Knowledge base
These AI security and privacy guides help Australian law, accounting and advisory firms use AI without losing control of client information. They explain where tools such as ChatGPT keep your data, what the Australian Privacy Principles mean for AI use, how to set up business plans securely, and what an AI acceptable-use policy must cover.
Last updated:
Reviewed 23 September 2026
When a firm covered by the Privacy Act uses AI, the Australian Privacy Principles apply to the personal information staff put into the tool and to anything it produces about a person. APPs 1, 3, 5, 6, 8, 10 and 11 matter most. This guide explains each, what the OAIC expects and what changes on 10 December 2026.
Reviewed 23 September 2026
To set up ChatGPT Business securely, verify your email domain, connect single sign-on with MFA, control who can join, switch off unapproved apps and third-party GPTs, set memory and record-keeping rules, and train staff against a written policy. This checklist is for practice managers at Australian law and accounting firms, current as at September 2026.
Reviewed 23 September 2026
Where does ChatGPT store your data? On personal plans, OpenAI stores content in the US and around the world. As at September 2026, new ChatGPT Enterprise and Edu workspaces and approved API customers can store content at rest in Australia, and ChatGPT Business is gaining a region choice. On every plan, the model still processes prompts offshore.
Reviewed 23 September 2026
An AI acceptable use policy tells staff which AI tools they may use, what information can go into them, how outputs are checked and who is accountable. Australian law and accounting firms also need it to deal with client confidentiality and privacy obligations. This guide explains each clause, and our free template supplies the wording.
Reviewed 23 September 2026
Shadow AI in professional firms is staff using AI tools the firm has not approved, such as personal ChatGPT accounts, browser extensions and AI note-takers. It puts client information outside the firm's control. The fix is to find what staff use and why, give them an approved tool for the same jobs, then restrict the rest.
This topic covers the security and privacy questions partners should settle before AI touches client work: which tools staff are using, where those tools keep data, what Australian privacy law expects, and what rules staff should follow. The guides are written for managing partners and practice managers, not security specialists, and they focus on decisions a firm can make itself.
Shadow AI is staff using AI tools the firm has not approved or configured, often personal accounts on free plans. It is the right place to start because a firm cannot secure tools it does not know about. Shadow AI in professional firms explains how to find out what is in use and move people onto approved tools.
It depends on the tool, the plan and the settings, not just the brand. Consumer and business plans of the same product can differ on how long data is kept, what administrators can see and whether inputs can be used to train models, and processing locations vary by vendor and plan. Where does ChatGPT store your data? sets out the position as at September 2026 and the alternatives for firms that need more control.
The Australian Privacy Principles set how organisations covered by the Privacy Act 1988 collect, use, disclose and protect personal information. The OAIC’s guidance on commercially available AI products says privacy obligations apply to any personal information entered into an AI system, and to AI output that contains personal information. AI and the Australian Privacy Principles translates the principles that matter most for AI into plain English, with examples from professional firms.
An AI acceptable-use policy should say which tools are approved, what information must never go into them, who reviews AI output before it reaches a client, and how staff report a mistake. Keep it short enough that people read it. AI acceptable-use policy: what it must cover walks through each clause and links to our free template.
Our security and data residency page explains how client data in the systems we build and run is stored, who has access, and how the AI providers we use handle your data. For work that cannot go into public tools, Private AI and knowledge assistants store client data in fully GDPR-compliant data centres, and your firm chooses which matter and client documents they can search.
This is general information, not legal advice.
Related service
Private AI for sensitive work: a staff chat assistant and an assistant that answers from your own precedents, policies and procedures, citing its sources.
Questions
No, not without controls the firm has checked. Free and personal AI accounts sit outside the firm's admin controls, so the firm cannot see what was shared, set how long it is kept or remove access when someone leaves. Settings on personal accounts can also allow conversations to be used to improve the vendor's models. Move staff onto a business plan the firm administers, or a private assistant.
Yes, if anyone in the firm uses AI for work. A short policy tells staff which tools are approved, what information must never go into them, who checks AI output before it reaches a client, and how to report a mistake. Without one, each person makes their own rules, and the firm cannot show what it expected of staff if something goes wrong.
Secure by design. Set up correctly. Fully managed.
Start with a free 45-minute discovery call. We look at your systems and priorities, then recommend a first step with a fixed scope, or tell you if we are not the right fit.
