OAIC, generative AI training guidance: de-identifying personal information is itself a use for a secondary purpose (Office of the Australian Information Commissioner, Guidance on privacy and developing and training generative AI models, 'Using de-identified information')
A holder that de-identifies records before a licence is itself making a use of personal information for a secondary purpose, so the APP 6 test (consent, or reasonable expectation and relatedness) applies to the de-identification step too. The OAIC says de-identification is context dependent and robust governance is needed.
Dated 18 Oct 2026Source checked 18 Oct 2026Basis: primary text
In the source's own words
“Developers using de-identified information will need robust de-identification governance processes. ... De-identifying personal information is a use of the personal information for a secondary purpose.”
Where it was read
Also read from the same source
- OAIC, Guidance on privacy and developing and training generative AI models (October 2024): AI training as a secondary purpose (Office of the Australian Information Commissioner, Guidance on privacy and developing and training generative AI models (published 21 October 2024))
- OAIC, generative AI training guidance, Example 3: a bank giving customer queries to a developer (Office of the Australian Information Commissioner, Guidance on privacy and developing and training generative AI models, Example 3)
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in this guide