Australia
Australian privacy and AI governance.
Australian Privacy Principles
How the architecture supports the 13 APPs.
Under the Privacy Act 1988, your organisation stays responsible for the personal information it handles. Because PromptLeash runs in your environment and nothing comes back, PromptLeash does not become another organisation holding that information.
Each statement below explains how the architecture supports your obligations under that principle. Whether and how each principle applies depends on your organisation and the information involved.
APP 1
Open and transparent management of personal information
The Trust Centre describes what PromptLeash reads, where it runs and who can see what, so you can describe the processing accurately in your privacy policy. If you use the evidence to make, or directly support, decisions that could significantly affect individuals, the new automated decision-making disclosures that apply to privacy policies from 10 December 2026 may be relevant.
APP 2
Anonymity and pseudonymity
Manager and executive views show aggregated results, and only for groups that meet the minimum group size. Individuals are represented by pseudonyms in the analysis, and because pseudonymised information can still be personal information, it stays in your environment under your access controls. Individual results are shown only to the individual.
APP 3
Collection of solicited personal information
You decide which sources are in scope and how far the scope extends, so you can limit collection to what is reasonably necessary for the purpose you set. Interaction content is read only within the agreed scope.
APP 4
Dealing with unsolicited personal information
AI interactions can contain personal information that nobody asked for, such as customer details pasted into a prompt. That information stays in your environment, where your own retention and deletion standards apply.
APP 5
Notification of the collection of personal information
PromptLeash provides notice templates as part of deployment, to help you tell people what is collected, why, and who can see what.
APP 6
Use or disclosure of personal information
Nothing comes back to PromptLeash, so using it does not disclose personal information to us. Inside your organisation, role-based access keeps each audience to the view that matches its purpose.
APP 7
Direct marketing
PromptLeash receives no personal information from your deployment, so it has none to use for direct marketing.
APP 8
Cross-border disclosure of personal information
PromptLeash runs in your environment and sends nothing back, so it adds no overseas disclosure of its own.
APP 9
Adoption, use or disclosure of government related identifiers
Individuals are represented by pseudonyms in the analysis. If government related identifiers, such as tax file numbers, appear in interaction content, they stay in your environment under your controls.
APP 10
Quality of personal information
Role and workflow mappings and findings are validated with the people who know the work, which helps keep the evidence accurate, up to date and relevant before it informs decisions.
APP 11
Security of personal information
PromptLeash runs inside your environment under your security standards, identity, access and logging. Updates ship one way and nothing comes back, so PromptLeash holds none of your personal information outside your environment.
APP 12
Access to personal information
The information stays in your environment, so you can respond to access requests through your own processes. Individuals can also see their own results in their individual view.
APP 13
Correction of personal information
Role and workflow mappings are reviewed with the people who know the work, and the information stays in your environment, so corrections can be made through your own processes.
Frameworks
Frameworks PromptLeash supports evidence for.
Meeting each framework remains your organisation's responsibility. PromptLeash supports evidence for parts of each one by showing how AI is used across roles and workflows, and how capability is developing.
Digital Transformation Agency
Policy for the responsible use of AI in government
Version 2.0 applies to non-corporate Commonwealth entities, with some exceptions, from 15 December 2025. Its mandatory requirements include accountable officials, transparency statements, internal AI use case registers and staff training on AI.
Evidence PromptLeash supports
How approved AI tools are used across roles and workflows, to inform your transparency statement and use case register, and to show where staff training is needed.
APS AI Plan 2025
APS AI training goals
The plan makes foundational AI training mandatory for all APS staff through the AI in government policy, and introduces Chief AI Officers to lead adoption in each agency.
Evidence PromptLeash supports
How AI capability is developing by role and workflow after training, so Chief AI Officers can see where people need more support.
National AI Centre
Guidance for AI Adoption
Published in October 2025, it sets out six essential practices for responsible AI adoption, including deciding who is accountable, measuring and managing risks, testing and monitoring, and maintaining human control.
Evidence PromptLeash supports
Ongoing evidence of how AI is used across roles and workflows, which supports measuring and managing risks, and testing and monitoring.
APRA
CPS 234 Information Security
Requires APRA-regulated entities to maintain an information security capability commensurate with the threats to their information assets, and to implement and test controls.
Evidence PromptLeash supports
How information is handled in approved AI tools against your policies, from a deployment that runs under your own security controls.
APRA
CPS 230 Operational Risk Management
In effect since 1 July 2025, it requires APRA-regulated entities to manage operational risk, maintain critical operations through disruption and manage material service providers.
Evidence PromptLeash supports
How AI tools are used across roles and workflows, to inform your view of critical operations and service provider dependencies. PromptLeash itself runs in your environment and sends nothing back.
AI management system standard
ISO/IEC 42001 clauses
Clauses relevant to AI use include 7.2 (competence), 7.3 (awareness) and 9.1 (monitoring, measurement, analysis and evaluation), with the Annex A controls for the use of AI systems (A.9).
Evidence PromptLeash supports
Competence and awareness by role, and ongoing measurement of how AI systems are used.
Take PromptLeash through your review.
Book a demo to see PromptLeash with your team, or request the security pack for your security review.