GDPR vs Privacy Act: What GDPR Means in Australia

GDPR applies to an Australian business when it offers goods or services to people in the EU, monitors their behaviour, or processes data through an EU establishment. Australia has no EU adequacy decision, so EU-to-Australia transfers need Standard Contractual Clauses. GDPR and the Privacy Act 1988 share a structure but differ on consent, lawful basis, automated decisions and impact assessments.

Does GDPR apply in Australia?

GDPR applies to Australian organisations in specific situations, not by default. Under GDPR Article 3, it reaches organisations outside the EU that offer goods or services to people in the EU, or monitor their behaviour there. It also covers processing in the context of any EU establishment. The UK GDPR works the same way for UK residents.

Consider a typical example. A Sydney software company's AI features summarise support tickets and draft replies. Over three years it picks up some UK and EU customers, a Berlin contractor joins engineering, and its AI vendor turns out to run inference in Frankfurt and Dublin.

That company now sits inside GDPR, UK GDPR and possibly the EU AI Act, while remaining bound by the Privacy Act 1988 (Cth) and its 2024 amendments. Two regulators, two breach clocks, two consent standards, and a transfer regime that does not treat Australia as adequate.

The short version

Australia's Privacy Act and the EU GDPR share an architecture: lawful collection, breach notification, access rights. On the ground they diverge on consent, lawful basis, automated decision rights, DPIAs, transfer mechanics and penalties. The EU AI Act adds separate obligations triggered by AI use. For any Australian organisation whose AI touches EU or UK personal information, those divergences decide what you build.

Where do GDPR and the Australian Privacy Act agree?

	Privacy Act 1988 (Cth)	GDPR (Regulation (EU) 2016/679)
Protects personal information	APPs 1 to 13 apply to APP entities	Applies to processing of personal data
Requires a lawful basis or purpose	APP 3 collection limitation	Art 6 lawful bases for processing
Data breach notification scheme	Notifiable Data Breaches Pt IIIC	Art 33 and 34 breach notification
Access and correction rights	APP 12 access, APP 13 correction	Art 15 access, Art 16 rectification
Cross-border transfer obligations	APP 8 disclosure overseas	Chapter V transfers to third countries
Independent regulator	Office of the Australian Information Commissioner	Data protection authorities, EDPB oversight
Special protection for sensitive categories	APP 3.3 sensitive information	Art 9 special categories

A team that has done serious Privacy Act compliance will recognise the GDPR vocabulary. The trap is assuming the similarity goes all the way down.

How is GDPR different from the Australian Privacy Act?

1. Consent threshold

GDPR Art 4(11) and Art 7 define consent as a "freely given, specific, informed and unambiguous" indication by "clear affirmative action". Bundled consent, pre-ticked boxes and service-gated consent generally fail. Withdrawal must be as easy as giving consent.

Privacy Act APP 3 requires consent to collect sensitive information, but the statute does not codify GDPR's specificity, bundling and withdrawal mechanics. The OAIC's APP Guidelines recommend express, informed, voluntary and current consent. A consent flow that satisfies the OAIC may fail the GDPR test, especially when asking permission to feed inputs into a model.

2. Lawful basis

GDPR Art 6 lists six lawful bases (consent, contract, legal obligation, vital interests, public task, legitimate interests), with Art 9 conditions layered on for special categories. You choose one and document it. Legitimate interests needs a documented balancing test.

The Privacy Act asks whether collection is reasonably necessary for your functions or activities, plus consent for sensitive information. There is no Art 6 menu. Many Australian organisations have never recorded a lawful basis, and the first GDPR-touching AI use case exposes that gap.

3. Automated decision-making rights

This divergence hits AI hardest.

GDPR Art 22 gives people the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, subject to limited exceptions. Where an exception applies, the controller must provide safeguards including human intervention, the chance to express a view, and the right to contest.

The Privacy Act now requires, under amendments made in 2024, that privacy policies disclose the use of computer programs to make decisions that could significantly affect an individual's rights or interests. These provisions commence on 10 December 2026. It is a transparency obligation, without a statutory right to human intervention. See our guide to the Privacy Act automated decision rules.

An AI engine that auto-declines an EU resident's application may be an Art 22 decision with the full safeguard stack. The same engine applied to an Australian must be disclosed, without the statutory right to a human review.

4. DPIA versus PIA

GDPR Art 35 requires a Data Protection Impact Assessment where processing, particularly with new technologies, is likely to result in high risk. EDPB guidance lists automated decisions with significant effects, large-scale special category processing and innovative technology as triggers.

The OAIC recommends Privacy Impact Assessments, but the Privacy Act imposes no general PIA requirement on the private sector. Once GDPR is engaged, a DPIA is required before high-risk AI processing begins.

5. Cross-border transfers

GDPR Chapter V restricts transfers outside the EU and EEA unless there is an adequacy decision (Art 45), appropriate safeguards such as Standard Contractual Clauses or Binding Corporate Rules (Art 46), or a limited derogation (Art 49). The Schrems II judgment (Case C-311/18, July 2020) requires a Transfer Impact Assessment for SCC transfers. The current SCCs date from June 2021 (Decision 2021/914).

Australia does not hold an EU adequacy decision. The adequacy list includes the UK, Switzerland, Japan, South Korea, New Zealand, Canada (commercial organisations), Israel and the United States under the EU-US Data Privacy Framework, among others. Australia is not on it.

Every transfer of EU personal data into an Australian-hosted AI system or vendor needs SCCs plus a TIA. The TIA assesses Australian surveillance and law enforcement law, including the Telecommunications and Other Legislation Amendment (Assistance and Access) Act 2018, and any supplementary measures.

APP 8 works the other way: it requires reasonable steps so overseas recipients do not breach the APPs, and generally makes the disclosing entity accountable. APP 8 is a reasonable steps standard. Chapter V is a prohibition with listed exceptions.

6. Penalty design

Since 2022, maximum penalties for serious or repeated interferences with privacy under the Privacy Act are the greater of A$50 million, three times the benefit obtained, or 30% of adjusted turnover. The 2024 amendments added lower penalty tiers.

GDPR Art 83 sets maximum fines at the higher of EUR 20 million or 4% of worldwide annual turnover for the most serious infringements, and EUR 10 million or 2% for others. In Australia a court imposes penalties on the Information Commissioner's application. In the EU, supervisory authorities impose fines administratively, subject to appeal.

7. EU AI Act

Regulation (EU) 2024/1689 entered into force on 1 August 2024 with staged application. Prohibited practices applied from February 2025, and general-purpose AI model obligations from August 2025. The Digital Omnibus on AI, in force from 27 July 2026, deferred most high-risk obligations to 2 December 2027 for Annex III systems and 2 August 2028 for AI in regulated products, while Article 50 transparency duties applied from 2 August 2026 (European Commission, 2026).

The Act reaches providers and deployers outside the EU where the AI system's output is used in the Union. High-risk status depends mainly on Annex III areas such as employment decisions, credit scoring, biometric categorisation, critical infrastructure and education. Obligations cover risk management, data governance, documentation, transparency, human oversight, accuracy and robustness.

How do Australian organisations end up under GDPR?

Most arrive through one of four routes.

	Trigger	What it brings into scope
EU or UK customer base	You sell, market, or offer services to EU or UK residents	Full GDPR or UK GDPR for that processing. EU AI Act if AI output is used in the EU. SCCs plus TIA for any data transfer back to AU.
EU or UK staff or contractors	A remote employee or contractor based in the EU or UK	Employment data is personal data under GDPR. HR systems and AI tools (recruitment scoring, performance review, monitoring) fall within GDPR scope for that individual.
AI vendor processes in EU regions	Your vendor hosts inference, embeddings, or storage in the EU even though you and your users are in AU	Often does not trigger GDPR on its own, but EU vendor terms commonly impose GDPR-equivalent obligations contractually. Read the DPA.
AI model trained on EU personal data	The foundation model or fine-tune used EU personal data in training	Direct GDPR exposure for the model provider; the Italian Garante's March 2023 temporary restriction of ChatGPT turned on lawful basis questions. Deployers should check the provider's position.

The third route is the one most often missed. An organisation with no EU customers or staff can find its AI workload routed through Frankfurt or Dublin because that is where the vendor's capacity sits. Whether GDPR formally applies depends on your role, but the vendor's data processing agreement will usually impose GDPR-style terms anyway. If data location matters to you, AI that runs on your own infrastructure in Australia removes the question. Our data sovereignty guide covers the options.

The fourth route sits upstream. The EDPB's Opinion 28/2024 on AI models and personal data is the current reference point for deployers checking a provider's position.

Where do GDPR and Privacy Act checkpoints sit in an AI data flow?

1. 1Data subjectEU or UK resident, AU resident, or both. Determines which regime applies to that record.
2. 2Collection pointGDPR Art 13 or 14 notice. APP 5 notification. Lawful basis recorded (GDPR Art 6 plus Art 9 if special category).
3. 3Cross-border transferIf EU to AU: SCCs plus TIA (Chapter V, Schrems II). If AU to overseas: APP 8 reasonable steps.
4. 4AI processingDPIA under Art 35 if high risk. EU AI Act obligations if Annex III high-risk system. Privacy Act automated decision transparency if significant effects (from Dec 2026).
5. 5Storage and retentionArt 5(1)(e) storage limitation. APP 11.2 destruction or de-identification when no longer needed.
6. 6Output or decisionArt 22 safeguards if solely automated and legally or significantly affecting. Right to human intervention, contestation, explanation.
7. 7Breach responseGDPR Art 33: 72 hours to supervisory authority. OAIC NDB: 30-day assessment, notify as soon as practicable if eligible.

The map needs to be complete, and it should be the artefact your CIO, privacy officer and general counsel use when scoping any AI build that may touch EU data.

What controls do you need for GDPR and the Privacy Act together?

1. Step 1Data flow auditInventory every personal-data field, system and processor. Tag each record by data-subject jurisdiction.
2. Step 2RoPA and privacy management planRecord of Processing Activities under GDPR Art 30 for EU-exposed processing, alongside your APP 1 privacy management documentation.
3. Step 3Transfer mechanismSign current EU SCCs for each EU-to-AU flow and complete a Transfer Impact Assessment. Use the UK IDTA or UK Addendum for UK transfers.
4. Step 4DPIA and PIADPIA under Art 35 for high-risk AI touching EU data. Run an OAIC-style PIA in parallel for the Australian side.
5. Step 5Art 22 reviewFor solely automated significant decisions on EU residents: confirm an Art 22(2) exception, document safeguards, and build human review that works in production.
6. Step 6DPO assessmentAppoint a DPO if Art 37 thresholds are met, or document why they are not.
7. Step 7Dual-clock breach responseOne playbook that triggers the GDPR 72-hour clock and the OAIC 30-day assessment from the same incident.
8. Step 8EU AI Act gap checkConfirm whether AI output is used in the EU, assess Annex III high-risk status and Art 50 transparency, and plan against current deadlines.

Whether the AI is bought, partner-built or in-house, someone must own each of these eight artefacts, and they should reference each other. A person approves before any automated decision reaches a customer: that design choice simplifies both regimes.

How much GDPR exposure does your organisation have?

Which of these is true today?

• You offer goods or services to EU or UK residents (any volume, any language)High exposure. GDPR Art 3(2)(a), full Chapter V transfer regime, possible AI Act if AI is in the product.
• You monitor EU residents' behaviour (analytics, tracking pixels, profiling, advertising)High exposure. GDPR Art 3(2)(b). Cookie and tracker consent at GDPR standard required.
• You have EU or UK staff, contractors, or board members whose data is processed in AUModerate-to-high exposure. GDPR applies to that processing. HR AI tools (recruiting, performance, monitoring) most at risk.
• Your AI vendor processes data in EU regions (Frankfurt, Dublin, Paris)Moderate exposure via the vendor's data processing agreement. Review the DPA, SCCs flow-down, and incident terms carefully.
• Your AI model was trained on data including EU personal informationIndirect exposure. Provider carries direct risk. Document your due diligence on the provider's lawful basis position.
• None of the above. Australian customers, Australian staff, Australian-hosted AI, no EU trackingLow exposure. Privacy Act 1988 and the 2024 amendments are your primary frame. Re-test annually as the business grows.

For most Australian organisations with any international footprint, at least one moderate trigger is already live. Document the answer and re-test every twelve months and on any material change.

Ten-question readiness checklist

1. Have we tagged every category of personal information the AI collects, infers or outputs by jurisdiction?
2. Have we recorded a GDPR Art 6 lawful basis (and Art 9 condition if needed) for each EU processing operation?
3. Have we completed a proportionate DPIA for the AI use case?
4. For EU-to-AU flows, have we signed current SCCs and completed a TIA?
5. For UK data, have we executed the UK IDTA or UK Addendum?
6. Does the AI make solely automated significant decisions on EU residents, and which Art 22(2) exception applies?
7. Have we mapped Privacy Act automated decision disclosures for 10 December 2026?
8. Does our incident plan trigger both the GDPR 72-hour and OAIC 30-day clocks from one detection?
9. Does the EU AI Act apply, and is the system high-risk under Annex III?
10. Are the answers documented, dated and owned, with a twelve-month review?

How Solve8 can help

We start with a data flow map and a written exposure assessment, then design AI that runs on your infrastructure in Australia with a person approving significant decisions. See our AI strategy service and private AI infrastructure, or talk to us about your cross-border exposure.

---

Related reading

• Privacy Act Automated Decision Making: Ready by 10 December
• AI Agent Governance, Data Access, Privacy, and Human Override
• AI Vendor Selection Questions for Australian Business
• Financial Services AI Compliance: APRA and ASIC
• AI Security Checklist: 50 Points for Australian Businesses
• Cyber Security Requirements for Australian Business

This article is general information, not legal advice. Legal positions evolve.