Compliance · Australia

OAIC updates APP 3 guidance for AI and personal information collection

Published on NORMIX: 2026-10-18 · NORMIX

Updated OAIC guidance explains how existing personal information collection requirements apply to AI, facial recognition and contemporary data practices.

The 13 May 2026 update expands examples and clarifies data minimisation, reasonably necessary collection, fair means and third party collection arrangements. It explains existing APP 3 requirements rather than creating a new AI-specific statute. Its relevance depends on whether the organisation is an APP entity and what information is collected.

NORMIX practical takeaway: map the personal information an AI workflow requests, receives or infers. Record why each category is needed and whether a less intrusive approach is available. Review supplier collection arrangements and any sensitive information consent requirements or applicable exceptions. Public availability of information does not by itself remove privacy obligations.