Australia Privacy Act 1988: The Complete Guide
Australia's Privacy Act 1988 is one of the Asia-Pacific region's longest-standing privacy laws. Substantially reformed in 2014 with the introduction of the 13 Australian Privacy Principles (APPs) and again in 2018 with the Notifiable Data Breaches scheme, the Act establishes a comprehensive framework for the handling of personal information by Australian Government agencies and private sector organizations.
What the Privacy Act Covers
The Privacy Act is built around 13 Australian Privacy Principles that cover the full lifecycle of personal information. APP 1 requires open and transparent management. APPs 2-5 govern collection, including rules for solicited and unsolicited information and notification requirements. APPs 6-9 address use, disclosure, direct marketing, and cross-border disclosure. APPs 10-13 cover quality, security, access, and correction.
Sensitive information — including health, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, and biometric data — requires consent for collection and is subject to stricter handling requirements.
The Notifiable Data Breaches scheme, introduced in February 2018, requires organizations to notify the OAIC and affected individuals when a data breach is likely to result in serious harm. Organizations must complete a reasonable assessment of a suspected breach within 30 days.
Who Needs to Comply
The Privacy Act applies to Australian Government agencies, private sector organizations with annual turnover exceeding AUD 3 million, health service providers, and certain other entities regardless of turnover. Small businesses below the turnover threshold may opt in or may be brought within scope through regulations.
Organizations outside Australia that collect or hold personal information of Australian residents may also be subject to the Act under its extraterritorial provisions.
Ongoing Reform
The Australian Government's Privacy Act Review (released in 2023) proposes significant reforms including a statutory tort for serious privacy invasions, a children's privacy code, enhanced enforcement powers, and alignment with international standards. Organizations should monitor these developments closely.
Practical Compliance Steps
- APP compliance review — Assess practices against all 13 Australian Privacy Principles
- Privacy policy — Publish a clear, current privacy policy meeting APP 1 requirements
- Collection notices — Provide APP 5 collection notices at or before the time of data collection
- NDB response plan — Establish breach identification, assessment, and notification procedures
- Cross-border disclosures — Assess overseas recipients and ensure APP 8 accountability
- Access and correction — Implement processes for individuals to access and correct their information