AI is only as fair, accurate and trustworthy as the data behind it. Data ethics is about the decisions you make before and around an AI system: what data you collect, whether you should use it for this purpose, who it affects, and how you'd explain the outcome to the person on the other end.
This article covers where data ethics shows up in AI projects, what Australian law and guidance expect, and practical steps to get it right. For the broader picture of adopting AI responsibly, including the National AI Centre's six essential practices, see our article on AI for business.
Where data ethics shows up in AI
- Purpose and consent: data collected to deliver a service isn't automatically fair game for training a model or profiling customers. Using it for something new generally needs consent, or must be within what people would reasonably expect.
- Bias in history: a model learns from past decisions, including their unfairness. If past approvals, hires or prices were skewed, a model trained on them will be too, only faster.
- Where the data came from: scraped web content and third-party data sets can carry errors, outdated information and personal information collected without people's knowledge.
- Transparency: people affected by an automated decision should be able to find out that it was automated, and how to question it.
- Accuracy: AI output can be wrong but sound convincing. A false statement about a real person is still personal information about them.
- Security: training data, prompts and outputs can expose sensitive information if access isn't controlled.
What Australian law and guidance expect
Australia doesn't have a standalone AI law. The National AI Plan, published in December 2025, relies on existing, technology-neutral laws supported by voluntary guidance. For data, the most important of those laws is the Privacy Act 1988:
- The Privacy Act applies to AI. In October 2024 the OAIC published two guides: one on using commercially available AI products, and one on developing and training generative AI models. The developer guide highlights the principles on transparency, collection, notification, use and quality of personal information, and makes clear that publicly available data isn't automatically fair to use for training.
- The 2024 reforms raised the stakes. The Privacy and Other Legislation Amendment Act 2024 added a statutory tort for serious invasions of privacy and, from 10 December 2026, requires privacy policies to explain when personal information is used in automated decisions that significantly affect people.
- Voluntary guidance sets the benchmark. Australia's AI Ethics Principles and the Guidance for AI Adoption describe what responsible use looks like, from fairness and privacy to human oversight.
A useful test: if you had to explain to a customer exactly how their data trained or fed this system, and what it decided about them, would you be comfortable? If not, rethink the data before you build.
Practical steps for ethical data in AI
- Know your data. List the data each AI use relies on: where it came from, what it contains and whether it includes personal or sensitive information.
- Check the purpose. Confirm each data set can be used for this purpose, or get consent.
- Use only what you need. Minimise, and de-identify where you can, before data goes near a model.
- Assess the impact. Run a privacy impact assessment for higher-risk uses, and consider who could be treated unfairly.
- Test for bias. Compare results across groups before launch, not after a complaint.
- Document it. Record the data sources, known limitations and intended use of each model or AI system.
- Keep people involved. Make sure a person can review, explain and override decisions that significantly affect someone.
- Monitor and review. Check accuracy and fairness over time, as data and behaviour change.
Not sure where you stand? Take our free AI readiness checklist. Our AI consultants build responsible guardrails into every project, and our data governance team can set up the ownership and controls your data needs.
