Australian Privacy Principles

· About Australian Privacy Principles

Key Takeaways

  • The Australian Privacy Principles (APPs) are the core privacy rules in the Privacy Act 1988 and apply to the collection, use, disclosure, storage, access and correction of personal information.[9][6]
  • The APPs apply to most Commonwealth government agencies and to private sector organisations with annual turnover of more than AU$3 million, with additional coverage for some smaller or special-category entities.[9][10]
  • The OAIC enforces the APPs through guidance, investigations, determinations, enforceable undertakings, infringement notices, and civil penalty proceedings for serious or repeated interferences with privacy.[1][5][12]
  • For serious or repeated privacy breaches, the maximum civil penalty for a corporation is the greater of AU$50 million, three times the benefit obtained, or 30% of adjusted turnover for the breach period; individuals face up to AU$2.5 million.[5][11]
  • The Privacy Act compilation in force on 4 June 2026 reflects amendments including the Strengthening Oversight of the National Intelligence Community Act 2025, while the OAIC’s APP Guidelines were updated on 13 May 2026.[3][1]
  • A 2025 remake of the Privacy Regulations commenced on 1 April 2026, but the APP framework itself remains in force and the 2026 reform package appears to be still in consultation or proposal rather than operative law.[14][8]

What It Is

The Australian Privacy Principles are the 13 baseline privacy rules in the Privacy Act 1988 (Cth), governing how covered entities collect, hold, use, disclose and manage personal information.[6][9] They are enforced by the Office of the Australian Information Commissioner (OAIC), and the OAIC publishes the authoritative APP Guidelines.[1][6]

The APP framework is longstanding rather than newly adopted: the current consolidated Act is in force as compiled on 4 June 2026, and the official APP Guidelines show an update to Chapter 3 on 13 May 2026.[3][1] The Privacy Regulations were remade as the Privacy Regulations 2025, commencing 1 April 2026.[14]

Key phase-in milestones relevant to current compliance are the ongoing operation of the APPs under the Privacy Act, the commencement of the 2025 regulations on 1 April 2026, and the post-2025 amendments reflected in the June 2026 compilation of the Act.[3][14]

Who Must Comply

The APPs apply to APP entities, including most Commonwealth government agencies and most private sector organisations with annual turnover of more than AU$3 million.[9][10] The regime also reaches some organisations below that threshold, depending on the statutory category and the type of personal information handled.[10]

The APPs have extraterritorial reach where the Privacy Act applies to an entity with an Australian nexus and relevant collection or handling of personal information. The practical effect is that overseas businesses can be covered if they carry on business in Australia and handle Australian personal information through an Australian footprint or other statutory connection.[10]

Common exemptions and carve-outs include small businesses below the turnover threshold unless another coverage rule applies, and sector-specific exclusions or modified treatments under the Act. Government-related handling of personal information is generally not exempt, and national-security or law-enforcement functions may be treated under separate statutory settings.[9][3]

Core Requirements

  1. Open and transparent management: Covered entities must have a clearly expressed APP privacy policy and manage personal information openly and transparently.[6][13]
  2. Anonymity and pseudonymity: Individuals must be given the option of not identifying themselves, or of using a pseudonym, in dealings where lawful and practicable.[13]
  3. Collection limits and notices: Personal information may only be collected where lawful and necessary, and entities must provide notice about the collection and related uses or disclosures in prescribed situations.[6][13]
  4. Use and disclosure controls: Personal information must not be used or disclosed for secondary purposes unless an APP exception applies, including consent or related-use exceptions.[6]
  5. Direct marketing rules: Direct marketing is restricted and must include opt-out mechanisms and, in some cases, additional notice or consent requirements.[13]
  6. Cross-border disclosure safeguards: When disclosing personal information overseas, entities must take reasonable steps to ensure the recipient does not breach the APPs, subject to statutory exceptions.[6]
  7. Data quality and security: Reasonable steps must be taken to ensure personal information is accurate, up to date and secure against misuse, interference, loss, unauthorised access, modification or disclosure.[6]
  8. Access and correction: Individuals generally have a right to access their personal information and request correction of inaccurate records.[9][6]
  9. Government identifiers and sensitive information: Use of government-related identifiers is restricted, and sensitive information is subject to tighter collection and handling rules.[6]

Deadlines and Penalties

| milestone | date | what applies | |---|---:|---| | Privacy Regulations 2025 commence | 1 April 2026 | Updated regulations operate under the Privacy Act framework.[14] | | Updated APP Guidelines Chapter 3 | 13 May 2026 | OAIC guidance reflects current interpretation.[1] | | Latest consolidated Privacy Act compilation | 4 June 2026 | Act as amended and in force on the compilation date.[3] | | 2026 reform exposure draft and consultation | August–September 2026 | Proposed second-tranche reforms remain proposed, not operative law.[8] |

Maximum penalties for a serious or repeated interference with privacy are set out in the Privacy Act civil penalty regime: for a body corporate, the greater of AU$50 million, three times the value of the benefit obtained, or 30% of adjusted turnover during the breach turnover period; for a person other than a body corporate, up to AU$2.5 million.[5][11]

Other sanctions include infringement notices, enforceable undertakings, investigations, compensation-style determinations, and reputational consequences from OAIC enforcement action.[12][5]

How to Comply

  1. Map your APP entity status: Confirm whether the organisation is covered as a Commonwealth agency, AU$3 million+ organisation, or another covered category, and document the legal basis for coverage.[9][10]
  2. Build an APP data inventory: Record what personal information you collect, where it is stored, who receives it, retention periods, and whether it is sensitive information or an identifier.
  3. Align controls to ISO 27001: Use ISO 27001-style information security management for access control, logging, incident response, supplier oversight and continuous risk treatment; this maps directly to the APP security obligation.[6]
  4. Operationalise privacy governance: Update the APP privacy policy, notices, consent records, complaint handling, access/correction workflows and marketing suppression logic to match the APP requirements.[6][13]
  5. Embed NIST CSF 2.0: Use the Identify, Protect, Detect, Respond and Recover functions to structure privacy incident readiness, breach response and third-party management; this is especially useful for security and resilience controls.
  6. Implement AI and automation governance with ISO 42001: Where automated systems process personal information, use ISO 42001 governance to control data quality, transparency, accountability and lifecycle risk, especially for decision-support tools.
  7. Contract for offshore disclosures: For cross-border transfers, insert contractual privacy obligations, audit rights and breach notification duties, and assess whether an APP exception shifts liability or risk.[6]
  8. Test and review regularly: Run periodic privacy impact reviews, access-correction drills, direct marketing checks, and security testing, then remediate gaps and retain evidence for audit and regulator review.

Related Regulations

Privacy Act 1988 (Cth) is the parent statute; the APPs are its operating rules and any conflict is resolved by the statute and its regulations.[3][9]

Notifiable Data Breaches scheme overlaps operationally because APP security failures often trigger breach-notification duties, even though the APPs themselves focus on protection and handling.[9]

Privacy Regulations 2025 support the Act and may affect how specific exemptions or details operate, but they do not replace the APP framework.[14]

Consumer Data Right rules can overlap for banking, energy and telecom data-sharing, creating parallel privacy and disclosure obligations for covered participants.

EU GDPR can conflict or overlap for Australian entities with European data subjects, especially on lawful basis, cross-border transfer and deletion rights, so multinational controls should be harmonised carefully.

FAQ

Does the Australian Privacy Principles apply to companies outside Australia?

Yes, if the foreign company has the Australian nexus required by the Privacy Act and is otherwise a covered entity. The practical test is whether the organisation carries on business in Australia and handles personal information within the Act’s reach.[10] Overseas groups often need Australian-facing privacy controls even when headquarters and hosting are offshore.

Are small businesses exempt from the APPs?

Generally yes if annual turnover is below AU$3 million, but the exemption has exceptions and does not protect every small entity. Some organisations below that threshold can still be covered depending on their function or the type of information handled.[10] A threshold check should be done before relying on the small-business exemption.

What counts as a serious privacy breach under the APP regime?

The APPs themselves set substantive obligations, while the penalty regime attaches to a serious or repeated interference with privacy under the Privacy Act.[5] Serious failures commonly involve major security lapses, unlawful disclosures, or persistent non-compliance across multiple APP obligations. The OAIC can escalate such matters to civil penalty proceedings.[5][12]

Do the APPs require a privacy policy?

Yes. APP 1 requires an openly available and clearly expressed APP privacy policy describing how personal information is managed.[6][13] The policy should be operationally accurate, not generic boilerplate, and should match actual collection, use, disclosure and complaint-handling practices.

Can personal information be sent overseas under the APPs?

Yes, but only with safeguards. The disclosing entity must generally take reasonable steps to ensure the overseas recipient does not breach the APPs, unless a statutory exception applies.[6] Contractual controls, due diligence and transfer mapping are the usual compliance tools.

What changed in 2025–2026?

The Privacy Regulations were remade in 2025 and commenced on 1 April 2026, and the Privacy Act compilation in force on 4 June 2026 includes amendments from the Strengthening Oversight of the National Intelligence Community Act 2025.[14][3] An August 2026 exposure draft indicates further reforms are being consulted on, but those proposals are not yet operative law.[8]

Sources

Put it into practice

More compliance guides