Privacy Act 1988

· About Privacy Act 1988

Key Takeaways

  • The Privacy Act 1988 (Cth) applies to most Australian Government agencies and many private sector organisations handling personal information, and it can reach conduct outside Australia in some cases.[1][15]
  • The Act is enforced by the Office of the Australian Information Commissioner (OAIC), which oversees the Australian Privacy Principles, the Notifiable Data Breaches scheme, and civil penalty proceedings in court.[4][8]
  • The current penalty regime distinguishes serious or repeated interferences with privacy from lower-tier contraventions, with maximum court penalties for corporations reaching the greater of AUD 50 million, three times the benefit obtained, or 30% of adjusted turnover.[8]
  • The Privacy and Other Legislation Amendment Act 2024 received Royal Assent on 11 December 2024, and most reforms commenced then, but some obligations were given delayed commencement windows.[4][12]
  • A delayed reform affecting automated decision-making disclosures in privacy policies is scheduled to take effect on 11 December 2026 after a 24-month grace period.[12]
  • As of the latest federal compilation on 4 June 2026, the Privacy Act includes amendments through Act No. 75 of 2025, so compliance teams should work from the current compilation rather than older consolidated versions.[1][2]

What It Is

The Privacy Act 1988 (Cth) is Australia’s core federal privacy statute. It regulates the handling of personal information by Australian Government agencies and by many private sector entities, primarily through the 13 Australian Privacy Principles (APPs) and related rules such as the Notifiable Data Breaches scheme.[1][14]

The Act is administered and enforced by the OAIC, which also issues guidance and may seek civil penalties in court for serious privacy contraventions.[8][14]

The Act was originally enacted in 1988. The current federal compilation available on the Federal Register of Legislation is dated 4 June 2026, and it shows amendments including Act No. 75 of 2025.[1][2] The major recent reform package, the Privacy and Other Legislation Amendment Act 2024, was passed on 29 November 2024 and commenced largely on 11 December 2024, with some provisions phased in later.[4][12]

Who Must Comply

The Act applies to most Australian Government agencies and to APP entities, which include many private sector organisations that are not small businesses exempted by the Act.[1][14] It also extends, in specified circumstances, to acts done or practices engaged in outside Australia and the external Territories where the statutory connection requirements are met.[15]

The usual threshold for many private sector entities is the small business exemption: businesses with annual turnover at or below AUD 3 million are generally exempt, unless an exception applies. Common exceptions include health service providers, businesses that trade in personal information, contractors to the Commonwealth, and certain other prescribed classes of organisations.[14][15]

The Act also covers entities that collect, use, or disclose personal information in ways that bring them within the definition of an APP entity, including some non-profits and service providers, depending on their activities.[14][15]

Core Requirements

  1. APP governance — APP entities must manage personal information in accordance with the 13 APPs, including lawful and fair collection, purpose limitation, notice, data quality, security, access, and correction.[1][14]
  2. Privacy policy — Covered entities must maintain a clear and up-to-date privacy policy describing personal information handling practices, including how complaints can be made and how individuals can access or correct data.[14][11]
  3. Collection controls — Organisations must only collect personal information that is reasonably necessary for their functions or activities, and sensitive information generally requires consent unless a legal exception applies.[1][14]
  4. Use and disclosure limits — Personal information may generally be used or disclosed only for the primary purpose of collection, or for a secondary purpose permitted by the APPs or authorised by consent or law.[1][14]
  5. Security and retention — Entities must take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification, or disclosure, and must destroy or de-identify information when no longer needed unless a legal requirement to retain it applies.[1][14]
  6. Access, correction, and complaints — Individuals have rights to access and correct personal information, and organisations must have complaint-handling processes that respond to privacy complaints.[14]
  7. Breach notification — Eligible data breaches must be assessed and, where notification thresholds are met, reported to affected individuals and the OAIC as soon as practicable under the Notifiable Data Breaches scheme.[14]

Deadlines and Penalties

| milestone | date | what applies | |---|---:|---| | Privacy Act enacted | 1988 | Federal privacy law takes effect and establishes the framework for APP entities and agencies.[1] | | Privacy and Other Legislation Amendment Act 2024 passed | 29 November 2024 | Major reform package passed Parliament.[4][12] | | Most 2024 reforms commence | 11 December 2024 | Most amendments take effect.[4][12] | | Latest federal compilation date | 4 June 2026 | Current consolidated text reflects amendments including Act No. 75 of 2025.[1][2] | | Automated decision-making disclosure reform | 11 December 2026 | Privacy policies must disclose certain automated decision-making uses after the grace period.[12] |

The maximum court penalty for a body corporate for serious or repeated interferences with privacy is the greatest of AUD 50 million, three times the benefit obtained, or 30% of annual turnover during the relevant period if the benefit cannot be determined.[8] For a person other than a body corporate, the maximum penalty is AUD 2.5 million.[8]

The OAIC may also seek lower-tier civil penalties and use infringement notice powers for certain contraventions, including non-compliant privacy-policy obligations.[8][11] Separate sanctions can include enforceable undertakings, declarations, compensation orders, compliance assessments, and reputational harm from public enforcement action.[8][14]

How to Comply

  1. Map your data and entity status — Determine whether the business is an APP entity, whether any small-business exemption applies, and whether any extraterritorial activity creates Australian privacy obligations.[14][15]
  2. Build a privacy inventory — Document personal information flows, including collection points, sensitive data, disclosure recipients, retention periods, and cross-border transfers; this maps well to ISO 27001 asset and information-classification controls.
  3. Refresh governance documents — Update privacy notices, the privacy policy, breach procedures, vendor clauses, and complaint workflows so they align with APP obligations and the NDB scheme.[14]
  4. Implement security controls — Use a risk-based control set consistent with ISO 27001 and NIST CSF 2.0 for access control, logging, vulnerability management, incident response, and encryption where appropriate.[1][14]
  5. Test breach response — Run tabletop exercises for eligible data breaches, including decision-making on assessment, notification timing, and evidence preservation; this should be integrated with incident response under NIST CSF 2.0.
  6. Operationalise privacy by design — Embed collection minimisation, consent checks, retention triggers, and access/correction handling into product and system design; this is a practical fit for ISO 42001 governance over AI-enabled processing.
  7. Train staff and vendors — Train personnel on permitted use/disclosure, phishing, subject rights, and escalation rules; extend contract terms to processors and service providers who handle personal information.
  8. Prepare for 2026 policy changes — Review whether any automated decision-making features trigger the 11 December 2026 disclosure obligation and update the privacy policy before that date.[12]

Related Regulations

  • The Notifiable Data Breaches scheme is part of the Privacy Act framework and is the main incident-notification regime for covered entities handling personal information.[14]
  • The Spam Act 2003 overlaps on marketing communications, but it regulates unsolicited electronic messages rather than general personal-information handling.
  • The Consumer Data Right regime overlaps where data portability and access apply in designated sectors, but it is sector-specific and does not replace Privacy Act compliance.
  • The Australian Consumer Law can intersect where misleading statements are made about privacy practices or data handling, creating parallel consumer-law risk.
  • The state and territory privacy laws can apply to public-sector bodies and specific local datasets, so federal compliance does not always eliminate local obligations.

FAQ

Does the Privacy Act apply to companies outside Australia?

Yes, in some circumstances the Act extends to conduct outside Australia and the external Territories where the statutory conditions are met.[15] This matters for offshore processors, foreign SaaS providers, and multinational groups serving Australian customers. Cross-border compliance should be assessed entity by entity, not group-wide.

Do small businesses have to comply?

Generally, businesses with annual turnover of AUD 3 million or less are exempt, but several common exceptions can pull them into scope.[14][15] Health service providers, businesses trading in personal information, and some Commonwealth contractors are typical examples. If an exemption does not clearly apply, the safer assumption is that the Act may apply.

What is the current maximum penalty under the Privacy Act?

For serious or repeated interferences with privacy, the maximum court penalty for corporations is the greatest of AUD 50 million, three times the benefit obtained, or 30% of annual turnover for the relevant period.[8] For individuals, the maximum is AUD 2.5 million.[8] Lower-tier contraventions can still attract substantial civil exposure and regulatory action.[8][11]

When do the 2024 privacy reforms take effect?

Most of the Privacy and Other Legislation Amendment Act 2024 commenced on 11 December 2024.[4][12] One important delayed reform requires certain automated decision-making disclosures in privacy policies from 11 December 2026.[12] Compliance teams should check each provision rather than assuming one universal commencement date.

Does the Act require notification after every data breach?

No. Only eligible data breaches trigger notification duties under the NDB scheme.[14] The key questions are whether there is unauthorised access, disclosure, or loss, and whether the incident is likely to result in serious harm after remedial action is considered. If the threshold is met, notification must be made as soon as practicable.

Sources

Put it into practice

More compliance guides