Is Claude safe for company data in Australia? | satori.

Is Claude safe for company data? That's the question we hear most often from Australian founders and IT managers, usually right after someone senior has asked them first. And it deserves a real answer, not a shrug and a "probably".

So here's the real answer: what Anthropic already handles for you, where your data actually goes, what the Privacy Act 1988 and the Australian Privacy Principles expect from your side, and the practical steps to a rollout you could defend to your board, your biggest client, or the OAIC.

No jargon. Promise.

---

Is Claude safe for company data? The short answer

Yes, with two conditions.

One: use Claude under Anthropic's commercial terms (Team, Enterprise or the API), not a free consumer account. Two: do a modest amount of homework at your end. Most of it is common sense written down.

And here's the thing nobody says out loud. The anxiety usually isn't about Claude at all. It's about not being able to answer the question when someone senior asks it. A director, an auditor, your biggest client's procurement team. This guide exists so you can answer calmly.

One more thing worth saying early, because honesty builds trust faster than reassurance: the OAIC's enforcement record to date is about data breaches and careless data handling at scale, think large leaks and reckless retention, not about employees using an AI assistant under commercial terms¹. That doesn't make the Privacy Act optional. It tells you where the real risk sits. We'll get there.

---

What does Anthropic already handle for you?

Before you build anything yourself, know what you're actually buying. A surprising amount of the work is already done.

No training on your business data. Under the commercial terms, Anthropic does not train models on your prompts or files². This is the single fact that defuses most boardroom worry, and it's contractual, not a marketing line³.

Certifications you can hand to an auditor. SOC 2 Type II, ISO 27001, and ISO/IEC 42001, the newer international standard for AI management systems⁴. Copies are available through Anthropic's Trust Portal.

Admin controls that behave like the ones you know. SSO, workspaces per team, centralised user management, and audit logs on Enterprise. The same admin patterns as Microsoft 365 or Google Workspace, which is exactly what the APPs' "reasonable steps" language wants to see.

One setting to check on day one. If someone clicks thumbs up or thumbs down on a response, that feedback data can be retained by Anthropic for up to five years⁵. Turn feedback submission off in your organisation settings if you handle anything sensitive. It's a toggle, not a negotiation.

And a bit of local context, because it matters for the "is this vendor serious about Australia" question: Anthropic opened a Sydney office in 2026, signed a memorandum of understanding with the Australian Government on 31 March 2026, the first under the National AI Plan⁶, and Australians are among the world's top per-capita Claude users. This is not a vendor treating Australia as an afterthought.

---

Where does your company data actually go?

This is the APP 8 question, and it's the one to get right.

APP 8 says that before you disclose personal information to an overseas recipient, you must take reasonable steps to ensure the recipient doesn't breach the APPs. And under section 16C of the Privacy Act, you generally stay accountable for what happens to that information after it leaves⁷. Your data, your responsibility, even offshore⁸.

So where does Claude process data? Two answers.

Claude via claude.ai and the API: processed in the US

By default, Claude processes data in the United States. That is not forbidden. APP 8 doesn't ban overseas disclosure, it regulates it. Your reasonable steps are exactly the things above: commercial terms, the no-training commitment, the security certifications, and your own privacy policy telling people that personal information may be disclosed to providers in the US. For most businesses and most use cases, this is a well-trodden, defensible path. You're already doing it with your email provider.

Claude on AWS Bedrock in Sydney: the onshore option

If data residency is a hard requirement, from your regulator, your enterprise clients, or your own risk appetite, Claude also runs on Amazon Bedrock in the Sydney region (ap-southeast-2). With the Australia-geography inference profiles (the au. prefix), Bedrock processes the inference request within Australian regions for the entire request lifecycle⁹.

That's the honest map. US by default, onshore when you need it. What you should never do is pretend the question doesn't exist.

---

Does the Privacy Act even apply to your business?

Here's the nuance most articles skip. Businesses with annual turnover of A$3 million or less are generally exempt from the Privacy Act¹⁰.

Before you close this tab: the exemption is narrower than it sounds, and shrinking. You're covered regardless of turnover if you provide a health service and hold health information, if you trade in personal information, or if you're a contracted service provider on a Commonwealth contract. Tax file numbers are regulated at any size under the TFN Rule. Job applicant data doesn't enjoy the employee records exemption. And the quiet one that catches most growing companies: your larger clients increasingly flow privacy obligations down through contracts, exemption or not.

Our advice is boring and correct: act as if you're covered. The reform direction points that way anyway, and everything in this guide is work you'd want done regardless.

---

Six steps to a defensible Claude rollout

The practical part. Eight to twelve hours total, spread over two weeks part-time.

Step 1: Map what goes in (1 to 2 hours). List your intended use cases and, for each, whether personal information could end up in a prompt. Minimise where you can. De-identified data is your friend.

Step 2: Update your privacy policy (1 to 2 hours). Add a paragraph noting that you use AI tools, that personal information may be disclosed to providers in the US, and which kinds. This covers your APP 8 and APP 1 transparency duties. It's an addition, not a rewrite.

Step 3: Write a one-page AI use policy (1 to 2 hours). What's allowed, what's conditional, what's never OK. Use the National AI Centre's Guidance for AI Adoption, the six voluntary practices, as your reference frame¹¹. It even ships with a policy template.

Step 4: Configure Claude for Work (30 minutes). SSO and MFA on. Workspaces per team. Feedback submission off. Retention settings reviewed. Audit logs on if you're on Enterprise.

Step 5: Train the prompt-hygiene habit (2 to 3 hours). Four questions before pasting: Is it health or other sensitive information? Stop. Is it bulk data, hundreds of rows? Stop and document first. Does the task actually need the person's name? If not, de-identify. Would you say it on stage at a conference? If not, think again.

Step 6: Write a data breach playbook (1 to 2 hours). Under the Notifiable Data Breaches scheme you have 30 days to assess a suspected eligible breach, and you notify the OAIC and affected individuals if serious harm is likely¹². Write down who does what before you need it. A page is enough.

---

What is the ADM deadline on 10 December 2026?

One genuinely new obligation is coming, and it's worth getting ahead of. From 10 December 2026, if you use personal information in automated decision-making that could significantly affect someone's rights or interests, your privacy policy must say so: what kinds of personal information are used, and what kinds of decisions are made¹³. The OAIC plans to publish its guidance around September 2026.

For most Claude use, a human reading a draft, summarising a document, analysing a spreadsheet, this isn't ADM. It becomes relevant the day you automate decisions about people: credit, hiring, claims, pricing. If that's on your roadmap, put the disclosure wording in your privacy policy update now, in step 2, and you're done early instead of scrambling in November.

---

How big is the risk, really?

Let's be concrete, because vague fear is what stalls good projects.

Australia has no AI Act. The proposed mandatory guardrails were shelved in December 2025 in favour of the National AI Plan¹⁴, with the voluntary Guidance for AI Adoption as the governance reference¹¹. So the legal frame for Claude at work is the Privacy Act. Full stop. Don't let anyone import EU obligations into your risk register.

The penalties are real, the pattern is specific. Serious or repeated interference with privacy can cost up to A$50 million or more since the 2022 amendments. But look at what actually draws enforcement: large-scale breaches, reckless retention, data handling failures¹. Not a 20-person firm using Claude Team with sensible rules.

The actual risk is shadow AI. The biggest exposure we see isn't the company that rolls Claude out properly. It's the company that bans it, and then discovers half the staff have been pasting client documents into free consumer accounts for a year. No admin controls, no policy, no visibility. The fix is the rollout, not the ban.

---

When should you call a lawyer?

Some situations deserve professional advice, and pretending otherwise is false economy:

• Health information at any real scale
• Children's data
• Automated decisions that affect individuals: credit, hiring, insurance
• Connecting Claude to entire systems, a whole CRM or mailbox, rather than curated folders
• Commonwealth contracts with specific privacy clauses

Everything else, the normal business use of Claude described above, is territory where a practical partner saves you time and missteps.

---

Want a hand with the rollout?

Privacy Act readiness is a project, not a permanent state. This guide gets you far if you want to run it yourselves. But the real value is rarely the documents. It's going from "we know we should" to "ten people are using Claude on Tuesday morning" without losing a quarter to internal debate.

Our satori-launch does exactly that: webinar, full-day workshop and your first skills rolled out, A$990 per user one-time (from 8 users), with the privacy settings configured properly from day one. If you want the ongoing side handled too, licences, support, optimisation, that's satori-claude. Prefer to build the habit first? Start with Claude training. Or just book a chat. No slides, just coffee and an honest conversation about where you actually stand. Sydney-based? We're your local AI consultant.

---

Sources

Footnotes

1. OAIC (2026). Australian Privacy Principles. https://www.oaic.gov.au/privacy/australian-privacy-principles ↩ ↩²

2. Anthropic (2026). Is my data used for model training? https://privacy.claude.com/en/articles/10023580-is-my-data-used-for-model-training ↩

3. Anthropic (2026). Commercial Terms of Service. https://www.anthropic.com/legal/commercial-terms ↩

4. Anthropic (2026). What certifications has Anthropic obtained? https://privacy.claude.com/en/articles/10015870-what-certifications-has-anthropic-obtained ↩

5. Anthropic (2026). How long do you store my data? https://privacy.claude.com/en/articles/10023548-how-long-do-you-store-my-data ↩

6. Anthropic (2026). Australian government and Anthropic sign MOU for AI safety and research. https://www.anthropic.com/news/australia-MOU ↩

7. OAIC (2025). APP Guidelines, Chapter 8: APP 8 Cross-border disclosure of personal information. https://www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-guidelines/chapter-8-app-8-cross-border-disclosure-of-personal-information ↩

8. Federal Register of Legislation (2026). Privacy Act 1988 (Cth). https://www.legislation.gov.au/C2004A03712/latest ↩

9. AWS (2025). Introducing Amazon Bedrock cross-Region inference for Claude in Japan and Australia. https://aws.amazon.com/blogs/machine-learning/introducing-amazon-bedrock-cross-region-inference-for-claude-sonnet-4-5-and-haiku-4-5-in-japan-and-australia/ ↩

10. OAIC (2025). Small business. https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/organisations/small-business ↩

11. National AI Centre, Department of Industry, Science and Resources (2025). Guidance for AI Adoption. https://www.industry.gov.au/publications/guidance-for-ai-adoption ↩ ↩²

12. OAIC (2025). Part 4: Notifiable Data Breach (NDB) Scheme. https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/preventing-preparing-for-and-responding-to-data-breaches/data-breach-preparation-and-response/part-4-notifiable-data-breach-ndb-scheme ↩

13. OAIC (2026). Consultation on Guidance for Transparency in Automated Decision Making. https://www.oaic.gov.au/engage-with-us/consultations/consultation-on-guidance-for-transparency-in-automated-decision-making ↩

14. Department of Industry, Science and Resources (2025). National AI Plan. https://www.industry.gov.au/publications/national-ai-plan ↩