Privacy policies and collection notices, what your business must do under the Privacy Act

Every time your business asks a customer or client for their name, email address or phone number, you trigger a legal obligation you may not have thought about. Under the Privacy Act 1988 (Cth) (the Act), a business that is an "APP entity" must do two things in particular: keep a privacy policy that meets the requirements of Australian Privacy Principle (APP) 1, and notify the person of certain matters at the moment their personal information is collected, under APP 5. That second document, the collection notice, is the one most small to medium businesses have never heard of, even though it applies every time a contact form is submitted.

Getting either document wrong is not a paperwork nuisance. A breach of an APP is an "interference with privacy" that can draw civil penalties of up to $50 million for serious breaches, plus regulator action, and a new statutory tort for serious invasions of privacy now exposes even businesses outside the Act. This article sets out who has to comply, what each document must contain, when you need one rather than the other, and the practical steps to stay compliant.

Who has to comply: the APP entity test

The obligations fall on an APP entity. For most businesses, the test is annual turnover. A business is covered by the Act if its annual turnover for the previous financial year was more than $3 million (s 6D of the Act). Annual turnover is broadly defined as the total of income from the business across sales, commissions, rent, interest and other operating income (s 6DA), and the Office of the Australian Information Commissioner (OAIC) confirms it includes all income from all sources, but not assets held, capital gains or proceeds of capital sales.

Because the test looks at the previous financial year, a business can grow into APP entity status without noticing. If this year's turnover crosses $3 million, the obligations bite next year. A business that has not traded for a full year is assessed on a projection of its first year's turnover.

A business below the threshold is generally exempt, but the exemption does not apply if the business:

provides a health service and holds health information (this catches private hospitals, medical practitioners, pharmacists, allied health providers, complementary therapists, child care centres and private schools, whatever their turnover);
trades in personal information, such as disclosing a customer list for a benefit, service or advantage, or collecting personal information in exchange for a benefit;
is a contracted service provider under a Commonwealth contract;
is a credit reporting body; or
is related to a body corporate that is covered by the Act.

The OAIC's list of exceptions also extends to operators of residential tenancy databases, reporting entities under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), businesses accredited under the Consumer Data Right and businesses prescribed by regulation. A small business can also choose to opt in to the Act under s 6EA. If any of these situations might apply to you, the safe course is to treat your business as an APP entity, because the consequences of guessing wrong are significant.

One further point worth planning for: the Government has flagged the removal of the small business exemption as part of its ongoing privacy reforms, with further legislation in development at the Attorney-General's Department. A business that treats the exemption as a permanent excuse to ignore the APPs is building up a compliance gap that may close within a few years.

Duty 1: publish an APP-compliant privacy policy

APP 1.3 of the Act requires every APP entity to have a clearly expressed and up to date policy about how it manages personal information. "Personal information" is defined in s 6 of the Act as information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information is true or not and whether it is recorded in a material form or not. A customer's name, email address, date of birth, health details and even a username can all be personal information.

Under APP 1.4, the privacy policy must cover, at a minimum:

the kinds of personal information the business collects and holds;
how it collects and holds that information;
the purposes for which it collects, holds, uses and discloses the information;
how an individual can access their information and seek correction;
how an individual can complain about a breach of the APPs, and how the business will deal with the complaint;
whether the business is likely to disclose personal information to overseas recipients; and
if so, the countries where those recipients are likely to be located, to the extent it is practicable to name them.

The policy must be made available free of charge and in an appropriate form, which in practice means on your website (APP 1.5). If someone asks for a copy in a particular form, you must take reasonable steps to provide it that way (APP 1.6). It is not a document you can write once and forget: it must be kept up to date, which matters when your collection practices, third party providers or overseas arrangements change.

APP 1.2 also requires the business to take reasonable steps to implement practices, procedures and systems that ensure it complies with the APPs and can deal with inquiries and complaints. A privacy policy that sits on a website while the business ignores it in practice is only half the obligation.

Duty 2: give a collection notice when you collect personal information

APP 5 is the collection notice obligation, and it is a timing obligation. At or before the time you collect personal information about an individual, or as soon as practicable afterwards if that is not possible, you must take reasonable steps to notify the individual of certain matters, or otherwise ensure they are aware of them (APP 5.1).

The matters in APP 5.2 that a collection notice should cover include:

the identity and contact details of your business;
the fact and circumstances of collection if you collected the information from someone other than the individual, or the individual may not be aware you have it;
if collection is required or authorised by law, the fact of that and the name of the law;
the purposes of the collection;
the main consequences, if any, for the individual if the information is not provided;
the entities or types of entities your business usually discloses that kind of information to;
that your privacy policy explains how the individual can access and correct their information;
that your privacy policy explains how to complain about a breach; and
whether you are likely to disclose the information overseas, and the likely countries where practicable.

The "reasonable steps" standard means a collection notice does not have to be a legal essay. A short, plainly worded notice next to a web form, a verbal notification on a phone call, or a statement on a paper form can each do the job, as long as the relevant matters are actually brought to the person's attention before or at collection.

The obligation also extends to information collected from third parties, for example when you buy a marketing list or receive customer details from a partner. If the individual does not know you have their information, APP 5.2(b) requires you to tell them, including the circumstances of the collection.

Privacy policy or collection notice: which one at the point of collection?

The two documents serve different jobs, and most businesses need both.

The privacy policy is a standing document. It describes, in general, how the business handles personal information across all of its activities, and it must be available whenever anyone wants to read it. The collection notice is an event document. It is tied to a particular collection, tells that particular person the specific things they need to know about that collection, and is given at the moment the information is taken.

Because the two overlap, some businesses try to use the privacy policy as the collection notice, for example by putting a line under a form that says "we handle your personal information in accordance with our privacy policy" with a link. Whether that satisfies APP 5 depends on whether it counts as reasonable steps to notify the individual of the APP 5.2 matters in the circumstances. A link buried in a form is unlikely to make an individual aware of the purposes, the consequences of not providing information or an overseas disclosure, particularly for higher stakes collections such as health information. The safer approach, and the one OAIC guidance materials reflect, is a short collection notice tailored to the collection event that covers the APP 5.2 matters, with the privacy policy linked alongside for the detail. Treat the policy as the reference document and the notice as the notification.

What happens if you get it wrong

A breach of an APP, including a breach of APP 1 or APP 5, is an interference with the privacy of an individual under s 13 of the Act, and it exposes the business to the OAIC's regulatory action and to court imposed penalties:

For a serious or repeated interference, an individual can be penalised up to $2.5 million and a body corporate up to the greatest of $50 million, three times the value of any benefit obtained from the conduct, or 30% of adjusted turnover during the breach period (s 13G).
For other interferences, the maximum is 2,000 penalty units (s 13H), which is $660,000 at the current penalty unit value of $330 set under s 4AA of the Crimes Act 1914 (Cth).
Failing to have a privacy policy, or having one that does not meet the APP 1.4 contents, is a civil penalty provision of its own (s 13K) with a maximum of 200 penalty units, currently $66,000, and the OAIC can issue infringement notices or compliance notices for these breaches without going to court.

The OAIC can investigate on its own initiative or after a complaint, conciliate disputes and make determinations that are enforceable in the Federal Court. It can also accept enforceable undertakings and run privacy assessments of a business's practices.

Two further consequences are easy to overlook. First, under the Notifiable Data Breaches scheme in Part IIIC of the Act, an entity covered by the Act that experiences a data breach likely to result in serious harm must notify affected individuals and the OAIC. Second, since June 2025 the Act has included a statutory tort for serious invasions of privacy in Schedule 2: an individual can sue for a serious, intentional or reckless invasion of their privacy by intrusion upon seclusion or misuse of their information, where they had a reasonable expectation of privacy and the public interest favours them. That cause of action is not limited to APP entities, so a business outside the Act is not automatically safe from a claim.

Your privacy compliance checklist

Work through these steps to put the privacy policy and collection notices in place:

[ ] Confirm whether you are an APP entity: check your annual turnover against the $3 million threshold and work through the exceptions, and repeat the check each year as turnover grows.
[ ] Draft a privacy policy that covers every APP 1.4 item, publish it free of charge on your website and keep it up to date.
[ ] Map every point where your business collects personal information: website forms, account creation, phone calls, in person, and information obtained from third parties.
[ ] Draft a collection notice for each collection point and give it at or before collection, covering the APP 5.2 matters that are relevant.
[ ] Identify any overseas recipients of personal information, such as cloud service or marketing providers, and disclose the likely countries where practicable.
[ ] Put a complaint handling process in place and make sure the privacy policy explains how to complain.
[ ] If you are below the threshold, decide whether to opt in to the Act and prepare the documents anyway, given the exemption is flagged for removal.

How a privacy lawyer can help

The judgment calls in this area are exactly where businesses get into trouble, and they are usually fact specific. A privacy lawyer can help you work out whether you are an APP entity when the position is not obvious, for example where a health service is incidental to your main business or where you exchange customer information with other businesses. They can draft the privacy policy and collection notices so they meet the APP 1.4 and APP 5.2 requirements rather than being marketing documents, and they can review your overseas disclosure arrangements, which are the items most commonly missing. If the OAIC contacts you about a complaint, an investigation or a proposed infringement notice, or if a serious data breach needs a Notifiable Data Breaches assessment, advice at that point can make the difference between a determination with penalties and a managed resolution. An Artificer Legal lawyer can also audit your existing documents against the current law, including the new statutory tort, and tell you what needs to change.

The collection notice is a timing obligation, not a document

If there is one part of this area that businesses most consistently miss, it is that the collection notice obligation is triggered by the act of collection itself, not by your compliance schedule. The moment a customer submits a form or gives you their details over the phone, the APP 5 clock has already started: the notification must happen at or before that moment, not when you get around to updating the website. A privacy policy alone does not protect you if the person was never told, at the point of collection, what you were taking their information for and what would happen to it. Build the privacy policy and the collection notices as a pair, keep the notices at every collection point, and review both whenever your practices change. That is the difference between having documents and being compliant.