Yes — not because ChatGPT is dangerous, but because you don’t have visibility over what’s happening, and that’s the actual problem.
When staff paste client data into a public AI tool, a few things happen that most businesses haven’t thought through. The data leaves your environment and goes to a third party. Depending on the tool’s settings, it may be used to train future models. Your client agreement probably didn’t contemplate this. Your privacy policy almost certainly doesn’t mention it. And you have no record of what was shared, why, or what came back.
None of that means the sky is falling. People are using these tools because they’re genuinely useful. But the absence of a policy means you’re running blind — you have no way to assess the risk because you don’t know what’s happening.
Under the Privacy Act, handling personal information in ways that aren’t covered by your policy, or sharing it with third parties without appropriate controls, creates real exposure. The December 2026 changes make this more acute, not less.
The practical response has two parts. First, a policy — not a blanket ban, which won’t work and will just drive the behaviour underground, but a clear set of rules about what data can and can’t go into public AI tools, what tools are approved, and what the process is for evaluating new ones. Second, a conversation with your team, so people understand why the rules exist and aren’t simply working around them.
Neither of these is a large project. A usable AI use policy for a mid-market firm is typically two to three pages. The hard part is making the decision to have one.
If you want to work through how this applies to your business, I offer a free call.
This content is for general information only and does not constitute legal advice. For advice specific to your circumstances, consult a qualified Australian privacy lawyer.
