Selling company data to AI companies from Australia

This guide covers Australian law for an Australian company licensing records to an AI buyer, usually in the US. The ownership and contract questions are in our guide to whether you can legally sell company data, and de-identification methods are in our guide to de-identification for AI training data.

Which privacy law and regulator apply in Australia?

The Privacy Act 1988 and its 13 Australian Privacy Principles apply to personal information in records an Australian company licenses, and the Office of the Australian Information Commissioner regulates them. The OAIC says the Act covers Australian Government agencies, organizations with annual turnover of more than $3 million and some other organizations.

Small businesses lose their exemption if they trade in personal information. The OAIC's APP guidelines say a small business operator is covered if it discloses personal information about someone for a benefit, service or advantage, unless it has consent or legal authority. A data license is exactly that kind of disclosure.

The Privacy and Other Legislation Amendment Act 2024 received Royal Assent on December 10, 2024. MinterEllison reports that it created a statutory tort for serious invasions of privacy from June 2025 at the latest, gave the OAIC infringement and compliance notice powers from December 11, 2024 and requires privacy policies to disclose automated decisions from December 10, 2026.

What has the OAIC said about AI training?

The OAIC has said that using personal information you already hold to train an AI model is a secondary use under APP 6, which needs consent or an exception. Its Guidance on privacy and developing and training generative AI models, published on October 21, 2024, says that in many cases it will be difficult to establish that such a secondary use was within reasonable expectations.

• Developers should not rely on a broad consent to handle information in line with a privacy policy
• Notices should name AI training specifically, not broad or vague purposes such as research
• An organization disclosing customer data to a developer for AI training needs its own APP 6 basis
• De-identification is context dependent and may be difficult to achieve, and de-identifying is itself a use of the information

The guidance also recommends contract terms on privacy compliance and asking for information about the source of personal information. Expect Australian and overseas buyers to ask for both.

Notice is a separate duty. The OAIC says that having information in a privacy policy is not a means of meeting the obligation to notify individuals under APP 5, so an updated policy alone does not tell customers or staff that their data may be licensed for AI training.

Do you need consent to license customer and employee records?

You will usually need consent, or a clear exception, to license customer records that still contain personal information. APP 6 permits secondary disclosure where people would reasonably expect it and it is related to the original purpose, and the OAIC's guidance says AI training rarely meets that test. Most sellers de-identify or exclude personal information instead.

Employee records have an exemption, but it is narrow. The OAIC says the exemption covers a private sector employer's acts directly related to a current or former employment relationship and an employee record. Its own example of an act outside the exemption is selling a list of employees to another organization for marketing.

The exemption also does not cover job applicants, volunteers or contractors who handle staff data. Licensing staff records to an AI buyer should therefore be assessed under the APPs, with advice.

You disclose personal information to a US buyer under APP 8, which has no list of approved countries. APP 8.1 requires an organization to take reasonable steps before disclosure to ensure the overseas recipient does not breach the APPs, and the OAIC generally expects an enforceable contract to do that.

Section 16C makes the Australian entity accountable for the overseas recipient's acts that would breach the APPs, even if it took reasonable steps. APP 8.2 lists exceptions, including a reasonable belief that the recipient is bound by a substantially similar law with an enforcement mechanism, and informed consent after the individual is told APP 8.1 will not apply. Data that is de-identified before export avoids these rules.

Does Australian copyright law affect a license?

Australian copyright law supports licensing, because the government has ruled out a text and data mining exception for AI training. MinterEllison reports that Attorney-General Michelle Rowland said in a media release on October 26, 2025 that the government does not support introducing one.

The Attorney-General's Department then consulted, through its Copyright and Artificial Intelligence Reference Group, on fair and legal ways to use copyright material in AI, according to MinterEllison. For sellers, that means AI companies need permission to train on Australian content they do not own, which strengthens the case for a paid license.

Does a US buyer withhold tax on payments to an Australian seller?

A US buyer must generally withhold 30% on US-source royalties paid to a foreign seller unless a treaty reduces the rate, according to IRS Publication 515, which sources royalties where the property is used. IRS Tax Treaty Table 1 shows a 5% rate for royalties paid to Australian residents under Article 12(2) of the Australia-US treaty, claimed on Form W-8BEN-E.

For GST, the ATO says supplies of services and rights can be GST-free exports when they are used or enjoyed outside Australia, or made to a non-resident who is not in Australia when the supply is made, but not when the service is provided in Australia. It points to GSTR 2019/1 for the detailed rules. Take tax advice, and see our guide to tax on AI data license payments.

Which buyers accept sellers from Australia?

Few buyers in our directory name Australia. AWS's seller eligibility guide lists Australia as an eligible jurisdiction for paid products on AWS Data Exchange. micro1 prioritizes the US, UK and Canada and says other regions may still be considered, and it prefers mainly English-language records.

What are Australia's rules at a glance?

What should an Australian seller do before licensing?

An Australian seller should decide early whether personal information will be de-identified or excluded, because consent for a secondary use is hard to collect after the fact. The steps below follow the OAIC materials cited above.

1. 1

   Confirm coverage

   Check your turnover against the $3 million threshold, remembering that trading in personal information removes the small business exemption.

2. 2

   Map the purposes

   Record why each dataset was collected and what notices said, then test AI licensing against APP 6.

3. 3

   Treat staff records as covered

   Assume the employee records exemption does not apply to a license and assess staff data under the APPs.

4. 4

   De-identify by a documented method

   De-identify what you keep, test it in context and exclude what cannot be de-identified reliably.

5. 5

   Contract for APP 8

   Where personal information remains, bind the overseas buyer to APP-compliant handling, breach response and deletion.

Our vetting standard checks these points before any buyer sees a sample. For a view of likely buyers, a realistic range and the rights issues to clear first, request a free data valuation.