Most businesses collect personal information every day, from customer emails to website analytics. Data consent sits at the centre of how Australian privacy law treats that information. Getting consent right builds trust with your customers. Getting it wrong can lead to complaints, regulatory action and reputational damage.
This guide explains what valid data consent looks like under the Privacy Act, when you actually need it, and how AI changes the picture. For a broader introduction, see our earlier guide to data privacy consent in Australia.
Does the Privacy Act Apply to Your Business?
The Privacy Act 1988 (Cth) and its 13 Australian Privacy Principles (APPs) apply to businesses with an annual turnover of more than $3 million. The Act also covers some smaller businesses, including health service providers, businesses that trade in personal information, credit reporting bodies, Commonwealth contractors and businesses related to a larger organisation.
Even if your business falls below the threshold, following the APPs is good practice. Larger clients and investors increasingly expect it, and the rules may tighten further.
What Counts as Valid Data Consent?
Under the Privacy Act, consent can be express or implied. A person gives express consent clearly, for example by ticking a box or signing a form. Implied consent comes from a person’s conduct.
According to the Office of the Australian Information Commissioner (OAIC), valid consent has four key elements.
The Person Is Adequately Informed
People must understand what they are agreeing to before they agree. Explain what you will collect, why you need it and who you will share it with, in plain English.
Consent Is Voluntary
People must have a genuine choice. If refusing would mean losing access to something unrelated, the consent may not be voluntary. The OAIC also warns against “bundled” consent, where one tick covers many different uses at once.
Consent Is Current and Specific
Consent applies to a particular purpose at a particular time. You cannot rely on a vague, open-ended consent from years ago to justify a new purpose today.
The Person Has Capacity
The person must be able to understand and communicate their decision. As a general rule, the OAIC suggests businesses may assume a person aged 15 or over has capacity, unless something indicates otherwise.
When Do You Need Data Consent?
You do not need consent for every use of personal information. Knowing when it matters helps you avoid both collecting pointless consents and missing the ones that count.
Sensitive Information
You generally need consent to collect sensitive information. This category includes health information, biometric data, racial or ethnic origin, religious beliefs, sexual orientation and criminal records. In practice, always seek express consent for this type of information.
Using Information for a New Purpose
If you collected information for one purpose, you usually need consent to use or disclose it for a different one. There are exceptions, such as where the person would reasonably expect the new use and it relates to the original purpose.
Direct Marketing
The direct marketing rules are more detailed. You can sometimes use personal information for marketing without express consent, but you must always offer a simple way to opt out. Separately, the Spam Act 2003 (Cth) generally requires consent before you send commercial emails or text messages.
Sending Information Overseas
Sending personal information overseas, including to some cloud providers, triggers extra obligations. Consent is one way to manage this, but only if you first expressly tell the person that, if they consent, you will not be required to take reasonable steps to ensure the overseas recipient complies with the APPs, and you may not be accountable for how it handles their information.
Data Consent and AI
AI tools have made data consent more complicated. Many businesses now use chatbots, transcription tools and analytics platforms that process customer or employee information. Each of these tools raises questions about how you collect, use and disclose that data. (Note that private sector employers are exempt from the APPs for current and former employee records handled in connection with the employment relationship, but this exemption is narrow.)
Using Commercial AI Products
The OAIC’s guidance on commercially available AI products sets out the regulator’s expectations. As a matter of best practice, the OAIC recommends that businesses do not enter personal information, particularly sensitive information, into publicly available generative AI tools. It also recommends due diligence before you choose an AI product and a privacy impact assessment before you roll it out.
Similarly, think carefully before you use existing customer data to train or improve an AI system. Check whether that use matches the purpose you originally collected the data for. If it does not, you will likely need fresh consent.
New Rules on Automated Decisions
From 10 December 2026, new transparency rules apply to businesses that use computer programs to make decisions about people. Suppose a program uses personal information to make a decision, or to do something substantially and directly related to making a decision, that could reasonably be expected to significantly affect someone’s rights or interests. In that case, your privacy policy must explain the kinds of personal information used and the kinds of decisions involved. The OAIC has updated its APP 1 guidance to cover the new requirements.
These rules focus on transparency rather than consent. Even so, they make it much harder to use personal information quietly inside automated systems. If you use AI to approve applications, screen job candidates or set prices, review your privacy policy now. Our guide to AI and data privacy laws covers this area in more detail.
Practical Steps to Get Data Consent Right
A few simple habits will put your business in a strong position:
- Map the personal information you collect and where it goes.
- Use clear, separate consent requests for different purposes.
- Seek express consent for sensitive information.
- Keep records of when and how each person consented.
- Make it easy for people to withdraw consent.
- Review your privacy policy whenever your practices change.
Good consent practices also reduce your exposure if something goes wrong. For example, they can help if you face a notifiable data breach or a claim under the new statutory tort for serious invasions of privacy.
How Allied Legal Can Help
Our data and privacy lawyers help businesses design consent processes, update privacy policies and prepare for the new automated decision rules. If your business builds or uses AI, our AI lawyers can review your tools and data flows against your privacy obligations.
To discuss data consent in your business, call us on 03 8691 3111 or email hello@alliedlegal.com.au.
Frequently Asked Questions
1. What is data consent?
Data consent is a person’s agreement to a business collecting, using or disclosing their personal information. Under Australian privacy law, it can be express or implied. It must also be informed, voluntary, current and specific, and given by someone with capacity.
2. Is implied consent enough?
Sometimes. Implied consent may work for routine, low-risk uses. For sensitive information or unexpected uses, you should seek express consent.
3. Can someone withdraw their consent?
Yes. A person can withdraw consent at any time, and you should make that easy. Once they withdraw it, stop using their information for that purpose.
4. Do the new automated decision rules apply to my business?
They apply to businesses covered by the Privacy Act that use computer programs to make decisions, or to do things substantially and directly related to making decisions, which could reasonably be expected to significantly affect people’s rights or interests. If you are unsure, map your systems and get advice before 10 December 2026.
This article is provided for general information only and does not constitute legal advice. You should obtain legal advice specific to your circumstances before acting on any information contained in this article.
