Running AI on the device is one of the most effective privacy controls an engineering team has. Data that never leaves the device can't leak from a server, be sent overseas or be reused for another purpose. It isn't a legal exemption, though. This guide sets out how the Australian Privacy Principles (APPs) shape an edge AI design, and what on-device processing does and doesn't change.
This is general information for engineers and product teams, not legal advice. Get advice from a privacy lawyer for your situation.
When the Privacy Act applies
The Australian Privacy Principles are the core of the Privacy Act 1988 and apply to organisations and agencies covered by the Act. Many small businesses with annual turnover of $3 million or less are exempt, but the OAIC lists exceptions, including health service providers and businesses that trade in personal information. Check the OAIC's small business guidance before assuming you're out of scope.
Edge AI often handles exactly the kind of data the Act cares about. The OAIC lists photographs, voice prints and facial recognition biometrics as examples of personal information. Some biometric information is also sensitive information, which carries a higher level of protection: the OAIC's facial recognition guidance states that biometric information and templates used for automated verification or identification are sensitive information.
The principles that shape an edge design
APP 3: collect only what's reasonably necessary
Under APP 3, an organisation may only collect personal information that is reasonably necessary for its functions or activities, and the OAIC's guidelines say that being helpful or convenient isn't enough. Sensitive information generally needs consent as well. For a camera system, that's an argument for detecting what you need (a person in a zone, a missing hard hat) rather than identifying who someone is.
Inference can itself be collection. The OAIC's guidance on commercially available AI products says that generating or inferring personal information with AI counts as a collection under APP 3.
APP 6: use it only for the purpose it was collected for
Footage collected for safety alerts can't simply be repurposed, for example for performance management or to train a model for another product, without working through APP 6. Edge processing helps because purpose is easier to enforce when the data never reaches a shared server.
APP 8: sending data overseas
If personal information goes to a cloud service hosted offshore, cross-border obligations come into play. Keeping inference on the device, or on servers in Australia, reduces how often the question arises. The OAIC's APP 8 guidelines explain the obligations in detail.
APP 11: security, deletion and de-identification
APP 11 requires reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. Since the 2024 amendments, the Act states that reasonable steps include technical and organisational measures. Organisations must also destroy or de-identify personal information they no longer need. On a device, that translates into short retention buffers, encryption and an automatic deletion schedule.
APP 1: transparency, including automated decisions
From 10 December 2026, organisations that use computer programs to make decisions, or to do things substantially and directly related to making them, where those decisions could significantly affect someone's rights or interests, must describe this in their privacy policy. The OAIC has published resources on the new obligation. An edge system that decides whether someone may enter a site, for example, could fall within it.
What on-device processing changes, and what it doesn't
| Question | Cloud-first design | On-device design |
|---|---|---|
| Where do raw images or audio go? | Streamed or uploaded to a server | Processed in memory and discarded, unless an event triggers retention |
| What leaves the site? | Raw data plus results | Results, counts and selected event clips |
| Cross-border exposure (APP 8) | Depends on hosting region and provider | Lower, if only results leave and they go to Australian hosting |
| Breach surface | A central store of raw data | Distributed devices holding little data |
| Is it still a collection under APP 3? | Yes | Yes, if the device captures or infers personal information |
| Consent for biometrics | Required unless an exception applies | Still required unless an exception applies |
The last two rows are where teams get caught out. Processing on the device reduces risk; it doesn't take the system outside the Act.
A practical reference architecture
- Capture to memory, not disk. Frames or audio sit in a short rolling buffer for inference and are continuously overwritten.
- Detect, don't identify, by default. Output classes and positions ("person in exclusion zone") rather than identities, unless identification is the purpose and you have a lawful basis for it.
- Minimise at the source. Crop, blur or mask faces and number plates on the device before anything is stored or sent.
- Send events, not streams. Transmit structured results and, where justified, short event clips with a defined retention period.
- Encrypt and authenticate. Encrypt storage and links, sign firmware and model updates, and lock down debug ports.
- Automate deletion. Enforce retention limits on both the device and the server, and log deletions.
- Keep personal data out of retraining by default. If field data is needed to improve the model, collect it under a separate, documented process with its own purpose and safeguards.
De-identification is a judgement, not a switch
Teams often assume blurred footage or aggregate counts are automatically anonymous. The OAIC's de-identification guidance calls it "a risk management exercise, not an exact science": information is de-identified when the risk of re-identification in its release context is very low, and that depends on the context. A count of one person in a small zone at 2 am may identify them; the same count in a busy terminal may not.
Facial recognition and biometrics
The OAIC's facial recognition guidance, published in November 2024, asks organisations to weigh necessity and proportionality, consent and transparency, accuracy and bias, and governance. On-camera recognition, the approach Xailient takes so that images need not go to the cloud, reduces how much biometric data moves around. It doesn't remove the need to justify using facial recognition in the first place.
Private inference for generative AI
The OAIC recommends that organisations don't enter personal information, and particularly sensitive information, into publicly available generative AI tools. For teams that need language or vision models on sensitive data, running the model on their own hardware is one answer. Vedametric builds private inference where, in its words, nothing leaves your network, and compresses models to run on a single GPU, a phone or a microcontroller.
Start with a privacy impact assessment
The OAIC describes a privacy impact assessment as a systematic assessment of a project that identifies potential privacy impacts, with recommendations to manage, minimise or eliminate them, and says it should be part of project planning. For edge AI, the cheapest time to do it is before the hardware is designed. Decisions such as whether a device can store raw footage at all are far easier to make on a whiteboard than after manufacture. For the wider design trade-offs, see edge AI vs cloud AI.
FAQ
- Is data processed only on a device still personal information?
- It can be. If the device captures or infers information about an identifiable person, the Privacy Act can apply even if nothing is uploaded. The OAIC treats personal information generated or inferred by AI as a collection under APP 3. On-device processing lowers risk, but it isn't an exemption.
- Does on-camera facial recognition avoid the need for consent?
- No. Biometric information used for automated verification or identification is sensitive information, which generally needs consent unless an exception applies. Processing on the camera helps with security and data minimisation, not with the legal basis for collecting it. Get legal advice.
- What changes for automated decisions on 10 December 2026?
- From that date, privacy policies must describe the kinds of personal information used, and the kinds of decisions made, by computer programs that make or substantially support decisions that could significantly affect individuals. The OAIC has published resources on the requirement.
- Are small businesses exempt from the Privacy Act?
- Many businesses with annual turnover of $3 million or less are, but not all. Health service providers, businesses that trade in personal information and some others are covered regardless of turnover. Check the OAIC's small business guidance.