The employee records exemption under the Privacy Act

By the ITLAW Team · Last reviewed November 2026 · General information, not legal advice

Guides › Workplace Technology › Employee records exemption

The Privacy Act 1988 (Cth) exempts private sector employers from the Australian Privacy Principles for certain handling of employee records. Many employers assume this means staff information is outside privacy law altogether. It is not.

What the exemption covers

The exemption applies to an act or practice of a current or former employer that is directly related to a current or former employment relationship and to an employee record held by the employer about the employee. An employee record includes information about engagement, training, discipline, performance, terms and conditions, leave, pay, union membership and health relating to the employment.

What it does not cover

• Job applicants: information about unsuccessful or prospective candidates.
• Contractors and volunteers: they are not employees.
• Uses not directly related to employment: for example, selling staff data or using it for unrelated marketing.
• Disclosure to third parties that is not directly related to the employment relationship.
• Government employers, who are covered by other rules.

Other laws still apply

• The statutory tort for serious invasions of privacy, see our article on the privacy tort.
• The Notifiable Data Breaches scheme for information outside the exemption.
• State health records laws, such as the Health Records and Information Privacy Act 2002 (NSW).
• The Fair Work Act 2009 (Cth) record-keeping rules and workplace surveillance laws.

Reform

The Tranche 2 exposure draft addresses the employee records exemption. Employers should treat staff information with APP-level care now, including security and access controls.

Frequently asked questions

Does the Privacy Act apply to employee records?

For private sector employers, acts directly related to the employment relationship and an employee record are generally exempt from the APPs. Other laws still apply.

Are job applicants covered by the exemption?

No. Information about job applicants is not an employee record of a current or former employee, so the APPs can apply.

Can employees sue for misuse of their information?

Potentially, under the statutory tort for serious invasions of privacy, which is not limited by the employee records exemption.

← Back to the Workplace Technology guide