The 13 Australian Privacy Principles explained

By the ITLAW Team · Last reviewed November 2026 · General information, not legal advice

Guides › Privacy & Data Protection › The 13 APPs

The Australian Privacy Principles (APPs) in Schedule 1 of the Privacy Act 1988 (Cth) are the core rules for how covered businesses handle personal information. They are principles-based: rather than prescribing exact steps, they require you to take “reasonable steps” suited to your business and the information you hold. If you are not sure whether the APPs apply to you, start with our small business exemption guide.

Part 1: Open and transparent management

• APP 1, open and transparent management: have practices, procedures and systems to comply with the APPs, and a clearly expressed, up-to-date privacy policy. From 10 December 2026 the policy must also cover certain automated decision-making.
• APP 2, anonymity and pseudonymity: let people deal with you anonymously or under a pseudonym where that is lawful and practicable, for example for general enquiries.

Part 2: Collecting personal information

• APP 3, collection of solicited information: only collect information reasonably necessary for your functions or activities, by lawful and fair means, and generally directly from the individual. Sensitive information usually needs consent.
• APP 4, unsolicited information: if you receive information you did not ask for, decide whether you could have collected it under APP 3. If not, destroy or de-identify it where lawful and reasonable.
• APP 5, notification: at or before collection, tell people who you are, why you are collecting their information, who you usually disclose it to and how to access your privacy policy.

Part 3: Dealing with personal information

• APP 6, use or disclosure: use or disclose information only for the primary purpose of collection, or a secondary purpose the person would reasonably expect and that is related (directly related for sensitive information), unless consent or another exception applies.
• APP 7, direct marketing: direct marketing is restricted. People must be able to opt out easily, and you must honour requests. Email and SMS marketing is also governed by the Spam Act.
• APP 8, cross-border disclosure: before disclosing to an overseas recipient, take reasonable steps to ensure it does not breach the APPs. You can remain accountable for its handling.
• APP 9, government related identifiers: do not adopt government identifiers such as tax file numbers or Medicare numbers as your own customer identifiers, and limit their use and disclosure.

Part 4: Integrity of personal information

• APP 10, quality: take reasonable steps to keep information accurate, up to date, complete and relevant.
• APP 11, security: protect information from misuse, interference, loss, unauthorised access, modification and disclosure, and destroy or de-identify it when no longer needed. Since the 2024 reforms, reasonable steps expressly include technical and organisational measures.

Part 5: Access and correction

• APP 12, access: give individuals access to their information on request, within a reasonable time, subject to limited exceptions.
• APP 13, correction: correct information that is inaccurate, out of date, incomplete, irrelevant or misleading, and respond to correction requests.

Where businesses most often fall short

• Privacy policies that do not match actual practices (APP 1).
• No collection notice on web forms (APP 5).
• Data kept indefinitely “just in case” (APP 11).
• Offshore cloud and support providers not assessed (APP 8).
• No process for access requests (APP 12).

Frequently asked questions

How many Australian Privacy Principles are there?

There are 13 Australian Privacy Principles, set out in Schedule 1 of the Privacy Act 1988 (Cth).

Who has to comply with the APPs?

APP entities: Australian Government agencies and organisations with annual turnover above $3 million, plus some smaller businesses such as health service providers and businesses that trade in personal information.

Which APP covers data security?

APP 11 requires reasonable steps to protect personal information and to destroy or de-identify it when it is no longer needed.

← Back to the Privacy & Data Protection guide