Australia Privacy Act and Live Chat: APP Guide

The Australia Privacy Act and live chat meet the moment a visitor types a name, an e-mail address or a description of their problem into your chat widget. That text is personal information, and if your business is covered by the Act, the Australian Privacy Principles (APPs) apply to how you collect, use, store and disclose it.

This guide explains who is covered, which principles matter most for a website chat with an AI assistant, how to handle cross-border processing, data breaches and requests for access, and what to configure in Talkmio. It is practical guidance, not legal advice, so check your own obligations with a qualified adviser or the regulator.

Does the Australia Privacy Act Apply to Your Live Chat?

The Privacy Act 1988 covers Australian Government agencies and many private organisations. A major test for businesses is turnover. The Office of the Australian Information Commissioner (OAIC) defines a small business as one with an annual turnover of 3 million Australian dollars or less, and such businesses are generally outside the Act.

There are important exceptions. According to the OAIC’s small business guidance, a small business must still comply if it provides a health service, trades in personal information, is a contracted service provider for a Commonwealth contract, is a reporting entity under anti-money laundering law, or is related to a larger covered body corporate, among other cases. If you opted in voluntarily, the Act applies too.

Overseas businesses with Australian visitors

The Act can also reach organisations outside Australia that carry on business in Australia and collect personal information there. If you sell to Australians and your turnover passes the threshold, assume the principles apply and plan accordingly.

Even if you are exempt

Many small businesses follow the principles anyway, because customers expect it and because partners, such as larger companies and government clients, often ask for it in contracts. A chat that behaves well costs little and avoids awkward questions later.

The Principles That Matter Most for Live Chat

There are 13 Australian Privacy Principles, described in the OAIC’s Australian Privacy Principles overview. Not all of them affect a chat widget equally. These are the ones to check first.

Principle	In plain words	What it means for live chat
APP 1: open and transparent management	Have a clear, current privacy policy	Mention the chat, the data it collects and who processes it
APP 3: collection	Collect only what you need	Keep the pre-chat form short; ask only for what you use
APP 5: notification	Tell people when you collect their data	Link your privacy policy from the chat or the welcome text
APP 6: use and disclosure	Use data for the purpose it was collected	Do not reuse chat data for unrelated marketing
APP 8: cross-border disclosure	Take care when data goes overseas	Know which providers process chats and where
APP 11: security	Protect data and delete what you no longer need	Control access, set retention and delete old chats
APP 12 and 13: access and correction	Let people see and correct their data	Be able to find a person’s conversations and export them

The table is a map, not a checklist you can sign off from a blog post. Use it to decide where to look in your own setup.

What Personal Information a Chat Collects

List what the chat records before you write any policy text. In Talkmio, a conversation includes the messages, the contact details a visitor enters, and context in your Inbox such as IP address, country, device, browser, source and pages viewed. The Contacts section keeps everyone who ever wrote to you, with their conversation history. Tickets add a number, a priority and a status.

Each of these items belongs in your records of what you hold. A visitor can also type things you did not ask for: health details, financial hardship, a government ID number. Your instructions and your team’s habits should discourage that. Tell Mio in the business instructions not to ask for sensitive details and to hand over when a visitor offers them.

APP 1 and APP 5: Say What the Chat Does

Your privacy policy should mention the chat in language a visitor can follow. State that conversations are recorded, what kinds of information are collected, why you use them, who can see them and how long you keep them. Add that an AI assistant answers questions, and that conversation text is processed by a service provider to produce answers.

APP 5 asks you to notify people about collection at or before the time you collect the data. A link to the privacy policy in the chat’s welcome text is a practical way to do it. Under Websites in Talkmio you can edit the welcome text, and the pre-chat form can be none, optional or required. If you require an e-mail before chatting, the notice should be visible before that step. Our guide to the live chat privacy policy contains a section-by-section outline.

APP 8: Overseas Processing and AI Providers

APP 8 matters because many chat tools use infrastructure or AI providers outside Australia. Before you disclose personal information to an overseas recipient, you generally need to take reasonable steps to make sure the recipient does not breach the principles. Ask any vendor, in writing, four questions.

Which providers process the conversation text, and for what purpose?
What data goes to the AI model provider? Talkmio sends only the conversation text and relevant knowledge base excerpts there.
Who can access conversations inside the vendor?
How do you export or delete data, and how long does deletion take?

Keep the answers with your records. They are the evidence of reasonable steps if anyone asks. The wider question of where data is kept is discussed in our article on data residency for live chat.

APP 11: Security, Retention and Deletion

You must take reasonable steps to protect personal information and to destroy or de-identify it when you no longer need it. For chat, three habits cover most of this.

Limit who can see chats. In Talkmio, Agents handle conversations, Admins also manage websites, Mio, channels and settings, and the Owner handles billing. Give people the lowest role they need.
Set a retention rule. Decide how long you keep conversations. Plans keep different history lengths: 30 days on Free, 365 days on Pro and unlimited on higher plans. Delete what you no longer need, and note your rule in your policy.
Keep sensitive details out. Instruct the team not to ask for card numbers or passwords in chat, and see our guide on live chat data retention.

Data Breaches: Know Your Reporting Duty

Under the Notifiable Data Breaches scheme, an organisation covered by the Act must notify affected individuals and the OAIC when a breach is likely to result in serious harm. The OAIC explains the scheme on its notifiable data breaches page. A data breach is unauthorised access, unauthorised disclosure or loss of personal information.

For a chat, the realistic risks are a stolen team password, a former employee who still has access, or a mistaken export sent to the wrong person. Reduce them with unique passwords, quick removal of leavers from the Team section and care with exports. Write a one-page response plan: who decides, who notifies, and where the vendor’s contact is.

Australia Privacy Act and Live Chat: A Setup Checklist for Talkmio

Use this list when you configure a new site, or when you audit an existing one. Each item maps to a principle above and to a setting you can find in the app.

Privacy policy updated. It mentions the chat, the information collected, the purpose, the AI assistant and the service providers involved (APP 1).
Notice at the point of collection. The welcome text under Websites links to the policy. If the pre-chat form is required, the link is visible before the visitor submits it (APP 5).
Short pre-chat form. Set it to none or optional unless you truly need the field (APP 3).
Instructions that avoid sensitive data. Mio is told not to ask for ID numbers, bank details, passwords or health information, and to hand the conversation to a person if the visitor volunteers them (APP 3 and APP 11).
Vendor answers on file. You hold written answers about which providers process chat text and how deletion works (APP 8).
Roles reviewed. Only people who need Admin rights have them, and leavers are removed from the Team section straight away (APP 11).
Retention rule written down. Your policy says how long conversations are kept, and someone deletes older ones on schedule (APP 11).
Access routine tested. Search a test contact in the Inbox, open the history in Contacts and practise the export (APP 12 and 13).
Breach plan on one page. It names who decides, who contacts the OAIC and affected people, and how to reach the vendor.

Review it twice a year

Privacy settings drift. Staff change, features are added and policies go stale. Put a recurring reminder in your calendar to repeat the checklist every six months, and after any major change to your site or your chat setup. Keep a dated note of what you checked, because a simple record shows that you take your duties seriously. Our guide to GDPR and live chat has a similar routine, which helps if you also serve visitors in Europe.

APP 12 and 13: Access and Correction Requests

People can ask what you hold about them and ask you to correct it. To answer quickly, you need to find a person’s conversations. In Talkmio, the Inbox searches by name, e-mail, text or ticket number, and Contacts holds the history for each person. Decide who handles these requests, how you confirm identity before sharing anything, and how you export the record. Talkmio lets you export or delete data on request. Our guide to data subject access requests in live chat works through the steps, and the same routine fits Australian requests.

Frequently Asked Questions

Does the Australia Privacy Act apply to my website chat?

It applies if your organisation is covered by the Act. Businesses with an annual turnover above 3 million Australian dollars are generally covered, and some smaller businesses are covered regardless, for example health service providers and those trading in personal information. Check the OAIC small business guidance or ask an adviser.

Is a chat conversation personal information?

Usually yes. A conversation can include a name, an e-mail address and details about a person’s circumstances, and an Inbox may also show IP address, country and device. Treat the whole record as personal information, list it in your records and mention the chat in your privacy policy.

Do I need to tell visitors an AI answers their chat questions?

Being open about it is good practice and fits APP 1 and APP 5, which require clear notice about how you handle personal information. Say in your privacy policy that an AI assistant answers questions and that a service provider processes conversation text. A clear label also builds trust with visitors.

What does APP 8 mean for AI chat tools?

APP 8 concerns disclosing personal information to overseas recipients. Ask your chat vendor which providers process conversations, what data reaches the AI model provider and how data can be exported or deleted. With Talkmio, only conversation text and relevant knowledge base excerpts go to the AI model provider.

How should I handle an access request for chat data?

Confirm the person’s identity, search the Inbox by name, e-mail or text, check Contacts for the conversation history and export the record. Reply within the time your policy and the law require. Talkmio lets you export or delete data on request, and your own process should say who does it.

Can I keep chat history forever?

You should keep personal information only as long as you need it. Set a retention rule, note it in your policy and delete older conversations. Talkmio plans keep 30 days on Free, 365 days on Pro and unlimited history on higher plans, so choose a plan and a rule that match your needs.

The Bottom Line

For the Australia Privacy Act and live chat, the working routine is short: confirm whether the Act covers you, mention the chat in a clear privacy policy, keep the pre-chat form lean, ask vendors where data goes, limit access and retention, and know how to answer access requests and breaches. This is guidance, not legal advice. Create a free Talkmio account and review the chat settings against the principles above.

Australia Privacy Act and Live Chat: What Businesses Must Do