Tech Suite | AI, data and disclosure: Is your privacy policy keeping up?

Send us your feedback In this episode, privacy law specialists Richard Wells and Suzy McMillan discuss practical steps organisations can take to ensure their privacy policies remain fit for purpose in the face of growing AI use. \[01:21] Richard asks how the Privacy Act 2020 framework, and in particular Information Privacy Principle (IPP) 3, applies when organisations use AI. Suzy explains that the key starting point is determining whether AI is actually being used to process personal information, as this will trigger privacy obligations pursuant to the Act. \[03:06] Richard and Suzy discuss whether different types of AI require different levels of disclosure, noting that low-risk productivity tools generally impose a lesser disclosure burden than AI used for decision-making, eligibility assessments, or credit scoring purposes. \[04:42] Suzy and Richard talk through the practical information organisations should include in their privacy policies, including acknowledging the use of AI and explaining its purpose in plain language, clarifying who processes the personal data, and being transparent about whether data may be used to train or improve AI models. \[06:37] They then consider the AI guidance from the Office of the Privacy Commissioner (OPC) and the important role Privacy Impact Assessments (PIAs) play in ensuring privacy policies accurately reflect how AI tools process personal information. \[08:49] Suzy talks through the privacy implications of AI model training and secondary use of personal information, highlighting the importance of reviewing vendor contracts to ensure any AI providers' data practices align with an organisations privacy policy. \[11:42] Richard and Suzy close out the episode by considering what good AI disclosure should look like in practice and the key steps organisations should undertake to bring their privacy policy up to standard, including conducting thorough PIAs, reviewing vendor terms, ensuring compliance against IPP 3, and training staff on the appropriate use of AI tools. *Information in this episode is accurate as at the date of recording, 3 July 2026.* Please contact Richard Wells, Suzy McMillan or our Technology team if you need legal advice and guidance on any of the topics discussed in the episode. And don’t forget to rate, review or follow *MinterEllisonRuddWatts* wherever you get your podcasts. You can also email us directly at [techsuite@minterellison.co.nz](mailto:techsuite@minterellison.co.nz) and sign up to receive technology updates via your inbox here. Additional resources  Privacy Act 2020 Biometrics Processing Privacy Code 2025 Tech Suite | How to comply with IPP12: Cross border disclosures of personal information AI-and-the-Information-Privacy-Principles (September 2023) | Office of the Privacy Commissioner.pdf Does the Office of the Privacy Commissioner approve or endorse Artificial Intelligence providers? (November 2025) | Office of the Privacy Commissioner For show notes and additional resources visit minterellison.co.nz/podcasts