No, DeepSeek’s hosted app is not an appropriate default for broker client files because it processes and stores personal data in China. Australia’s federal government restriction covers government systems and devices. Private use is a separate question, and locally running an open model changes where the information goes.
Is DeepSeek Banned in Australia?
Yes, DeepSeek is banned on Australian Government systems and devices under Protective Security Policy Framework Direction 001-2025. That direction does not impose a general ban on private Australians using DeepSeek.
The Secretary of the Department of Home Affairs issued the direction in 2025 to address an unacceptable security risk to government. The official directions register requires government entities to prevent access, use or installation and remove existing instances. The restriction includes web services, so using a browser does not avoid it on a covered system.
For a private brokerage, the government direction does not itself decide whether staff can use DeepSeek. The brokerage’s own security policy and contractual obligations still apply. An aggregator or licensee can prohibit a tool even when private use is lawful.
A broker can therefore distinguish two decisions. Personal experimentation with a fictional question is outside the federal government-device prohibition. Uploading a client’s loan file requires a separate assessment of privacy and confidentiality obligations.
What DeepSeek Collects and Where It Goes
DeepSeek’s privacy policy says it collects prompts and account information, with personal data stored in China. It describes user content as including “text input, voice input” alongside uploaded files, photos and chat history.
The policy also lists device identifiers, IP addresses, usage logs and approximate location. Some collection depends on the service used. It states that it will “collect, process and store your Personal Data in People’s Republic of China”.
DeepSeek lists model training and service improvement among its uses of personal data. It allows sharing with service providers and its corporate group. Its legal-disclosure clause permits access, preservation and sharing for applicable law, legal process or government requests, subject to the clause’s conditions.
For a broker, the relevant exposure includes information inside an uploaded document. A client’s income details remain personal information even when the prompt itself contains no client name. Treat uploading the document as sending its contents to the service.
DeepSeek and Client Information
Sending identifiable client information to DeepSeek creates an overseas-disclosure issue for a brokerage covered by the Privacy Act. The information can also face uses and access beyond the brokerage’s direct control. Keep real client files out of the hosted service.
The Office of the Australian Information Commissioner (OAIC) recommends that organisations avoid putting personal information into publicly available generative AI tools. Its commercial AI guidance also requires attention to how the provider uses information and who receives it.
Under Australian Privacy Principle 8 (APP 8), an entity generally must take reasonable steps before overseas disclosure to ensure the recipient handles information consistently with the principles. The brokerage can remain accountable for the recipient’s mishandling. The OAIC’s APP 8 guidance explains the rule and its exceptions.
Consent is not a shortcut around that assessment. If relying on the specific APP 8 informed-consent exception, the brokerage must first explain that APP 8.1 will not apply.
Explain that the brokerage would not be accountable under the Privacy Act if the overseas recipient mishandles the information. The client would lose redress under that Act for that mishandling. Then obtain valid consent. Other privacy duties still apply.
What Clients Need to Be Told
A brokerage’s privacy policy must describe likely overseas disclosures and identify the countries where practicable. Its collection notice must also address likely overseas recipients and their locations where practicable. For this hosted service, China is a known destination. The OAIC explains these duties in its privacy-policy guidance and collection-notice guidance.
Explain the actual proposed use in language a client can understand. Name the service and the information it would receive. Describe the purpose of the upload and overseas handling, including any training use or access that affects the decision. A generic reference to technology suppliers does not explain a specific request for informed consent.
In a hypothetical case, a broker wants help rewriting an email about a borrower’s changed employment. Pasting the original thread transfers client details and third-party information. Write a fresh example using fictional circumstances instead, and leave the original correspondence in the approved client system.
Running DeepSeek Models Locally
A DeepSeek open model can run on a local computer without sending prompts to DeepSeek when the software performs inference locally and external services are disabled. Inference means the model processes your prompt and generates the response. Downloading model files is separate from uploading a client file to the hosted chatbot.
DeepSeek’s published R1 repository includes local-running guidance and smaller downloadable models. The model name alone does not establish local processing. A desktop app can still call a cloud service, send telemetry or use online search.
The brokerage must assess the complete setup before introducing client information. That assessment covers the application’s network connections and any cloud fallback, plus access to saved conversations and backups. A fictional task that works with network access blocked helps establish that its processing can stay local.
Local processing removes the transfer to DeepSeek only if the configured system keeps the information local. It leaves the brokerage responsible for device security and the accuracy of the output. A model can still invent a fact or follow malicious instructions inside a document.
Use the local setup only after the brokerage accepts those controls. Until then, keep DeepSeek work to public information and fictional examples, with client records in the brokerage’s approved systems.
