What personal information is in construction documents?
More than the contracts suggest. Subcontractor files hold names, phone numbers, licence numbers and insurance details. Induction records list individual workers. NSW subcontractor's statements refer to wages and payroll tax. Incident reports describe injuries. Site photos show people. The OAIC says privacy obligations apply to any personal information put into an AI system, and to output that contains personal information. Map which document types in the proposed workflow contain personal information before deciding what the service may read.
Does the Privacy Act apply to your business?
The OAIC says most small businesses with annual turnover of $3 million or less are not covered by the Privacy Act, but some are regardless of turnover. One listed category is a contractor that provides services under a Commonwealth contract, which matters to builders working on federal projects. Turnover for this purpose includes all income from all sources. The OAIC publishes a privacy checklist for small business. Even if the Act does not cover you, your head contracts may impose confidentiality and privacy terms that any provider must also meet.
Where are the files processed and stored?
Ask the provider to name the countries where your documents and the model processing sit, including any sub-processors. Under Australian Privacy Principle 8, before an organisation covered by the Act discloses personal information to an overseas recipient, it must take reasonable steps to ensure the recipient does not breach the APPs, and it is generally accountable for what the recipient does with the information. Exceptions exist, so get advice on your situation. A provider that cannot tell you where processing happens cannot help you meet that obligation.
Will your documents be used to train a model?
Ask, and get the answer in the contract. Business and API terms from model providers commonly differ from consumer terms, so check which apply. The larger risk is often inside your own business: staff pasting documents into free chatbots. The OAIC recommends, as best practice, that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools. A short written rule for staff covering what may and may not be pasted into which tools is worth adopting before any automation project starts.
Ask for the provider's data processing terms before any demonstration with real documents. Until they are agreed, use made-up or redacted examples. Remember that commercial information needs protecting too: tender prices, subcontract rates and the client's design documents are usually confidential under your contracts even when they contain no personal information.
Who can access the documents and the outputs?
The OAIC lists who will have access to personal information put into or generated by an AI product as part of the due diligence a business should do. Access questions apply to the provider's staff, to its sub-processors and to your own people, because a shared login or an over-broad project permission lets people see records they do not need. Ask the provider these questions and expect specific answers rather than a link to a general security page.
- Which of the provider's staff can see your documents, and under what conditions?
- Can access be limited to the projects in scope?
- Are actions logged, and can you review the logs?
- How is access removed when a staff member or project finishes?
What happens if there is a data breach?
Under the Notifiable Data Breaches scheme, an organisation covered by the Privacy Act must notify affected individuals and the OAIC when a data breach is likely to result in serious harm to someone whose personal information is involved. If a provider holding your documents has a breach, you need to know quickly to meet that duty. Ask how and how fast the provider will tell you, what information it will give, and put that in the contract. Ask what happens to your documents when the contract ends and how deletion is confirmed.