AI and the Privacy Act: Cross-Border Disclosure When Students' Answers Go Offshore

When an RTO sends a student's written assessment response to an offshore AI marking or feedback tool, and that response contains personal information, the transmission is a cross-border disclosure that triggers Australian Privacy Principle 8 before the data leaves the country, not after. ASQA has published no specific guidance on this intersection, but the Privacy Act 1988 is clear, and the obligation sits squarely inside the Standard 4.1 governance framework and the Standard 4.3 risk system. This article maps the exposure, corrects a common misconception about how the major AI platforms handle data, and sets out what it means for RTOs, their governing persons and the students whose answers go offshore.

The Question Every AI-Curious RTO Must Answer

A participant at a recent ASQA webinar raised a question every RTO evaluating AI marking or feedback tools needs to answer: when student assessment responses are sent to offshore AI providers, and those responses contain personal information, what are the cross-border disclosure obligations under the Privacy Act? ASQA has published no specific guidance on this intersection. The Privacy Act 1988 (Cth), however, is not silent. Before personal information is disclosed to an overseas recipient, the Australian Privacy Principle 8 obligation is triggered, and for RTOs that obligation sits inside the Standard 4.1 governance framework and the Standard 4.3 risk management system. An RTO that has not mapped this exposure has not satisfied either Standard.

1. The Problem in Concrete Terms

Consider the scenario that generated the question. An RTO is evaluating AI-assisted marking to reduce assessor workload, improve consistency and speed up feedback. The tool integrates with the learning management system: when a student submits a written response, the tool sends that response to the AI platform's servers for processing, and the platform returns a score or feedback suggestions that an assessor reviews before finalising the competency judgement. The scenario is practical, commercially attractive and increasingly common. It is also, in almost every current implementation, a cross-border personal information disclosure, because the major commercial AI platforms process data on infrastructure located outside Australia, often in the United States, although some enterprise and cloud-hosted deployments now offer regional data residency that must be checked vendor by vendor.

The legal consequences do not depend on how the RTO characterises the transaction. They do not turn on whether a data processing agreement has been signed, whether the vendor calls itself a processor rather than a controller, or whether the student's name is in the transmitted data. If the information transmitted can be used to identify the student, or is associated with an identifier that lets the platform build a profile, it is personal information under the Privacy Act, and the cross-border rules apply. This is not a risk on the horizon. It is a present obligation that many RTOs evaluating or deploying AI assessment tools have not fully addressed.

2. What the Privacy Act Requires: Australian Privacy Principle 8

The Privacy Act applies to RTOs that are APP entities. An APP entity is, broadly, an organisation with annual turnover above three million dollars, an organisation that provides a health service and holds health information, or an organisation otherwise covered, including certain Commonwealth contractors. The turnover threshold means many RTOs, particularly those operating at scale or receiving substantial government funding, are APP entities, and RTOs contracted to deliver services on behalf of the Commonwealth or a state agency may be covered regardless of turnover. The threshold itself is on borrowed time: the small business exemption is slated for removal under the current Privacy Act reform programme, with that change expected to take effect around the end of 2026, which would bring most RTOs within the Act regardless of turnover. RTOs that are not APP entities may also fall under state or territory privacy legislation applying equivalent standards. The prudent course is to treat the obligation as applying now, because for most RTOs it already does and for the rest it soon will.

For APP entities, the cross-border obligation sits in Australian Privacy Principle 8, within Schedule 1 of the Act. Before an APP entity discloses personal information to an overseas recipient, it must take reasonable steps to ensure the recipient does not breach the APPs in relation to that information. The exception is where the entity reasonably believes the recipient is subject to a law or binding scheme that protects the information in a way at least substantially similar to the APPs, and there are mechanisms available to the individual to enforce that protection. The practical effect is significant: where an RTO transmits student personal information to an overseas AI platform and cannot point to a binding law or scheme providing substantially similar protection, the RTO remains accountable for any interference with privacy the overseas recipient causes.

Most AI platform vendors operate under their own terms of service and, where applicable, frameworks such as the European Union's GDPR. Whether any of these provides protection substantially similar to the APPs, and whether an enforcement mechanism is available to Australian students, is a question the RTO must assess before transmitting personal information. It cannot be assumed from the existence of a vendor privacy policy.

3. How Student Assessment Data Qualifies as Personal Information

Personal information is information or an opinion about an identified individual, or an individual who is reasonably identifiable. Whether the data sent to an AI marking platform qualifies depends on what is included and what can be inferred. In most implementations, the data includes the student's written response. Where the task requires the student to write about their own professional experience, workplace observations or learning history, as good assessment design under Standard 1.4 tends to require, the response may be inherently identifying even without a name. More commonly, the transmission also includes metadata: an API call typically carries the assessment task, the unit of competency and a student identifier such as a student number. The combination of the response and an identifier that can be matched back to the RTO's records is personal information; the student is reasonably identifiable, and the APP 8 obligation is triggered.

There are also categories of sensitive information that attract heightened protection: health, disability, racial or ethnic origin, cultural background, religious beliefs, political opinions, sexual orientation and criminal record, among others. Where assessment content touches these, as it may across community services, health and sport and recreation qualifications, the transmitted data may be sensitive information, which attracts additional obligations under APP 3, including express consent to collection, and those obligations extend to the cross-border disclosure under APP 8.

4. The Link to Standard 4.1 Governance and Standard 4.3 Risk

Standard 4.1 requires the organisation and its governing persons to be fit and proper, to act diligently and make informed decisions that facilitate compliance, and to lead a culture of integrity, fairness and transparency. These obligations are not confined to the Outcome Standards themselves; they extend to all applicable law, including the Privacy Act. A governing person unaware that the RTO's AI deployment creates a Privacy Act exposure, or aware but not acting on it, is not exercising the diligence Standard 4.1 demands. Standard 4.3 reinforces the point: it requires the organisation to identify, manage and review risks to students, staff and the organisation, and a cross-border disclosure exposure is a risk to students, whose information is at stake, and to the organisation, which faces legal and regulatory consequences. APP 8 exposure belongs in the Standard 4.3 risk register with documented controls.

There is also a link to Standard 2.1, which requires information provided to students to be clear, accurate and accessible. Where personal information is transmitted to an overseas AI platform, students should be informed of the practice, both as a matter of Privacy Act compliance and of Standard 2.1. The collection notice required under APP 5 must describe the purposes for which personal information is collected, and the countries to which it may be disclosed, and that notice forms part of the pre-enrolment information the student receives.

5. Mapping Vendor Data Flows Before Deployment

The factual foundation of APP 8 compliance is a data flow map: a documented understanding of what personal information is transmitted, in what form, for what purpose, by what mechanism, to what jurisdiction, under what terms, with what retention and deletion, and with what security controls. It should be completed before any AI marking or feedback tool is deployed, updated whenever the configuration, the vendor's terms or the data categories change, and reviewed within the Standard 4.4 continuous improvement cycle on a schedule proportionate to the risk.

A data flow map is not a one-time exercise. Vendor terms change, sometimes without prominent notice; data categories expand as configurations evolve; and processing jurisdictions shift as vendors restructure. A map accurate at deployment will not stay accurate without periodic verification.

6. Assessing Substantially Similar Protection

The APP 8 exception requires a reasonable belief that the recipient is subject to a law or binding scheme protecting the information in a way substantially similar to the APPs. That is a legal assessment, not a commercial one, and it cannot be resolved by reading a vendor's privacy policy. The major US-based providers are not subject to a federal privacy law providing comprehensive protection substantially similar to the APPs: the United States operates a sectoral framework, with laws for specific data categories such as health information under HIPAA and financial information under the Gramm-Leach-Bliley Act, but no general federal privacy law of the kind the APPs represent. Some vendors point to participation in the APEC Cross-Border Privacy Rules system or to GDPR-based contractual clauses as evidence of substantially similar protection. Whether these satisfy the Australian test is not definitively settled, and the OAIC has published guidance on APP 8 that RTOs should consult alongside legal advice.

The consequence of this uncertainty is that an RTO cannot assume APP 8 compliance from a vendor's participation in any framework without making the assessment itself. If it cannot satisfy itself that substantially similar protection exists, it must either obtain the student's informed consent before transmitting their data, under the consent exception in APP 8, or implement technical controls, principally genuine de-identification, so that the transmitted information cannot identify the individual.

7. The Misconception About Training, and the Clauses That Matter

A common misconception is that the major AI platforms use everything submitted to them to train their models. For the commercial offerings most relevant to an RTO deploying a marking or feedback tool, the API and enterprise tiers of the major providers, the position is generally the reverse. By default, data submitted through these commercial channels is not used to train the provider's models, retention is limited, often to a short window for abuse monitoring, and zero-data-retention arrangements are available to qualified enterprise customers. The training-by-default risk is real, but it attaches mainly to the consumer and some paid-individual tiers of these products, where submitted data may be used for model improvement by default or on an opt-out basis and retained for far longer. The practical lesson is that the data-handling profile depends heavily on both the vendor and the product tier. An RTO should prefer a commercial API or enterprise agreement with documented no-training and limited-retention terms over a consumer-tier integration, verify the specific tier's terms before deployment, because they vary between vendors and change over time, and still confirm the key protections contractually.

The vendor agreement is the primary instrument through which the RTO exercises any control over offshore data, and an agreement that omits the matters below leaves the RTO exposed to the section 16C liability regardless of the agreement's existence.

8. De-identification, and the APEC-Region Question

A question raised at the webinar was whether RTOs must ensure AI providers store data in the APEC region. The answer is nuanced. APEC-region storage does not automatically satisfy the substantially similar protection test, because the APEC Cross-Border Privacy Rules framework is voluntary, not all member economies have equivalent privacy laws, and storage location does not determine which laws govern the processing. Where a vendor holds APEC Cross-Border Privacy Rules certification, and data is processed only within economies whose frameworks provide substantially similar protection, that may help support the reasonable-belief test, but it does not establish it by itself.

The more reliable response, where substantially similar protection cannot be established, is genuine de-identification before transmission. If the data sent to the platform cannot identify any individual, it is no longer personal information for Privacy Act purposes and APP 8 does not apply. A de-identification workflow for AI marking would strip all direct identifiers (name, student number, date of birth, contact details) from the response, review the content for indirect identifiers (specific employers, locations, supervisors or other people that could enable re-identification), transmit the de-identified response under a pseudonymous transaction code the RTO keeps internally, and receive the output under that code for the assessor to link back. This adds operational complexity and is not feasible for every assessment type, particularly where the response is inherently tied to the student's identity by its content. In those cases, the options are to obtain express informed consent or not use the offshore platform for that assessment.

9. Building It Into the Standard 4.3 Risk Register

The cross-border disclosure risk must be documented in the Standard 4.3 risk register. The entry should describe the specific exposure (transmission of student personal information to an overseas AI platform without adequate assurance of substantially similar protection under APP 8), and rate it for likelihood and severity. The consequence of a substantiated breach includes an OAIC determination, civil penalty proceedings (which for serious or repeated breaches can reach tens of millions of dollars), reputational damage, student complaints, and findings affecting ASQA audit outcomes under Standard 4.1. Since mid-2025, individuals also have a direct statutory right to sue for serious invasions of privacy, adding a further liability channel beyond regulatory action.

The controls should document the steps taken: the data flow map, the vendor clauses, the substantially similar protection assessment, the student notification in the collection notice and pre-enrolment materials, the de-identification workflow where applicable, and the professional development given to staff who operate the tools. Each control should have an owner, a review date and a way of testing its effectiveness. The residual risk, after controls, should be assessed, and a documented decision made by governing persons about whether it sits within the organisation's risk appetite. That is a governing person decision under Standard 4.1: an RTO that has deployed AI marking without governing persons making and recording an informed decision about the Privacy Act exposure has a Standard 4.1 gap regardless of how good its technical controls are. Finally, the entry should specify monitoring and review, who watches for changes to vendor terms, how staff are kept current, and what triggers an out-of-cycle review, integrated into the Standard 4.4 continuous improvement system.

10. What This Means for RTOs

For an RTO weighing an AI marking or feedback tool, the work falls in a clear order.

First, decide before you deploy, not after. Map the data flow, identify the recipient jurisdiction, assess substantially similar protection, and have governing persons make and document a decision about the residual risk. The APP 8 obligation is owed at the point of disclosure, so the analysis belongs before the first student response is transmitted.

Second, choose the tier and the terms deliberately. Prefer a commercial API or enterprise agreement with documented no-training and limited-retention terms over a consumer-tier integration, lock purpose limitation, deletion, subprocessor, security and breach-notification clauses into the contract, and, where substantially similar protection cannot be established, use genuine de-identification or express informed consent. The vendor and the tier, not the marketing, determine the privacy profile.

Third, govern it as a standing risk, not a one-off. Put the exposure in the Standard 4.3 register, assign and test the controls, and review it through the Standard 4.4 cycle as vendor terms, the reform landscape and the RTO's own operations change. With the small business exemption due to fall and the framework tightening, the exposure will only grow more relevant.

11. Conclusion: Accountability Travels With the Data

The appeal of AI marking is genuine, and nothing in the Privacy Act forbids it. What the Act forbids is sending a student's identifiable answers offshore without first taking responsibility for what happens to them. The accountability travels with the data: under section 16C, the RTO that made the disclosure decision bears the consequence of the recipient's handling, and no vendor agreement transfers that back. The reassuring part, often missed, is that the commercial tiers of the major platforms are frequently better on this than their reputation suggests, with no-training defaults and limited retention, so the responsible path is usually available. The unreassuring part is that it has to be chosen, assessed and documented, not assumed.

Good assessment design and good privacy governance are not in tension; they are the same discipline applied to the same data. The RTO that maps the flow, chooses the right tier, assesses the protection, governs the residual risk and tells its students what happens to their answers can adopt AI with confidence. The one that transmits first and asks later has not saved itself work. It has simply moved the work to the point where it is hardest to do and most expensive to get wrong.

References and Further Reading

Privacy Act 1988 (Cth), Australian Privacy Principles 3, 5, 8 and 11; section 16C; and the Notifiable Data Breaches scheme in Part IIIC. Federal Register of Legislation.

Office of the Australian Information Commissioner. Australian Privacy Principles Guidelines (APP 8, cross-border disclosure) and guidance on de-identification.

Office of the Australian Information Commissioner. Notifiable Data Breaches scheme guidance.

Federal Register of Legislation (2025). National Vocational Education and Training Regulator (Outcome Standards for NVR Registered Training Organisations) Instrument 2025, Outcome Standards 1.4, 2.1, 4.1, 4.3 and 4.4.

Attorney-General's Department. Privacy Act Review and the Privacy and Other Legislation Amendment program (small business exemption and automated decision-making reforms).

This article provides general information about the intersection of Australian privacy law and RTO compliance obligations and is not legal advice. RTOs dealing with specific AI deployments, Privacy Act assessments or vendor negotiations should seek advice from a qualified legal practitioner with expertise in Australian privacy law and RTO compliance.