If your business collects information about people, the first question under Australian privacy law is whether that information counts as personal information. The answer decides whether the Privacy Act 1988 (Cth) (the Act) and its 13 Australian Privacy Principles (APPs) govern how you can collect, use, store and share it, and what you must do if something goes wrong.
The definition is broader than most business owners expect. It is not limited to names and addresses. It can cover opinions, information you never write down, and data that only identifies someone when it is combined with other details.
This article explains what the Act's definition of personal information covers, how to tell when someone is reasonably identifiable, and where businesses most often get it wrong.
- The legal definition: the three limbs of the statutory test
- Reasonable identifiability: when information can single someone out
- Sensitive information: the higher-protection subset
- What is not personal information: business records and de-identified data
- A worked example: how the test plays out in a small business
- Misconceptions and help: where businesses get it wrong and when a lawyer assists
The APPs bind APP entities. In practice that means most businesses with an annual turnover above $3 million, and some smaller businesses caught for specific reasons such as providing health services or trading in personal information. Many small businesses are not required to comply, but the definition still matters: if you do fall within the Act, the first thing a regulator or a customer will ask is whether the information you hold is personal information.
The legal definition
Section 6(1) of the Privacy Act 1988 (Cth) defines personal information as information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information or opinion is true or not and whether or not it is recorded in a material form.
Four points in that definition matter more than business owners realise.
First, it covers opinions, not just facts. A note in a customer file saying a client is difficult to deal with is an opinion about an individual and can be personal information, even if the opinion is wrong. The Act applies whether the information is true or not.
Second, the information does not need to be recorded. Something one of your staff simply observes or is told, and never writes down, can still be personal information if it is about an identified or identifiable person.
Third, the information does not need to be private in the ordinary sense. The OAIC's guidance notes that personal information can range from sensitive and confidential information to information that is publicly available, such as a photograph posted online.
Fourth, the definition is not limited to obvious identifiers. The OAIC lists a name, signature, home address, email address, telephone number, date of birth, medical records, bank account details and employment details as information that will generally be personal information. So too can work-related details such as salary or job title, and even certain business information where it identifies an individual.
Common examples a small business might hold include:
- Identity details: name, date of birth, signature and photographic identification
- Contact details: home address, email address and telephone number
- Financial details: bank or credit card details and billing records
- Employment details: salary, job title and performance records
- Online identifiers: IP addresses, login data, device identifiers and web browsing behaviour
- Marketing preferences: opt-in and opt-out choices for email or SMS
The thread running through all of these is that the information relates to an individual who can be identified or singled out.
When is someone reasonably identifiable?
Most of the hard questions turn on the words reasonably identifiable. You do not need to know a person's name for information to be personal information. The test is whether the information, on its own or combined with other information available to you, can reasonably single out a particular individual.
The OAIC's guidance says the question is assessed case by case, with the circumstances and context in mind. The factors it points to include the nature and amount of information, who holds it, who will have access to it, whether it can be combined with other available information to identify someone, and how practical identification actually is. The word reasonably matters: if identification is technically possible but so impractical that it is almost never going to happen, the information may not be personal information. Where there is genuine uncertainty, the OAIC encourages entities to err on the side of caution and treat the information as personal information.
Context can change the answer. A postcode alone would rarely identify anyone in a city. In a remote region where one person lives at a particular property, the same postcode combined with a property description could identify that person immediately. Similarly, a photograph is personal information when the person in it can be recognised, and the OAIC notes that identification can be achieved through means such as facial recognition software, not only by someone recognising the face.
The character of information can also change over time. A dataset that does not identify anyone today may become personal information if you later acquire other data that can be matched to it, or if new technology makes matching practical. The OAIC warns that information holdings are dynamic and the character of information can change.
Sensitive information: the higher-protection subset
Sensitive information is a defined subset of personal information that attracts extra protection. Under s 6(1) of the Act it includes information or an opinion about a person's:
- racial or ethnic origin
- political opinions or membership of a political association
- religious beliefs or affiliations
- philosophical beliefs
- membership of a professional or trade association or a trade union
- sexual orientation or practices
- criminal record
It also includes health information, genetic information, and biometric information and biometric templates.
For an APP entity, sensitive information sits behind a higher bar before it can be collected. APP 3.3 says sensitive information can generally only be collected with the individual's consent, and only where it is reasonably necessary for the entity's functions or activities. That is materially stricter than the rule for ordinary personal information, which can be collected where reasonably necessary without consent in most cases.
Health information deserves special mention for many small businesses. A gym or personal trainer holding notes about a client's injuries, a beauty clinic recording treatment history, or an employer holding employee medical certificates are all holding sensitive information, with the consent and security obligations that come with it.
What is not personal information
Two categories of information generally fall outside the definition.
The first is information about a business rather than an individual. A company's name, registered address and ABN are not personal information. But the position changes when the business is run by an identifiable person. The OAIC gives the example of information about a loan a sole trader takes out to buy tools for their business, which can be personal information about the sole trader. If your customer is a sole trader, their business details can be their personal information.
The second is genuinely de-identified information. Information that has been de-identified, so that it no longer relates to an identifiable person, falls outside the definition. De-identification is harder to achieve than it sounds, and the OAIC publishes dedicated guidance on it. Simply removing names from a spreadsheet is usually not enough, because the remaining details, such as postcode, age, gender and occupation, can often be combined with other available data to re-identify people. If you plan to rely on de-identification, it is worth specialist help to assess whether the data can still be linked back to individuals.
A worked example: Maya's fitness studio
Maya runs a boutique fitness studio in a regional town. She collects client names, email addresses and phone numbers at sign-up. She keeps a health questionnaire for each client, covering injuries and medical conditions, so her trainers can adapt sessions. Clients check in through an app that records their arrival time and location. The studio also keeps a spreadsheet of loyalty scores used for marketing, with client numbers but no names.
Applying the definition, the sign-up details are clearly personal information. The health questionnaires are personal information and, because they are health information, they are sensitive information, so Maya needs consent to collect them and can only use them for purposes clients would reasonably expect. The app check-in data is personal information too: in a regional town, a check-in time and location can readily identify a client, even without a name attached. The loyalty spreadsheet sits in the grey zone. If the client numbers can be matched back to the sign-up records, the spreadsheet is personal information. If the numbers were genuinely scrambled and no link remained, it might be de-identified, but Maya should assume it is personal information until a careful review shows otherwise.
A corporate client that books a block of classes is different. The company's ABN and address are not personal information. But the sole-trader accountant who also books classes is identifiable through their business details, so that information is personal information about them.
The practical point for Maya is that almost everything she touches is personal information. She needs a privacy policy that explains what she collects and why, she should only collect what is reasonably necessary, she needs consent for the health information, and she must keep the data secure and respond to access and correction requests.
Common misconceptions
Certain misconceptions about the definition recur time and again. The most common ones are:
- We do not collect names, so we are not affected: The definition does not require a name. Client numbers, photographs, location data and loyalty scores can all be personal information where they can single someone out.
- De-identified data is safely outside the Act: Only genuine de-identification puts data outside the definition. Removing names is rarely enough, and re-identification is often possible by combining the remaining data with other available information.
- Business information is never personal information: True for companies, but not for sole traders, whose business details can identify them.
- Only sensitive information is protected: All personal information is protected by the APPs. Sensitive information attracts a higher bar for collection, but ordinary personal information still carries obligations around collection, use, disclosure, security and access.
- Publicly available information is fair game: Publicly available information can still be personal information. The definition turns on identifiability, not on whether the information is public.
Each of these misconceptions matters because getting the classification wrong can mean handling information without the protections the Act requires, and discovering the error only after a complaint or a breach.
When you need a privacy lawyer
Working out what counts as personal information is usually straightforward, but the grey zones, such as whether a dataset is reasonably identifiable or genuinely de-identified, are exactly where a privacy lawyer adds value. A practitioner can:
- map what your business actually collects, holds, uses and discloses, and classify each item against the definition
- assess whether your business is an APP entity, including whether any small business exemption applies
- draft or update your privacy policy and collection notices so they reflect your actual practices
- review consent mechanisms, particularly for sensitive information
- advise on de-identification proposals and data-sharing arrangements
- help you respond to access and correction requests, complaints to the OAIC, or a data breach
The benefit of doing this early is that compliance is cheaper than remediation. A business that has its data mapped and its policy aligned can respond to a complaint or an OAIC investigation quickly and credibly, and can show that it took its obligations seriously.
The question to ask about every dataset
Before you collect, store or share any information about people, ask one question: could this information, on its own or combined with anything else my business holds or can access, single out a real person? If the answer is yes, or you are not sure, treat it as personal information and handle it accordingly.
The misstep that costs businesses most is assuming that because they do not store names, the Act does not apply. The definition was written to catch exactly that assumption. When in doubt, the OAIC's approach is the sensible one: err on the side of caution, and get advice on the genuinely grey cases.