Australia’s Privacy Act 1988 and the Australian Privacy Principles (APPs) regulate how organizations collect, use, store, and disclose personal information of Australian residents. Administered by the Office of the Australian Information Commissioner (OAIC), these principles set Australia’s benchmark for data protection. If your business handles personal information of Australians, whether you are based in Australia or just sell to people there, this guide explains what compliance looks like in practice.
The Privacy Act and the 13 APPs
The Privacy Act protects the personal information of individuals in Australia. Personal information is any information about an identified or reasonably identifiable person, which is a deliberately broad definition that covers names, emails, addresses, IP addresses, purchase history, and even things like customer support notes.
The heart of the law is the 13 Australian Privacy Principles (APPs), which every covered organization must follow. They read like a checklist rather than a code: be open about what you do, collect only what you need, tell people when you collect, use data only for the stated purpose, keep it secure, and let people see and correct it. The full list is below.
The 13 APPs in Plain English
Here is the whole framework, grouped so it is easier to hold in your head:
- Openness and choice (APPs 1-2): have a clear, current privacy policy, and let people deal with you anonymously or under a pseudonym where that is practical.
- Collecting the right way (APPs 3-5): only collect personal information you actually need, deal with information that arrives unsolicited, and tell people what you are collecting and why at the time of collection.
- Using and sharing (APPs 6-9): use and disclose information for the purpose it was collected (with limited exceptions), follow specific rules for direct marketing, protect data sent overseas, and do not misuse government-related identifiers.
- Quality and security (APPs 10-11): keep information accurate and up to date, and protect it with reasonable security safeguards.
- Access and correction (APPs 12-13): give people access to their information on request, and correct it when they ask.
Most compliance work lives in three places: the privacy policy (APP 1), collection notices (APP 5), and security (APP 11). Get those right and the rest tends to follow.
Who Must Comply: The $3 Million Question
The Privacy Act has an unusual feature for a modern privacy law: a small business exemption. Organizations with an annual turnover of AUD 3 million or less are generally exempt from the APPs, unless they fall into a listed exception, such as providing health services, trading in personal information, or operating in credit reporting.
Two things matter here in 2026:
- If you are a small business today, check the exceptions before assuming you are exempt. Selling customer data, running a health service, or handling credit information removes the exemption regardless of turnover.
- The exemption is being removed. Privacy Act reforms are rolling out in tranches, and recent reporting points to the small business exemption ending from December 10, 2026, which would bring an estimated 2.5 million more Australian businesses under the full 13 APPs. The exact timing has shifted before, so treat the direction as certain and the date as approximate.
The practical advice for every Australian small business: do not build your privacy program around the exemption. Build it as if the APPs apply to you today, because they very likely will soon, and the work is the same either way.
The Notifiable Data Breaches Scheme
Under the Notifiable Data Breaches (NDB) scheme, which has operated since February 2018, organizations covered by the Privacy Act must act when a data breach occurs:
- A breach is notifiable when it is likely to result in serious harm to any affected individual.
- Notify the OAIC and affected individuals as soon as practicable after you become aware, with a Notifiable Data Breach statement that includes what happened and what people can do to protect themselves.
- If you are unsure whether the harm threshold is met, the OAIC expects a reasonable assessment, and you should be ready to justify your decision either way.
- Keep records of your assessment. The OAIC can investigate, and it has shown it will, with enforcement actions and penalties now far beyond the early years of the scheme.
Serious harm includes financial loss, identity theft, serious embarrassment, or damage to reputation. If in doubt, get advice early, because the notification clock runs from awareness, not from the end of your investigation.
Privacy Policies and Collection Notices
APP 1 requires a clearly expressed and current privacy policy, and the OAIC expects it to be easy to find. A good Australian privacy policy covers:
- What personal information you collect and hold
- How you collect it, including from third parties
- Why you collect it and what you do with it
- Who you disclose it to, including overseas recipients and which countries they are in
- How people can access and correct their information
- How they can complain, and how you handle complaints
- Whether you are likely to disclose information to overseas recipients, naming the countries
APP 5 adds the collection notice: at the time you collect information (or as soon as practical after), you must tell people who you are, why you are collecting, what happens if they do not provide it, and their access and complaint rights. A form that collects an email address without any notice is an APP 5 breach waiting to happen.
Direct Marketing and Cross-Border Data
Two APPs create practical friction for online businesses:
- APP 7 (direct marketing): you can only use personal information for direct marketing if the person would reasonably expect it, or if you offered an opt-out and they did not decline. Every marketing message needs a working unsubscribe path, and consent-based lists are the safest model.
- APP 8 (cross-border disclosure): before sending personal information overseas, you must take reasonable steps to ensure the recipient will handle it in line with the APPs, and you remain accountable for it. This matters for every Australian business using US-based email, analytics, or cloud tools. The OAIC has published guidance on what “reasonable steps” means in practice.
For most small operators, APP 8 means checking where your software vendors store data and confirming they maintain reasonable security and privacy commitments. You stay accountable even when a US cloud provider holds the data.
Reform Watch: What Changes in 2026-2027
The Privacy Act is in its biggest reform cycle since 1988. The changes are landing in tranches, and the ones to watch:
- Removal of the small business exemption, scheduled by recent reporting for December 10, 2026
- New transparency requirements for automated decision-making, so if you use AI to make decisions about people, expect disclosure obligations
- A statutory tort for serious invasions of privacy, on the horizon as part of the reform package
- Stronger enforcement powers and higher penalties, which the OAIC has already begun using
If your business uses AI tools to profile customers or automate decisions, the automated decision-making rules are the piece to watch closely. More disclosure and explanation obligations are coming.
An Action Plan for a Small Business
- Confirm whether the APPs apply to you today, including the exceptions to the small business exemption.
- Plan as if the exemption is ending. The direction of travel is certain.
- Publish a clear privacy policy covering all APP 1 requirements.
- Add collection notices to every form, checkout, and signup.
- Audit your marketing lists against APP 7 and check where your vendors store data under APP 8.
- Write a breach response plan that can notify the OAIC as soon as practicable.
- Set up a process for access and correction requests under APPs 12 and 13.
Australia’s privacy regime is only getting stricter, and the businesses that treat the APPs as a habit instead of a hurdle will be the ones that sail through the reforms. Start now, while the pressure is low.
Doing business across borders?
The Australian Privacy Act is one of several laws that can cover the same business. The Global Privacy Law Hub compares GDPR, CCPA, PIPEDA, LGPD, Australia, and UK-GDPR side by side.
About The Author
