Privacy law in Australia: a business guide to the Privacy Act 1988

By the ITLAW Team · Last reviewed November 2026 · General information, not legal advice

What the Privacy Act covers

The Privacy Act regulates how “personal information” is collected, used, disclosed, stored and destroyed. Personal information is information or an opinion about an identified individual, or an individual who is reasonably identifiable. That includes obvious data such as names and addresses, but also IP addresses, device identifiers, location data and customer profiles when they can be linked back to a person.

Some personal information is “sensitive information” and carries stricter rules, including health information, biometric data, racial or ethnic origin, political opinions, religious beliefs, sexual orientation and criminal records. As a general rule, sensitive information can only be collected with consent and where it is reasonably necessary for your functions or activities.

Who has to comply

The Act applies to “APP entities”: Australian Government agencies and organisations with an annual turnover of more than $3 million. Businesses at or below that threshold are usually exempt, but the exemption has significant carve-outs. You are covered regardless of turnover if you:

• provide a health service and hold health information (this includes many allied health, fitness and wellbeing businesses)
• trade in personal information, for example by buying or selling customer lists
• are a contracted service provider to the Commonwealth
• are related to a larger business that is covered
• have opted in to the Act, or are covered by another law that applies the APPs to you, such as reporting entities under the anti-money laundering laws

The small business exemption is one of the issues under review in the Tranche 2 reforms, so smaller businesses should not assume it will last indefinitely.

The 13 Australian Privacy Principles in practice

The APPs are principles rather than a checklist, which gives businesses flexibility but also means you need to show your approach is reasonable. In practical terms they require you to:

• Be open (APP 1): have a clearly expressed, up-to-date privacy policy and practices that let you comply.
• Collect only what you need (APP 3 to 5): collect personal information lawfully and fairly, only where reasonably necessary, and tell people what you are collecting and why at the time of collection.
• Use and disclose for the right purpose (APP 6): use information for the purpose you collected it, or a related purpose the person would reasonably expect, unless an exception applies.
• Follow the direct marketing rules (APP 7): give a simple way to opt out and honour it.
• Take care with overseas disclosure (APP 8): before sending personal information offshore, including to many cloud providers, take reasonable steps to ensure the recipient handles it consistently with the APPs. You can remain accountable for what they do.
• Keep it accurate and secure (APP 10 and 11): take reasonable steps to protect information from misuse, interference, loss and unauthorised access, and destroy or de-identify it when no longer needed.
• Give access and correction (APP 12 and 13): respond to requests from individuals to see or correct their information.

Penalties and enforcement

The Office of the Australian Information Commissioner (OAIC) enforces the Act. Reforms in 2022 and 2024 strengthened its powers considerably. For serious interferences with privacy, a company can face a maximum civil penalty of the greater of $50 million, three times the benefit obtained, or 30% of adjusted turnover for the relevant period. Lower tiers now cover less serious breaches, and the OAIC can issue infringement notices for administrative failures such as a defective privacy policy.

The OAIC has also moved to proactive compliance sweeps. In January 2026 it began reviewing privacy policies across several sectors, so a privacy policy that has not been updated in years is a real risk.

The statutory tort for serious invasions of privacy

Since 10 June 2025, an individual can sue a person or business that seriously invades their privacy by intruding on their seclusion or misusing information about them. The invasion must be intentional or reckless and serious, the person must have had a reasonable expectation of privacy, and the public interest in privacy must outweigh any competing public interest. Unlike most privacy complaints, this claim goes directly to a court and does not require proof of financial loss.

What is changing next

Two dates matter for most businesses:

• 10 December 2026: new APP 1 requirements commence. If you use a computer program to make, or substantially help make, decisions that could significantly affect an individual’s rights or interests, your privacy policy must describe the kinds of personal information used and the kinds of decisions made. This is not limited to AI. See our AI and automated decisions guide.
• By 10 December 2026: the OAIC must register a Children’s Online Privacy Code, which will apply to many online services likely to be accessed by children.

Separately, on 31 August 2026 the Attorney-General released an exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026, the long-awaited “Tranche 2”. It proposes around 40 changes, including broader definitions of personal information, a requirement that handling of personal information be fair and reasonable, a controller and processor model, new individual rights and a direct right of action. The Bill may change before it is introduced, and no commencement date has been set.

A practical privacy checklist

• Map what personal information you collect, where it is stored and who can access it, including cloud and software providers.
• Check whether you are an APP entity, even if your turnover is under $3 million.
• Update your privacy policy and collection notices so they match what you actually do.
• Review contracts with offshore and cloud providers against APP 8.
• Set retention periods and delete data you no longer need.
• Prepare a data breach response plan. See our data breach and cyber security guide.
• Identify any automated decision-making before 10 December 2026.

Frequently asked questions

Does the Privacy Act apply to my small business?

Usually not if your annual turnover is $3 million or less, but you are covered regardless of size if, for example, you provide a health service, trade in personal information or contract to the Commonwealth.

What counts as personal information?

Any information or opinion about an identified individual, or one who is reasonably identifiable. It can include names, contact details, IP addresses, device IDs and location data.

Can I store customer data overseas?

Yes, but under APP 8 you must generally take reasonable steps to ensure the overseas recipient handles it consistently with the APPs, and you may remain accountable for its handling.

What is the maximum penalty for a privacy breach?

For a serious interference with privacy, a company faces a maximum civil penalty of the greater of $50 million, three times the benefit obtained, or 30% of adjusted turnover.

Further reading: OAIC guidance for businesses · Privacy Act 1988 (Cth)