Privacy Act (AU)

Australia's Privacy Act 1988 regulates how the federal government and many private organizations handle personal information, through thirteen Australian Privacy Principles (APPs). It includes a mandatory Notifiable Data Breaches scheme, and it is in the middle of a major reform program.

The first tranche of reforms, passed in late 2024, raised penalties and gave the regulator more tools, created a statutory tort for serious invasions of privacy from 10 June 2025, and added automated decision-making transparency from 10 December 2026. A second tranche is now out for consultation.

• APP entities: Australian Government agencies and organizations with annual turnover above AU$3 million.
• Some smaller businesses regardless of turnover, including health service providers, businesses that trade in personal information, and contracted service providers to the Commonwealth.
• Organizations outside Australia with an Australian link, such as carrying on business in Australia.
• Employee records held by a private employer are largely exempt, as are small businesses not otherwise caught.

Individuals can access and correct their personal information (APPs 12 and 13), deal anonymously or pseudonymously where practicable, opt out of direct marketing, complain to the Office of the Australian Information Commissioner, and sue for serious invasions of privacy under the statutory tort.

For serious interferences with privacy, civil penalties of up to the greater of AU$50 million, three times the benefit obtained, or 30% of adjusted turnover for the relevant period. Since the 2024 reforms, lower tiers and infringement notices also apply, including for failures in privacy policies. The OAIC enforces.

1. Confirm you are an APP entity, including under the exceptions to the small business exemption.
2. Update your APP 1 privacy policy, including automated decision disclosures before 10 December 2026.
3. Run a data breach response plan that assesses suspected breaches within 30 days.
4. Review overseas disclosures under APP 8 and the contracts behind them.
5. Check direct marketing against APP 7 and the Spam Act.
6. Follow the second-tranche consultation; the small business exemption may change.