# AI and privacy law: GDPR, PIPEDA, and the Privacy Act > What UK GDPR, the EU GDPR, PIPEDA and Quebec's Law 25, Australia's Privacy Act, and US rules require before a small business puts personal data into AI tools. None of the **privacy law** we read in the UK, the EU, Canada, Australia, or the US bans AI tools as such, but each controls the personal data you put into them: a lawful reason, information for the people concerned, a contract with the AI provider, care with data leaving the country, and an assessment before high-risk uses. Several rules changed in 2026, in the UK, the EU, and Australia. **Key takeaways** 1. Since September 30, 2026, UK GDPR refers to the Information Commission, the successor to the Information Commissioner's Office. 2. Quebec's privacy law requires a privacy impact assessment and a written agreement before personal information is communicated outside Quebec, including to a service provider. 3. From December 10, 2026, Australian businesses covered by the Privacy Act must describe in their privacy policy the computer programs that make or help make significant decisions about people. ## Privacy law and AI tools, country by country Treat the AI provider as any other company you hand personal data to: have a reason, tell people, sign a contract, check where the data goes, and assess the risky uses first. That is the legal side of [the rules for using AI at work](/guides/ai-at-work/data-and-rules/), summarized from the laws and regulators' guidance as of November 10, 2026. It is not legal advice, and the laws have exceptions this page cannot cover. ### The five questions every law asks 1. **Why are you using the data?** A lawful basis or purpose, and no reuse beyond what people would reasonably expect. 2. **Did you tell people?** Your privacy notice should mention AI providers, transfers abroad, and automated decisions. 3. **Is there a contract with the provider?** The AI company should act as your service provider, with a data processing agreement. 4. **Where does the data go?** Most AI providers process data outside your country. 5. **Is the use high-risk?** Decisions about people, such as hiring or credit, call for an assessment first and human involvement. ### UK Under UK GDPR, you may only use processors that give [sufficient guarantees](https://www.legislation.gov.uk/eur/2016/679/article/28), under a written contract that covers instructions, confidentiality, security, and deletion at the end. The Data (Use and Access) Act 2025 rewrote the rules on international transfers and on automated decisions, with most changes in force from February 5, 2026: a significant decision taken solely by automated means now requires safeguards, including telling the person, letting them comment, and giving them access to human intervention. A data protection impact assessment is required before high-risk processing, “in particular using new technologies.” Businesses with fewer than 250 employees are exempt from keeping records of processing, unless the processing is risky, regular, or involves sensitive data. Since September 30, 2026, the law refers to the Information Commission, created by the 2025 Act to succeed the Information Commissioner's Office. ### EU, if you have European clients The EU GDPR applies to a business outside the EU that offers goods or services to people in the EU, or monitors their behavior there, and it usually requires a representative in the EU. Fines reach €20 million or 4% of worldwide annual turnover for the most serious breaches. In December 2024, the European Data Protection Board said that an AI model trained on unlawfully processed data could make its later use unlawful, unless the model is truly anonymous. ### Canada Under PIPEDA, a business stays responsible for personal information it gives a service provider, must ensure comparable protection by contract, and should tell customers that their data may be processed in another country. The privacy commissioners' [principles for generative AI](https://www.priv.gc.ca/en/privacy-topics/technology/artificial-intelligence/gd_principles_ai/) say to enter personal or confidential information in a prompt only where authorized. Quebec goes further. Its private-sector law requires a privacy impact assessment for any new information system involving personal information, and an assessment plus a written agreement before personal information is communicated outside Quebec, including to a provider. People must be told when a decision about them is based exclusively on automated processing. Federal reform is still a bill: C-27 died in January 2025, and its successor, C-36, the Protecting Privacy and Consumer Data Act introduced on June 15, 2026, was at second reading as of November 10, 2026. ### Australia The Privacy Act does not cover most businesses with an annual turnover of A$3 million or less, but the exceptions are long, from health service providers to businesses that trade in personal information; check the OAIC's list. For covered businesses, the OAIC's [guidance on commercial AI products](https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/guidance-on-privacy-and-the-use-of-commercially-available-ai-products) says the Act covers both what you put in and what comes out; generating personal information counts as collecting it; access by the AI developer is a disclosure to mention; and, as good practice, personal information should not go into public AI tools. From December 10, 2026, privacy policies must describe the computer programs that make or help make significant decisions about people. ### US The US has no single comprehensive federal privacy law; Congress has passed laws by sector, and at least 19 states had general consumer privacy laws by August 2025, according to the Congressional Research Service. California's law applies to businesses above thresholds such as $26.625 million in annual revenue, and its rules on automated decision-making technology apply to significant decisions from January 1, 2027. The FTC has warned AI companies that they must keep their privacy promises, such as not training on customer data, and that quietly changing their terms to use data more widely may be unfair or deceptive. Health data handled for a HIPAA-covered entity requires a business associate agreement with the provider. ### In practice - Use a business plan with a data processing agreement for anything involving personal data. - Update your privacy notice to mention AI providers and transfers. - Assess before using AI for decisions about people, and keep a human in those decisions. - Check sector rules if you work in health, finance, or law. ### The client side of the question Privacy law is about people's data; professional confidentiality covers more. See [what regulators say about client information and AI](/guides/ai-at-work/data-and-rules/confidential-information/). ### The EU's AI-specific law The EU also has a law on AI itself, separate from GDPR, with obligations for businesses that use AI. See [what the AI Act means for small businesses](/guides/ai-at-work/data-and-rules/eu-ai-act/).