6, so the purpose of disclosure still needs its own review.
Test what the contract can support
Describe permitted uses precisely and request concrete security, complaint-handling, retention, and incident arrangements. If the buyer wants to keep training rights after the licence ends, highlight that issue for negotiation before sending a sample. For audio or image data, prepare a separate identity-risk review; removing filenames may leave voices, faces, or contextual identifiers intact. Use aggregate statistics and synthetic examples to demonstrate coverage during early diligence.
- Record why the activity is a disclosure or use under the applicable guidance.
- Identify who controls onward access and approves subcontractors.
- Review any proposed APP 8 exception with qualified counsel.
Review before release
Sources reviewed on 19 October 2026. This is a preparation checklist, not legal clearance, tax advice, or confirmation that an AI lab accepts suppliers from this jurisdiction. Ask qualified local counsel to review the actual dataset, collection history, proposed training purpose, recipient, and current rules before releasing personal data.