Australia's primary privacy legislation — 13 principles governing how personal information is collected, used, stored and protected. Including the Notifiable Data Breaches scheme.
The Privacy Act 1988 is Australia's primary privacy legislation, governing how personal information is collected, used, disclosed, stored and destroyed. At its core are the 13 Australian Privacy Principles (APPs), which apply to Australian Government agencies and private sector organisations with annual turnover above $3 million — though many smaller organisations are also captured.
The Act was significantly amended by the Notifiable Data Breaches (NDB) scheme in 2018, which introduced mandatory notification obligations when a data breach is likely to result in serious harm. Further reforms are underway following the Attorney-General's Privacy Act Review Report.
All Australian Government agencies, private sector organisations with annual turnover above $3 million, health service providers, organisations that trade in personal information, and organisations related to entities covered by the Act. Many organisations below the turnover threshold opt in or are captured by sector-specific requirements.
Maintain a clearly expressed privacy policy. Give individuals the option of not identifying themselves where practicable.
Collect only personal information that is reasonably necessary. Deal with unsolicited information appropriately.
Notify individuals about the collection of their information. Use and disclose only for the purpose of collection or a permitted exception.
Use personal information for direct marketing only with consent or within reasonable expectations, with an opt-out mechanism.
Take reasonable steps to ensure overseas recipients handle information in accordance with the APPs.
Handle government identifiers appropriately. Take reasonable steps to ensure personal information is accurate, complete and up to date.
Protect personal information from misuse, interference, loss and unauthorised access or disclosure. Destroy or de-identify when no longer needed.
Give individuals access to their personal information and the ability to request correction of inaccurate information.
Since February 2018, organisations must notify affected individuals and the Office of the Australian Information Commissioner (OAIC) when a data breach is likely to result in serious harm. Notification must occur as soon as practicable after the organisation becomes aware of the breach. Failure to notify can attract civil penalties. The NDB scheme applies to all organisations covered by the Privacy Act.
We help organisations build the security controls that underpin Privacy Act compliance — particularly APP 11 (security of personal information) and the NDB scheme. This includes data mapping, privacy impact assessments, breach response planning, and integrating privacy obligations into your broader security governance framework.
Discuss Privacy ComplianceBook a free 30-minute call with Doug. No obligation — just an honest conversation about your compliance posture and what it would take to close the gaps.
Book a Discovery Call