Australian privacy law and what your business must do to comply

If your business collects, uses or stores information about its customers, clients or staff, Australian privacy law may already regulate how you handle it. The Privacy Act 1988 (Cth) sets out 13 binding rules, the Australian Privacy Principles (APPs), that cover everything from how you collect personal information to how you destroy it once you no longer need it. Breaching them can cost far more than a fine: penalties for serious breaches now reach into the tens of millions of dollars.

This guide covers who the law applies to, the duties you must actually meet day to day, what happens if you get it wrong, and a checklist you can work through this week.

Who must comply with the Privacy Act

The Privacy Act applies to "APP entities", which include most businesses with an annual turnover above the small business threshold. Under s 6D of the Privacy Act 1988 (Cth), a business is a "small business" if its annual turnover for the previous financial year was $3,000,000 or less, and a new business is a small business if its projected turnover for the current year is $3,000,000 or less. Turnover is calculated under s 6DA as the income the business earns, including proceeds of sales, commission, rent, interest, royalties and dividends. The Office of the Australian Information Commissioner (OAIC) confirms that this includes income from all sources, but not assets held, capital gains or proceeds of capital sales.

If your turnover is above $3 million, the Act applies to you. Below it, you may still be caught, because the Act covers certain businesses regardless of turnover, including:

Health service providers: private hospitals, medical and allied health practices, pharmacies, private schools and childcare centres.
Businesses that trade in personal information: for example, selling a customer list to a marketing company.
Contractors: businesses providing services to Australian Government agencies under a Commonwealth contract.
Credit providers and credit reporting bodies: operators of residential tenancy databases are also covered.
Related entities: businesses related to a body corporate that is itself covered.
Opted-in businesses: small businesses that have chosen to be covered by the Act.

If you are a small business operator that is a reporting entity under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), the Act applies to those activities under s 6E.

One important note for planning: the long-standing small business exemption was not removed in the Privacy and Other Legislation Amendment Act 2024 (Cth), and it remains current law. The Government has flagged removing it in a future round of reform, so if you are currently exempt, it is worth treating the APPs as your target standard rather than waiting to be forced into compliance.

The 13 Australian Privacy Principles

The APPs sit in Schedule 1 of the Privacy Act and are the heart of your compliance obligations. They are framed around two recurring standards: you may only do things that are "reasonably necessary" for your business, and you must take "reasonable steps" to protect information. What is reasonable will depend on your size, the sensitivity of the information and the risk involved. The main duties break down into the following areas.

Be open about how you handle information (APP 1)

Under APP 1, you must have practices, procedures and systems in place to ensure you comply with the APPs, and you must have a clearly expressed and up-to-date privacy policy. The policy must be available free of charge, normally on your website, and it must explain what personal information you collect and hold, how and why you collect it, how you use and disclose it, and how people can access or correct it and complain about a breach. This is the document your customers will read to decide whether to trust you with their details, so it needs to reflect what you actually do, not a template you downloaded.

Collect only what you need (APPs 3 and 5)

APP 3 stops you from collecting personal information unless it is reasonably necessary for one of your functions or activities. If you are a tradie taking a customer's phone number to book a job, that is reasonably necessary; asking for their date of birth and tax file number is not.

Sensitive information gets extra protection. Under APP 3.3, you must not collect sensitive information, such as health details, racial or ethnic origin, political opinions or religious beliefs, unless the individual consents and the collection is reasonably necessary (or a specific exception applies). If your business collects health information, for example a gym, pharmacy or counselling practice, this is the rule that will shape your consent forms.

APP 5 then requires you to notify individuals at or before the time you collect their information. The notification must set out who you are, what you are collecting and why, what will happen if they do not provide it, who you may disclose it to, and how they can access or correct it.

Use and disclose information only for the purpose you collected it (APP 6)

APP 6 is the rule that stops information being repurposed. If you collect an email address to send an invoice, you cannot turn around and use it for a weekly marketing newsletter unless the customer consents, or the use falls within a permitted exception. In practice the exception that matters most is where the individual would reasonably expect the information to be used for the secondary purpose, and that purpose is related to the original one. For sensitive information, the secondary purpose must be directly related, which is a much higher bar. Keep your purpose statements in your collection notices accurate, because they set the boundary for everything you do with the data afterwards.

Keep personal information secure (APP 11)

APP 11 requires you to take such steps as are reasonable in the circumstances to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. The principle expressly contemplates both technical and organisational measures, which means the human side counts as much as the software side. Practical steps include:

Access controls: only staff who need the information to do their job can see it.
Staff training: your team knows how to handle information and what to do if something goes wrong.
System hygiene: up-to-date software, strong passwords and encryption for anything sensitive.
Third-party providers: IT providers, web hosts and payment processors should only receive what they need, and should be bound by contract to protect it.

APP 11 also requires you to destroy or de-identify personal information once you no longer need it for any permitted purpose and are not required by law to keep it. That means shredding paper records and securely wiping devices before disposal, and having a retention schedule that tells you how long different records should be kept.

Mind the cross-border and direct marketing rules (APPs 8 and 7)

If you disclose personal information to someone outside Australia, APP 8 requires you to take reasonable steps to ensure the overseas recipient does not breach the APPs, and you generally remain accountable for the information as if you had handled it yourself. Before using an offshore cloud provider or data processor, check where the data will sit and what protections the contract gives you.

APP 7 regulates direct marketing. You can send marketing to existing customers in some circumstances, but you must always offer a simple way to opt out and must honour opt-out requests promptly. Failing to provide a workable opt-out mechanism is itself a breach that can attract a penalty notice.

Report serious data breaches (the Notifiable Data Breaches scheme)

Since February 2018, Part IIIC of the Privacy Act has required notification of eligible data breaches. An eligible data breach occurs where there is unauthorised access to, unauthorised disclosure of, or loss of, personal information, and a reasonable person would conclude there is a likely risk of serious harm to affected individuals. When assessing that risk, the Act directs you to consider the kind and sensitivity of the information, whether it was protected by security measures, who could have obtained it, and the nature of the harm.

If you have reasonable grounds to suspect an eligible data breach, you must prepare a statement setting out what happened, what information was involved and what steps individuals should take, and give it to the OAIC as soon as practicable. You must also notify the affected individuals, or publish the statement on your website if individual notification is not practicable. A good rule of thumb is to treat any suspected breach seriously, contain it, assess it within 30 days, and get advice early if the information involved was sensitive or large in volume.

What happens if you don't comply

The enforcement landscape has changed significantly in recent years. Under s 13G, serious or repeated interference with privacy can now attract a maximum civil penalty for a body corporate of the greatest of $50,000,000, three times the value of any benefit obtained from the conduct, or 30% of adjusted turnover during the breach period. Individuals face penalties of up to $2,500,000. Less serious interferences attract up to 2,000 penalty units under s 13H, and the OAIC can issue infringement notices or compliance notices for specific APP breaches under s 13K.

The OAIC can investigate complaints from individuals, run its own Commissioner-initiated investigations, conciliate disputes and make binding determinations, including awards of compensation. Since 10 June 2025, individuals have also been able to sue directly for serious invasions of privacy under a new statutory tort introduced by the Privacy and Other Legislation Amendment Act 2024 (Cth). Beyond the legal exposure, a publicised data breach erodes the customer trust that small and medium businesses depend on, and can disqualify you from tenders or contracts that require privacy compliance.

A practical compliance checklist

Work through these steps to bring your business in line with the APPs:

Confirm your status: work out whether the Privacy Act applies to you, including the turnover test and the exceptions above.
Write and publish a privacy policy: accurate, up to date and easy to find.
Map your information flows: list every place personal information enters your business and what happens to it.
Trim your collection: stop collecting anything you do not reasonably need, and update forms and notices to match.
Check your notifications: make sure individuals are told at collection what you do with their information.
Lock down access: review who can see what, and apply the need-to-know principle to staff and contractors.
Train your people: make privacy handling part of onboarding and refresh it regularly.
Set a retention schedule: destroy or de-identify information you no longer need, and wipe devices before disposal.
Plan for incidents: write a simple response plan so someone knows what to do when a breach is suspected, including when to notify the OAIC.
Review before you change systems: a privacy impact assessment is a good idea before adopting new software, especially anything that stores customer data.

When to get a lawyer involved

You do not need a lawyer to run most of the day-to-day compliance steps above, but legal help is usually worth it at the edges. A lawyer can help you work out whether the Act applies to you at all, which is harder than it looks once the exceptions are in play. They can draft or review your privacy policy and collection notices so they match your actual practices, and they can negotiate the privacy terms in contracts with IT providers and overseas processors. If a breach happens, or the OAIC contacts you about a complaint or investigation, get advice before you respond: what you say in a notification statement can be used against you later. And if your business handles sensitive information, children's data or large volumes of customer data, an early privacy review is a far cheaper way to find problems than an investigation.

The exemption most businesses assume they have

If you take one thing from this article, check whether you are actually exempt from the Privacy Act before assuming you are. Many small operators believe the law does not touch them, only to discover they are caught because they provide health services, trade in personal information, or work under a Commonwealth contract. And the small business exemption itself is on borrowed time: the Government has committed to removing it as part of ongoing privacy reform. The businesses that will cope best are the ones that treat the APPs as the standard now, starting with a single question: do we have a current, accurate privacy policy, and does our team know how to apply it?