Australia Privacy Act Compliance

Australian Privacy Principles

The Privacy Act contains 13 Australian Privacy Principles (APPs).

They cover:

• Open and transparent management of personal information
• Anonymity and pseudonymity
• Collection of solicited personal information
• Dealing with unsolicited personal information
• Notification of the collection of personal information
• Use or disclosure of personal information
• Direct marketing
• Cross-border disclosure of personal information
• Adoption, use or disclosure of government-related identifiers
• Quality of personal information
• Security of personal information
• Access to personal information
• Correction of personal information

The APPs apply throughout the personal-information lifecycle, from collection through use, disclosure, storage, security, access, correction, and destruction.

Consent Under the Australian Privacy Act

The Australian Privacy Act does not operate as a blanket opt-in consent law.

Consent is important in particular situations, including the collection of sensitive information and certain uses or disclosures. For ordinary non-sensitive personal information, organizations may in some circumstances rely on implied consent or other permitted grounds.

Consent is not required for every collection, use, or disclosure of personal information.

The requirements depend on the type of information and the processing activity.

For example, organizations generally need express consent before handling sensitive information. For non-sensitive personal information, express consent is not always required, although the organization must have a reasonable basis for any implied consent it relies upon.

Consent should be:

• Voluntary
• Current
• Specific
• Informed
• Understandable
• Capable of being withdrawn where applicable

Organizations should avoid unclear or bundled consent requests that prevent individuals from understanding which processing activities they are agreeing to.

Sensitive Information

The Privacy Act provides additional protection for sensitive information.

Sensitive information includes categories such as:

• Racial or ethnic origin
• Political opinions
• Political associations
• Religious beliefs or affiliations
• Philosophical beliefs
• Trade-union membership
• Sexual orientation
• Criminal record
• Health information
• Genetic information
• Biometric information used for automated biometric verification or identification
• Biometric templates

Organizations generally need the individual's consent to collect sensitive information unless an applicable exception applies.

Because sensitive information carries additional privacy risks, organizations should maintain separate controls for its collection, use, disclosure, retention, and security.

Privacy Notices and Collection Notices

APP 5 requires organizations to take reasonable steps to notify individuals, or ensure they are aware, of specified matters when collecting personal information.

Relevant information can include:

• Identity and contact details of the organization
• The fact and circumstances of collection
• Whether collection is required or authorized by law
• Purpose of collection
• Consequences of not providing information
• Intended disclosures
• Overseas disclosures
• Relevant privacy-policy information
• How individuals can access or correct their information
• How privacy complaints can be made

Privacy notices should be clear, accessible, and appropriate for the circumstances.

Privacy Policy Requirements

APP 1 requires covered organizations to maintain a clearly expressed and up-to-date privacy policy.

The policy should explain how the organization manages personal information and provide information such as:

• Types of personal information collected
• How information is collected
• Purposes of collection, use, and disclosure
• Overseas disclosures
• Access and correction procedures
• Complaint procedures
• Privacy governance information
• Other matters required by the APPs

The policy should be available free of charge in an appropriate form, generally through the organization's website.

Data Minimization and Purpose Limitation

Organizations should collect personal information only where reasonably necessary for their functions or activities.

They should assess:

• What information is being collected
• Why it is required
• Whether less information could achieve the same purpose
• How the information will be used
• Who will receive it
• How long it will be retained

Organizations should also avoid using or disclosing information for purposes that are incompatible with the original collection purpose unless the APPs permit the additional use or disclosure.

Direct Marketing Under APP 7

APP 7 places specific restrictions on using and disclosing personal information for direct marketing.

Generally, an organization must not use or disclose personal information for direct marketing unless an applicable exception applies.

Where direct marketing is permitted, individuals must have an effective way to opt out. Organizations must give effect to valid opt-out requests within a reasonable period. OAIC guidance indicates this would generally be no more than 30 days, although digital communications may allow a faster response.

Organizations should therefore maintain:

• Marketing consent or permission records where applicable
• Opt-out preferences
• Suppression lists
• Preference synchronization
• Third-party marketing controls
• Evidence that opt-out requests were honored

Cookies and Online Tracking

Australia's Privacy Act does not create a blanket cookie-consent requirement.

Instead, organizations should assess the information collected by cookies, pixels, SDKs, advertising technologies, analytics tools, and other trackers against the APPs.

Relevant considerations include:

• Whether the technology collects personal information
• Whether the information is sensitive
• The purpose of collection
• Whether the information is used for direct marketing
• Whether it is disclosed to third parties
• Whether it is transferred overseas
• Whether consent is required for the particular processing
• Whether individuals have been properly notified

This means a website should not automatically assume that every analytics or advertising cookie requires opt-in consent under the Privacy Act.

Third-Party Disclosure

APP 6 regulates the use and disclosure of personal information.

As a general principle, organizations should use or disclose personal information only for the primary purpose for which it was collected, unless an exception applies.

Additional requirements can apply where information is used for a secondary purpose.

Organizations should document:

• Primary purpose
• Secondary purposes
• Third-party recipients
• Legal basis or exception
• Consent where required
• Data-sharing agreements
• Overseas recipients

Cross-Border Data Transfers

APP 8 establishes rules for cross-border disclosure of personal information.

Before disclosing personal information to an overseas recipient, an APP entity generally must take reasonable steps to ensure that the recipient does not breach the APPs in relation to the information.

The Australian organization can remain accountable for certain acts or practices of the overseas recipient.

Organizations should therefore conduct appropriate due diligence on:

• Overseas vendors
• Cloud providers
• Analytics platforms
• Marketing providers
• Customer-support providers
• Group companies
• Sub-processors

Consent for Overseas Disclosures

There is an exception under APP 8 where an organization expressly informs the individual about the consequences of consenting to the overseas disclosure and the individual then consents.

The information provided should explain that, if the individual consents and the overseas recipient subsequently mishandles the information, the organization may not be accountable under the Privacy Act for that handling and the individual may not have the same redress under the Act.

Consent used for this purpose should be:

• Voluntary
• Current
• Specific
• Informed
• Understandable

Organizations should not seek unnecessarily broad consent for undefined future transfers.

Data Security Under APP 11

APP 11 requires organizations to take reasonable steps to protect personal information from:

• Misuse
• Interference
• Loss
• Unauthorized access
• Unauthorized modification
• Unauthorized disclosure

Security measures should be proportionate to factors such as:

• Sensitivity of the information
• Quantity of information
• Potential harm
• Organization size and resources
• Technical environment
• Processing activities
• Third-party access

OAIC guidance identifies measures such as access controls, audit trails, privacy risk management, employee training, and breach-response procedures as relevant privacy governance controls.

Eligible Data Breach Notification

Australia operates a Notifiable Data Breaches (NDB) scheme.

Where an organization has reasonable grounds to suspect an eligible data breach, it must undertake an assessment and, where the breach is an eligible data breach, notify affected individuals and the OAIC as required.

An eligible data breach generally involves unauthorized access to, disclosure of, or loss of personal information where the circumstances are likely to result in serious harm to affected individuals.

Organizations should maintain:

• Breach detection procedures
• Incident-response plans
• Risk assessment processes
• Containment procedures
• OAIC notification workflows
• Individual notification templates
• Remediation records
• Incident documentation

Access to Personal Information

APP 12 provides individuals with a right to request access to personal information held about them, subject to applicable exceptions.

Organizations should provide a clear and accessible process for:

• Receiving access requests
• Verifying identity
• Locating relevant information
• Assessing applicable exceptions
• Providing access
• Documenting the response

Privacy policies should explain how individuals can request access to their information.

Correction of Personal Information

Under APP 13, individuals can request correction of personal information that is inaccurate, out of date, incomplete, irrelevant, or misleading.

Organizations should maintain procedures for:

• Receiving correction requests
• Verifying information
• Updating records
• Notifying relevant third parties where required
• Documenting the correction

Anonymity and Pseudonymity

APP 2 provides individuals with the ability to deal with an organization anonymously or using a pseudonym where practicable, subject to exceptions.

Organizations should therefore consider whether identity is genuinely necessary for a particular interaction before requiring identifying information.

Data Retention and Destruction

Organizations should not retain personal information indefinitely when it is no longer required.

APP 11 includes obligations concerning the destruction or de-identification of personal information that is no longer needed, subject to applicable exceptions and retention requirements.

Organizations should maintain:

• Retention schedules
• Deletion procedures
• Secure destruction controls
• De-identification procedures
• Legal retention exceptions
• Records of disposal activities

Privacy Impact Assessments

The OAIC recommends that organizations consider conducting a Privacy Impact Assessment (PIA) when introducing projects or changing practices involving personal information.

A PIA can help identify privacy risks before a system, product, technology, or business process is deployed.

Relevant projects can include:

• New customer databases
• AI systems
• Advertising technologies
• Large-scale analytics
• New cloud platforms
• Biometric systems
• Data-sharing initiatives
• International data transfers

OAIC guidance specifically identifies PIAs as a practice organizations should consider as part of their APP 1 compliance systems.

Automated Decision-Making

Australia's Privacy Act reforms introduce new transparency requirements for certain automated decisions.

From 10 December 2026, APP entities that arrange for a computer program to use personal information to make, or substantially contribute to, decisions that could reasonably be expected to significantly affect an individual's rights or interests will have additional privacy-policy obligations.

Privacy policies will need to provide specified information about:

• Kinds of personal information used by the computer program
• Kinds of decisions made solely through computer programs
• Kinds of decisions where computer programs substantially and directly contribute to the decision

Organizations using AI or automated decision systems should therefore review their privacy policies before the December 2026 commencement date.

Statutory Tort for Serious Invasions of Privacy

A statutory tort for serious invasions of privacy commenced on 10 June 2025.

The new cause of action can provide individuals with a separate avenue for seeking redress for certain serious invasions of privacy, including:

• Intrusion upon an individual's seclusion
• Misuse of information relating to an individual

The tort has requirements, defenses, exemptions, and public-interest considerations separate from ordinary APP compliance. Courts can grant remedies including damages, injunctions, or an order requiring an apology.

This means organizations should consider privacy risks more broadly than simply checking whether their practices comply with the APPs.

Employee Records and Other Exemptions

The Privacy Act contains several exemptions and special regimes.

Organizations should assess whether specific activities fall within exemptions relating to areas such as:

• Employee records
• Certain political activities
• Journalism
• Small businesses
• Registered political parties
• Certain other statutory activities

Exemptions can be narrow and fact-specific, so organizations should not assume that an entire business is exempt merely because one processing activity falls within an exemption.