Privacy complaints in Australia and the obligations your business must meet

Most privacy problems in Australian small and medium businesses start the same way. Not with a hacker, but with a routine mistake. An email goes to the wrong address, a spreadsheet is shared too widely, an online form collects a date of birth nobody needs, or a customer asks to see their file and never hears back. Any of these can become a formal privacy complaint, and once one lands, a set of legal obligations switches on that your business may not have thought about.

The core rules come from the Privacy Act 1988 (Cth) (the Act) and the Australian Privacy Principles (the APPs) it contains, administered by the Office of the Australian Information Commissioner (the OAIC). This guide covers who those obligations apply to, the duties that prevent and resolve privacy complaints, what happens if a complaint escalates to the regulator or a court, and the practical steps you can take now.

When the Privacy Act applies to your business

The first question is scope. The APPs bind APP entities, and most private businesses are APP entities only if they are not small business operators. Under s 6D of the Privacy Act 1988, a business is a small business if its annual turnover for the previous financial year was $3 million or less. Below that line, the APPs generally do not apply to you.

The small business exemption is narrower than it sounds. Under s 6D(4), a business is covered regardless of turnover if it:

Provides a health service: businesses that provide a health service and hold health information are covered, which pulls in medical, dental, allied health, pharmacy and counselling practices.
Trades in personal information: a business that discloses personal information to someone else for a benefit, service or advantage, or collects it for such a benefit, is covered.
Works on Commonwealth contracts: contracted service providers under a Commonwealth contract are covered.
Is a credit reporting body: credit reporting bodies are covered.

A small business operator can also choose to be treated as an organisation by notifying the Commissioner in writing under s 6EA, which brings the full Act across.

Two further points matter even if you fall outside the Act. First, customers, payment providers, platforms and industry codes routinely expect privacy standards in practice, so being exempt is not the same as being immune from complaint. Second, since 10 June 2025 the Act has contained a statutory tort for serious invasions of privacy, and that cause of action is not limited to APP-covered businesses. The question "does the Privacy Act apply to me?" is no longer the only one worth asking.

Your duty to be transparent: privacy policy and collection notices

APP 1 requires a clearly expressed, up-to-date privacy policy that is available free of charge, and APP 5 requires you to notify people at the point of collection about what you are collecting, why, who you disclose it to, and how they can access, correct or complain about their information.

This is the obligation most directly linked to complaints. Most complaints do not arise from malice. They arise from surprise, when what a customer reasonably expected does not match what the business actually did. A privacy policy that matches your real practices, and short collection notice wording on every form, sign-up and checkout, removes much of that surprise before it becomes a dispute.

Your duty to collect only what you need

APP 3 provides that an organisation must not collect personal information unless it is reasonably necessary for one or more of its functions or activities. Sensitive information, such as health information, can only be collected with consent in most cases.

The practical test is simple. If a field on a form is not needed to deliver the service, take it off. Collecting a full birth date when an age range will do, or a phone number when an email suffices, is the kind of over-collection that regulators and complainants notice. The less you hold, the less there is to lose, disclose or argue about.

Your duty to keep personal information secure

APP 11 requires an entity to take such steps as are reasonable in the circumstances to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. It also requires you to destroy or de-identify information once you no longer need it, unless you are required by law to keep it.

For a small business, reasonable steps usually include:

Individual logins: separate accounts for each staff member rather than shared passwords.
Access on a need-to-know basis: customer lists and employee records restricted to the people who actually need them.
Multi-factor authentication: on email, accounting software, customer relationship management systems and cloud storage.
Offboarding discipline: removing access promptly when a staff member or contractor leaves.
Retention timeframes: deciding how long you keep each category of information, and sticking to it.

Security failures are a leading trigger of privacy complaints, and they are also the failure most likely to produce a notifiable data breach.

Your duty to answer access and correction requests

APP 12 gives individuals the right to request access to the personal information you hold about them, and APP 13 gives them the right to request correction. An organisation must respond to an access request within a reasonable period after the request is made, and must not charge for correction requests. Refusal is only available on the limited grounds set out in APP 12.3, such as where access would pose a serious threat to health or safety, or would unreasonably impact another person's privacy.

This is where complaints most often start. Access and correction requests are frequently ignored, delayed or met with confusion about where the information is stored. A request that goes unanswered is not a request that goes away. It becomes a complaint, and eventually a matter for the OAIC. If you can locate the information and respond within a reasonable period, with a written record of what you did, most of these disputes end quietly.

Your duty to notify eligible data breaches

Since the Notifiable Data Breaches scheme in Part IIIC of the Act commenced, businesses covered by the Act must handle data breaches in a structured way. An eligible data breach arises where there is unauthorised access to or disclosure of personal information, or loss of it, and a reasonable person would conclude that the access, disclosure or loss is likely to result in serious harm to any affected individual (s 26WE).

If you suspect an eligible data breach, you must carry out a reasonable and expeditious assessment, with all reasonable steps taken to complete it within 30 days of becoming aware (s 26WH). If you then have reasonable grounds to believe an eligible data breach has happened, you must prepare a statement describing the breach and the kinds of information involved, give it to the Commissioner, and notify affected individuals, as soon as practicable (s 26WK).

This is the obligation that makes preparation worthwhile. In the middle of a suspected breach is the worst time to work out who is responsible, what happened, and how to assess serious harm. A simple written plan, agreed in advance, is what lets a business act calmly and within the statutory timeframes.

Your duty to take complaints seriously

The Act builds in an expectation that you will deal with complaints directly. Under s 40(1A), the Commissioner must not investigate a complaint unless the complainant first complained to the business, unless it was not appropriate for them to do so. In other words, the law gives you a first chance to resolve the matter. The Commissioner may also decline to investigate complaints made more than 12 months after the complainant became aware of the act or practice (s 41).

A defensible response to a complaint looks like this:

Acknowledge quickly: confirm receipt and that you are looking into it. Silence is the fastest way to escalate a complaint.
Work from records: use your data map to identify what information was involved, where it came from, who had access and who it may have been shared with.
Contain ongoing risk: reset passwords, revoke access and contact providers while the investigation proceeds.
Respond with an outcome: explain what happened in plain English, correct inaccurate information, delete information where appropriate, and say what you have changed.
Document everything: a written record of your response is your best evidence if the matter later reaches the OAIC.

What happens if you get it wrong

If a complaint is not resolved, the OAIC can conciliate it (s 40A), investigate it, and make a determination under s 52. A determination can declare that the business has interfered with an individual's privacy, require it to take specified steps to ensure the conduct is not repeated, and require it to redress the complainant's loss or damage, including through compensation. Determinations are enforceable through the Federal Court.

There are also civil penalties. For a serious or repeated interference with privacy under s 13G, a body corporate faces a maximum penalty equal to the greatest of $50 million, three times the value of the benefit obtained from the conduct, or 30% of adjusted turnover during the breach period. For individuals, the maximum is $2.5 million. Other interferences with privacy attract up to 2,000 penalty units under s 13H.

On top of the regulator pathway, individuals can now sue directly. The statutory tort for serious invasions of privacy, in force since 10 June 2025, lets a person sue for intrusion upon their seclusion or misuse of information relating to them, where they had a reasonable expectation of privacy, the invasion was intentional or reckless, and it was serious. Damages are available for emotional distress and, in exceptional circumstances, exemplary damages, capped at the greater of $478,550 or the maximum non-economic loss damages awardable in defamation proceedings.

A short compliance checklist

Work through these items in order:

[ ] Run the scope test: confirm whether the small business exemption applies, including the s 6D(4) exceptions.
[ ] Keep a data map of what you collect, why, where it is stored and who it is shared with.
[ ] Match your privacy policy and collection notice wording to what you actually do.
[ ] Set an access and correction process with a named owner and a response timeframe.
[ ] Write a data breach response plan before you need one.
[ ] Train staff using real scenarios, such as a wrong-recipient email or a customer access request.
[ ] Keep a written record of every complaint and how you responded.

Where a privacy lawyer actually helps

A practitioner can assess whether your business is within the Act, including the less obvious triggers such as health services and trading in personal information. They can draft or review your privacy policy and collection notices so the wording matches your operations, set up the internal process for access and correction requests, and help you build a breach response plan.

When something has already gone wrong, a lawyer can assess whether an incident meets the serious harm test for notification, prepare the statement to the OAIC, respond to a complaint or investigation, and advise on exposure under the civil penalty provisions or the new statutory tort. In a dispute, early legal advice is usually far cheaper than a determination or a penalty.

The obligation that quietly turns complaints into disputes

Of all the duties in this article, one is missed most often: responding to access and correction requests within a reasonable period, with a paper trail. It is the duty with no obvious deadline, no regulator watching, and no event that forces it onto the calendar, so it is the one most easily ignored. Yet it is the most common route from a routine customer request to a formal privacy complaint.

The first action to take this week is to run the scope test in s 6D and, if the Act applies to you, make one person responsible for the access-request inbox and the complaint record. Everything else in this article is easier to build once those two things are in place.