If your business holds personal information about employees, customers or job applicants, a privacy breach is not a hypothetical risk. It can be a misdirected email with a payroll file attached, a stolen laptop, or a staff member viewing records they had no reason to see. Under the Privacy Act 1988 (Cth) (the Privacy Act) and the Australian Privacy Principles (the APPs), most employers that hold that information owe real legal duties, and since the 2024 reforms the consequences for getting it wrong are higher than ever.
This guide sets out what the law actually requires of you: who must comply and why, the day-to-day duties (privacy policy, information security, breach response), how the employee records exemption works and where it stops, and what happens if you fail to meet the mark. We finish with a compliance checklist and a note on when to bring in a lawyer.
Who must comply with the Privacy Act
The APPs bind Australian Government agencies and most private sector organisations. Those covered entities are called APP entities, and the test for whether a business is covered is broader than many employers assume.
Under s 6D of the Privacy Act 1988 (Cth), an organisation is not a small business operator (and so is not exempt) if it:
- Exceeds the turnover threshold: its annual turnover is more than $3 million in a financial year. Turnover is the proceeds of sales of goods and services earned in the year, not profit (s 6DA).
- Provides health services: it provides a health service to an individual and holds health information about them.
- Trades in personal information: it discloses personal information about an individual to someone else for a benefit, service or advantage, or collects personal information by providing a benefit, service or advantage.
- Works for the Commonwealth: it is a contracted service provider under a Commonwealth contract.
- Handles credit information: it is a credit reporting body.
- Is related to a covered entity: it is a related body corporate of a business that is not a small business operator (s 6D(9)).
A small business that is otherwise exempt can also choose to be treated as an organisation, which brings it within the APPs (s 6EA). And if you collect personal information through a website or app used by the public, the practical expectation is that you will handle that information under the APPs and publish a privacy policy, even where your turnover is modest.
Your day-to-day privacy duties
If you are an APP entity, the APPs translate into a handful of concrete duties that should be built into how your business actually runs.
Publish a privacy policy and give collection notices
APP 1.3 requires every APP entity to have a clearly expressed and up-to-date APP privacy policy. APP 1.4 sets out what it must contain: the kinds of personal information you collect and hold, how you collect and hold it, the purposes of collection, use and disclosure, how individuals can access and correct their information, how they can complain about a breach and how you will deal with that complaint, and whether you are likely to disclose information to overseas recipients (and, if practicable, which countries).
APP 5 adds a notice requirement: at or before the time you collect personal information, you must take reasonable steps to notify the individual of the relevant matters, such as why you are collecting it and who you may share it with. For most employers this means a collection notice on job application forms, onboarding paperwork and customer-facing forms, not just a policy buried on your website.
Secure the personal information you hold
APP 11.1 is the core security obligation: you must take such steps as are reasonable in the circumstances to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. Since the 2024 amendments, APP 11.3 makes clear that those steps include technical and organisational measures, and APP 11.2 requires you to destroy information or de-identify it once you no longer need it (subject to legal retention requirements).
What is "reasonable" depends on your size and the sensitivity of the data, but in practice it means access controls on a least-privilege basis, multi-factor authentication for accounts that can reach personal information, encryption of laptops and portable devices, secure file-sharing rather than public links or personal email, prompt removal of access when staff leave, secure disposal of paper records, and training so staff can spot phishing and misdirected emails.
Assess and notify serious breaches under the NDB scheme
Part IIIC of the Privacy Act sets up the Notifiable Data Breaches (NDB) scheme. It applies when there is an eligible data breach: unauthorised access to, or unauthorised disclosure of, personal information, or loss of information in circumstances where unauthorised access or disclosure is likely, where a reasonable person would conclude that there is a likely risk of serious harm to any affected individual (s 26WE).
When deciding whether serious harm is likely, the Act directs attention to the kind and sensitivity of the information, whether it was protected by security measures and how easily those could be overcome, who could obtain it, and the nature of the harm (s 26WG). A remedial action exception applies: if you act before the access or disclosure results in serious harm, and as a result a reasonable person would no longer conclude serious harm is likely, the incident is not an eligible data breach (s 26WF).
If you have reasonable grounds to suspect an eligible data breach, you must carry out a reasonable and expeditious assessment and take all reasonable steps to complete it within 30 days of becoming aware (s 26WH(2)). The OAIC treats 30 days as a maximum, not a target.
If the assessment confirms an eligible data breach, you must prepare a statement setting out your identity and contact details, a description of the breach, the kinds of information involved and recommended steps for affected individuals, give a copy to the OAIC as soon as practicable (s 26WK), and notify affected individuals as soon as practicable (s 26WL). If you cannot practically notify individuals, you must publish the statement on your website and take reasonable steps to publicise it.
The employee records exemption is narrower than it looks
Private sector employers get a limited exemption for employee records. Under s 7B(3) of the Privacy Act 1988 (Cth), an act or practice is exempt from the APPs if it is directly related to a current or former employment relationship and to an employee record held by the employer. An employee record is a record of personal information relating to the employment of the employee (s 6(1)), including health information, engagement, training and discipline history, terms and conditions, contact details, performance and conduct, hours, salary, union membership, leave, and tax, banking or superannuation affairs.
The exemption is easy to over-read, and the OAIC's guidance makes clear where it stops:
- Job applicants: the exemption does not cover future employment relationships, so information about unsuccessful applicants is not exempt. Once someone becomes an employee, records from their pre-employment checks become exempt.
- Contractors and volunteers: the exemption covers employees only. Contractors, subcontractors, volunteers, and external providers such as recruitment or HR firms handling employee information must comply with the APPs.
- Outside the relationship: the act or practice must be directly related to the employment relationship. Selling an employee list to a marketer, for example, is not exempt.
- Not everything is an employee record: the information must relate to the employment of the employee. Emails an employee receives from their bank through their work account may not form part of an employee record.
There are two points employers most often miss. First, the exemption does not apply to tax file number information contained in an employee record, so TFN data remains protected. Second, because the NDB scheme applies only to information that is already subject to APP security obligations, a breach of an exempt employee record does not trigger the NDB assessment and notification requirements. But a breach involving job applicant, contractor or volunteer information, or a file that mixes exempt and non-exempt data, can still be notifiable, and the OAIC recommends that employers notify affected individuals where a breach of employee records is likely to result in serious harm even when not strictly required. Other laws, including state and territory health records and workplace surveillance laws and general employment law obligations, continue to apply alongside the Privacy Act.
What it costs to get it wrong
The 2024 reforms, which came into force on 11 December 2024, sharply increased the price of failure. A serious interference with privacy now attracts civil penalties of up to $2.5 million for individuals and, for bodies corporate, the greatest of $50 million, three times the value of the benefit obtained from the conduct, or 30% of adjusted turnover (s 13G of the Privacy Act 1988 (Cth)). Other interferences with privacy carry up to 2,000 penalty units (s 13H), and the OAIC can issue infringement notices and compliance notices for specified APP breaches of up to 200 penalty units (s 13K). Penalty units are indexed annually on 1 July.
Failing the NDB scheme itself is an interference with privacy: not completing the 30-day assessment, not preparing a statement for the OAIC, or not notifying affected individuals can each attract those penalties (s 13(4A)). The OAIC can investigate complaints, accept enforceable undertakings, and take proceedings in the Federal Court, which can order compensation, redress and even publication of a statement about the contravention (s 80UA).
Individuals can also sue directly. Since 11 June 2025, the statutory tort for serious invasion of privacy in Schedule 2 of the Privacy Act is in force. An individual can sue where an employer intentionally or recklessly intrudes on their seclusion or misuses information relating to them, the invasion is serious, and the individual had a reasonable expectation of privacy. Damages are capped by the legislation, but the exposure is real, particularly for misconduct in handling sensitive employee information.
A compliance checklist for employers
Use this checklist to test where your business stands:
- Confirm coverage: check your turnover and whether any of the s 6D categories apply to you.
- Publish a compliant privacy policy: make sure it covers the APP 1.4 contents and is easy to find.
- Give collection notices: at the point of collection, for staff, applicants and customers.
- Control access: least-privilege access, multi-factor authentication, prompt offboarding.
- Secure devices and files: encryption, secure sharing, secure disposal of paper and hardware.
- Train your team: phishing, misdirected email, and how to handle personal information day to day.
- Plan for incidents: a named response team, escalation paths, and a tested breach response plan.
- Review your contracts: make sure payroll, IT and HR providers owe you contractual security and notification obligations.
- Document everything: keep records of incidents, assessments and decisions, even where no notification is required.
When to get professional help
Some situations genuinely need a lawyer. Get advice early if you are unsure whether your business is an APP entity, if a breach involves information where serious harm is possible and the 30-day clock is running, or if you are weighing whether the remedial action exception applies. Notification decisions are consequential: the OAIC can investigate a failure to notify, and failing to notify when required exposes you to penalties. Multi-entity breaches, files mixing exempt and non-exempt information, TFN data, and any contact from the OAIC all warrant legal input.
A privacy lawyer will assess whether you are covered, map what personal information you hold and where, help you run a defensible breach assessment, draft the statement to the OAIC and the notification to individuals, handle regulator contact, and rebuild your policies and contracts so the next breach is less likely.
The employee records trap
The single most expensive mistake we see is treating the employee records exemption as blanket cover for anything an employer holds about a person. It is not. It does not reach job applicants, contractors or volunteers, it does not protect TFN information, and it does not stop the NDB scheme applying to non-exempt information in the same file. The first action this week is to confirm whether your business is an APP entity, and then to identify who owns privacy in your business and what personal information you actually hold. That answers the question that drives everything else: which duties apply to you, and what happens if the wrong email goes to the wrong person tomorrow.