The Privacy Act 1988 requires covered entities to put privacy policy into practice through their systems. If you cannot restrict access, find data, apply retention rules, or trace an incident, the policy will not be enough.
Clients, tender panels, and insurers may ask for proof. To provide it, know the current duties, proposed reforms, and records your security work produces.
But, before we discuss the many aspects, always remember that anything in this article is general information only and is not legal advice.
Now, let’s nut it out.
What Is the Privacy Act 1988?
The Privacy Act 1988 (Cth) is Australia’s central federal law for handling personal information. It establishes the Australian Privacy Principles (APPs) and Notifiable Data Breaches (NDB) scheme.
Now, let’s break down what information the Act covers and which data needs extra protection.
What the Act Is Designed to Protect
The Privacy Act 1988 is designed to govern how covered entities collect, use, disclose, secure, and dispose of personal information.
Because it moves through databases, tickets, emails, SaaS systems, backups, logs, devices, files, and supplier systems, map where it sits and who can access it.
That map gives each duty an owner, control, and evidence.
Also, It supports cybersecurity compliance when a client, insurer, or regulator asks how you protect personal information.
Personal Information vs Sensitive Information
Personal information identifies someone or makes them reasonably identifiable, while sensitive information is a protected subset.
For a covered entity, the Privacy Act treats sensitive information as a protected category within personal information.
This changes how you collect it, while APP 11 requires you to protect both types from misuse, loss, unauthorised access, change, and disclosure. Hence, use your data inventory to separate them.
Personal information identifies a person, or makes them reasonably identifiable, which can include:
- Names and contact details
- IP addresses and location data
- Support tickets and account records
- Separate data fields that identify someone when combined.
Sensitive information needs tighter collection controls. APP 3 generally requires consent before you collect it, unless an exception applies, which includes:
- Health, genetic, and specified biometric information
- Racial or ethnic origin
- Political or religious views
- Trade-union membership
- Sexual orientation or practices
- Criminal records.
Once you identify sensitive information, limit access, record why you hold it, encrypt it where appropriate, monitor its use, and remove it when you no longer need it.
The 13 Australian Privacy Principles
The 13 Australian Privacy Principles govern data from collection to disposal. They tell you what you may collect and use, how to protect it, and when people may access or correct it.
Collecting and Handling Personal Information
APPs 1 to 7 and 9 govern why you collect personal information and what you may do with it:
- APP 1: Manage information openly through a current policy and working practices.
- APP 2: Allow anonymity or pseudonymity where practicable.
- APP 3: Collect only what your work reasonably needs, with extra conditions for sensitive information.
- APP 4: Assess unsolicited information and remove it if you could not lawfully collect it.
- APP 5: Tell people why and how you collect their information.
- APP 6: Limit use and disclosure to the primary purpose or an authorised secondary purpose.
- APP 7: Manage direct marketing and opt-out requests.
- APP 9: Restrict how you adopt, use, and disclose government-related identifiers.
Apply those rules in the systems people use.
However, you need limit form fields, record each purpose, version notices and consent, log access, honour opt-outs, and document exceptions.
Data Quality, Security, and Retention
Building on the collection and handling principles discussed above, APPs 10 and 11 address how you maintain, protect, and dispose of that personal information:
- APP 10 (Data Quality): Take reasonable steps to ensure the personal information you collect, use, or disclose is accurate, up-to-date, and complete.
- APP 11 (Data Security & Retention): Protect stored data from misuse, loss, interference, unauthorised access, modification, or disclosure, and securely destroy or de-identify it when no longer needed.
These security duties directly translate into technical requirements.
Following the 2024 amendments, technical and organisational safeguards are explicit under APP 11. Several core controls to implement include:
- Access & Authentication: Enforce least privilege access models and mandatory multifactor authentication (MFA).
- Data Protection & Visibility: Use automated data discovery, robust encryption, and data loss prevention (DLP) tools to monitor transfers and enforce data classification.
- Infrastructure & Maintenance: Maintain secure system configurations, prompt vulnerability patching, comprehensive logging, and routinely tested backups.
- Lifecycle Management: Set up automated retention schedules to ensure data is destroyed or anonymised once its operational and legal requirements end.
These controls work best when paired with ongoing security awareness training, since strong technical safeguards can still fail if staff misuse access or fall for social engineering.
Access, Correction, and Cross-Border Disclosure
Alongside maintaining quality and security, you must also manage how personal information is shared overseas, accessed, and corrected under APPs 8, 12, and 13:
- APP 8 (Cross-Border Disclosure): Take reasonable steps before disclosing data overseas to ensure recipients protect it. Because a cloud region alone does not determine access, review data flows, administrator permissions, sub-processors, and supplier contracts.
- APP 12 (Access): Provide individuals with access to their personal information upon request. Verify identity, maintain searchable records, and manage export controls to fulfil requests efficiently.
- APP 13 (Correction): Take reasonable steps to correct inaccurate or outdated data. Track requests systematically and update any downstream copies to maintain data accuracy across systems.
Who Does the Privacy Act Apply To?
The Privacy Act 1988 applies to:
- Australian Government agencies
- Private sector organisations with an annual turnover of more than A$3 million
- Specific small businesses that meet statutory criteria or engage in higher-risk data activities.
The exact scope depends on your entity type, revenue, and specific business operations.
APP Entities and Australian Government Agencies
The Privacy Act primarily regulates APP entities, which comprise all Australian Government agencies and covered private sector organisations.
State and territory public-sector bodies often sit under separate laws, although some duties overlap.
The Act can also reach offshore. If you operate across borders, check the Australian-link test and local laws instead of relying on server location.
The A$3 Million Annual Turnover Threshold
Most private organisations with annual turnover greater than A$3 million must comply. The small-business rules generally use the previous financial year.
But turnover does not settle coverage. Group structure, acquisitions, and regulated services can change the result, so record and review your decision.
Small Businesses That Must Comply Regardless of Turnover
Some small businesses must comply regardless of turnover, because the OAIC’s coverage guidance includes the following, even where turnover is A$3 million or less:
- Private health providers
- Personal-information traders
- Credit-reporting bodies
- Commonwealth contracted service providers
- Registered employee associations
- Accredited Consumer Data Right participants
- Businesses that opt in.
However, an exception may cover one service rather than the whole business.
Thus, if you support a Commonwealth contract or health platform, trace the data used before treating the wider environment as exempt.
Credit Reporting, Health, and Tax File Number Rules
Credit reporting, health information, and tax file numbers (TFNs) are subject to specific, stricter privacy requirements that apply regardless of standard organisation thresholds.
Part IIIA and its code govern credit information, while sensitive-information and TFN rules can reach beyond ordinary APP coverage.
Because those rules differ, name each data type and then set its access and disposal rules.
After all, a single confidential label can mask the fact that some material is still a draft.
The Notifiable Data Breaches Scheme
The Notifiable Data Breaches (NDB) scheme requires covered entities to act when a breach is likely to cause serious harm, which is why your team must:
- Establish what counts as a data breach
- Assess whether it is eligible
- Take all reasonable steps to finish that assessment within 30 days
- Notify the OAIC and affected people as soon as practicable when notification is required.
The OAIC’s NDB publications track the breaches entities have reported.
They show why your team needs current data maps, logs, and access records before deciding whether serious harm is likely.
What Counts as an Eligible Data Breach
An eligible data breach generally exists when all three conditions apply:
- Personal information is accessed or disclosed without authorisation, or it is lost in circumstances likely to lead to either outcome;
- A reasonable person would conclude that serious harm to at least one individual is likely; and
- Remedial action has not removed that likelihood.
Those tests make early containment matter. Check what escaped, whether usable encryption protected it, who received it, and what harm could follow.
If your actions make serious harm unlikely, the breach may no longer require notification.
Assessment and Reporting Timeframes
You must assess a suspected eligible breach reasonably and expeditiously, taking all reasonable steps to finish within 30 days.
That is the outer limit, so start as soon as you have grounds for suspicion.
If the assessment confirms an eligible breach, prepare a statement for the Information Commissioner and notify affected or at-risk people as soon as practicable.
Be aware that data maps, logs, DLP alerts, endpoint telemetry, encryption status, and supplier records show who and what were affected.
Key Amendments and Recent Updates
Australia’s privacy framework is rapidly evolving through legislative updates and major review proposals that expand regulatory oversight and introduce direct legal remedies.
The following subsections outline the initial review recommendations, the key changes enacted under the 2024 Amendment Act, and the new statutory cause of action for serious privacy breaches.
The Privacy Act Review and Government Response
The Privacy Act Review provided the foundational roadmap for comprehensive privacy reform by recommending broader statutory coverage and stricter personal data safeguards.
In September 2023, the government agreed to many of these proposals in principle, setting the trajectory for ongoing legislative updates.
We recommend you to use the review to plan ahead, but build today’s controls around provisions already in force.
The 2024 Privacy and Other Legislation Amendment Act
The 2024 amendments confirm that APP 11 can require technical and organisational measures when you secure or dispose of personal information.
They also give the OAIC more ways to oversee privacy obligations.
From 10 December 2026, your privacy policy must cover certain automated decisions. If a computer program makes, or directly supports, a decision that significantly affects a person’s rights or interests, include the prescribed details in the policy.
Start by listing the systems that make those decisions, then check what each policy entry needs to explain.
The Statutory Tort for Serious Invasions of Privacy
The statutory tort provides individuals with a direct legal remedy to sue entities for serious, intentional, or reckless invasions of privacy.
Enforceable since 10 June 2025, it applies where a reasonable expectation of privacy exists and is not outweighed by public interest considerations.
Because the tort can apply even when the small-business exemption does, check:
- Who has privileged access?
- What tools monitor or record?
- How do you investigate insiders?
- Who approved each use?
Enforcement and Penalties
Enforcement of the Privacy Act is overseen by the Office of the Australian Information Commissioner (OAIC), which holds broad powers to investigate breaches and apply a tiered structure of civil penalties and infringement notices.
Below, we break down the regulatory role of the OAIC and the specific penalty levels organisations can face for non-compliance.
The Role of the OAIC and the Information Commissioner
The OAIC handles:
- Complaints
- Investigates conduct
- Checks privacy practices
- Makes determinations
- Issues directions and notices
- Accepts enforceable undertakings
- Starts civil penalty proceedings.
Those powers make your records important, which is why they should show:
- What information you held
- Which safeguards ran
- When you found the incident
- How you judged the harm
- Who decided what
- Which fixes you completed.
Civil Penalties and Infringement Notices
Civil penalties and infringement notices are financial statutory remedies enforced by the OAIC to penalise privacy breaches, scaled according to the severity and nature of the non-compliance.
Under the current Privacy Act, the maximum penalty for a body corporate that seriously interferes with privacy is the greatest of A$50 million, three times the attributable benefit, or 30% of adjusted turnover during the statutory period when the benefit cannot be determined.
For another person, it is A$2.5 million.
For lower tiers, the 2024 reforms set a maximum of 2,000 penalty units for non-serious interference and 200 for specified administrative APP or NDB statement breaches.
The OAIC can use infringement or compliance notices for the latter. None of these maximums applies automatically whenever a breach occurs.
What Further Reform Could Mean for Australian Businesses
Further privacy reform could change who must comply with the Privacy Act and how covered businesses handle personal information.
The small-business exemption remains in force today, while the proposed measures below are not yet legal duties.
The first change concerns coverage. The second concerns how organisations collect, market, secure, and report on personal information.
Removal of the Small Business Exemption
The small-business exemption has not changed. If your business turns over A$3 million or less, it generally has no duties under the Privacy Act unless an existing exception covers the work you do.
The 2026 exposure draft keeps that position. Consultation has closed, but the draft remains a proposal.
A client can set privacy terms in a contract, even though it cannot change whether the Act applies to your business.
The next proposals concern what covered organisations do when they collect, use, and report on personal information.
Fair and Reasonable Handling and Direct Marketing Limits
Under the draft, covered organisations would need to show that their handling of personal information is fair and reasonable.
It would also change direct-marketing rules and require a statement to the OAIC within 72 hours once an organisation has reasonable grounds to believe an eligible data breach occurred.
The 30-day limit for assessing a suspected breach would remain.
If the Bill becomes law, check whether your team can:
- Explain why you collect each type of personal information, then remove fields you do not need;
- Honour marketing opt-outs and record when you share personal information; and
- Turn an incident log into a statement for the OAIC within 72 hours.
What the Privacy Act Means for Australian SMBs
Australian SMBs must build active technical safeguards into their systems to comply with the Privacy Act 1988, rather than relying on static policies.
While drafting a privacy notice sets your intent, managing obligations effectively begins by evaluating whether the law applies to your current operations and contractual commitments.
Working Out Whether Your Business Is Covered Today
Determining whether the Privacy Act applies to your business comes down to what you do and what you have agreed to, not just your annual turnover.
While revenue offers a quick starting point, specific exceptions and contract terms can easily bring smaller organisations under the law.
To clarify your obligations, consider the following four key questions:
- What are your entity type, turnover, group structure, and opt-in status?
- Do regulated activities or Commonwealth contract work bring you into scope?
- Do special data or state and territory rules apply?
- Do contracts, tenders, or supplier terms impose extra duties?
Recheck whenever you acquire a business, launch a service, add a data partner, or take on government work.
Also, seek legal advice if coverage remains disputed.
Practical Steps to Get Compliant
Achieving practical privacy compliance requires translating abstract Australian Privacy Principles into specific technical workflows, assigned internal roles, and documented audit records.
By assigning exact operational owners to each privacy duty, you ensure that system controls remain active and that verifiable proof is available when third-party request evidence:
| Privacy duty | What to do | Evidence to keep |
|---|---|---|
| Collect only what you need | Record the purpose and remove unused fields | Data inventory, approved forms, and notice versions |
| Restrict and protect access | Use least privilege, MFA, encryption, and access reviews | Configurations, reviews, and exceptions |
| Find and fix weaknesses | Patch by risk, run a vulnerability assessment to track vulnerabilities, and verify fixes | Scan results, owners, due dates, and retests |
| Retain data only as required | Set retention periods and automate suitable disposal | Retention schedule, deletion jobs, and disposal records |
| Detect and respond to breaches | Centralise logs and test your NDB decisions | Alerts, incident timeline, decision log, and notification templates |
| Control supplier access | Record data flows, access, locations, and response duties | Contracts, assurance reports, and supplier reviews |
Where the Essential Eight and SMB1001 Fit
The Essential Eight and SMB1001 help you run security controls that support the work APP 11 requires, but neither proves you meet every Privacy Act duty, and understanding how the two frameworks compare shows exactly where that gap sits.
To protect personal information while covering the duties outside APP 11, use each for a different job:
- Essential Eight: Helps reduce common attack paths through patching, multifactor authentication, access controls, and recoverable backups.
- SMB1001: Gives your SMB a staged way to build, assign, and review security controls.
- Privacy works outside both frameworks: Covers why you collect data, how long you keep it, how you handle consent, and how you respond to people’s requests.
After applying the frameworks, check the privacy work they do not cover:
- Can you find personal data across your systems?
- Can you record consent and control overseas transfers?
- Can you apply retention rules and delete data when required?
- Can you respond to access and correction requests?
- Can you assess a suspected eligible data breach?
How Privacy Obligations Affect Cyber Insurance Cover
Your privacy records can support a cyber insurance application because they show what personal information you hold and how you protect it.
However, be aware because each insurer and policy differs, but underwriters may ask whether your controls work in practice.
We recommend you to keep current evidence for the areas they often review:
- Multifactor authentication (MFA): Shows where you require stronger sign-in protection.
- Access management: Shows who can reach personal information and how you review that access.
- Incident response: Shows how your team detects, contains, assesses, and reports a suspected breach.
- Vulnerability management: shows how you identify weaknesses, assign fixes, and track overdue work.
Answer from current records. Inaccurate information or unmet policy conditions may affect your terms or a claim.
The same records can also help you answer buyer questionnaires, show that you fixed findings, and support a tender or contract review.
Meet Your Privacy Act 1988 Obligations With Redscale
If your business handles personal information, meeting your Privacy Act 1988 obligations isn’t optional. Clients, tender panels, and insurers often stall deals when businesses can’t produce clear evidence of access controls, retention practices, or incident response records.
Redscale is a team of CREST and OSCP-certified security specialists helping Australian businesses meet their Privacy Act obligations. We offer penetration testing, managed security services, and vulnerability management to help you build the access controls, incident detection, and audit evidence your APP 11 and NDB duties require.
Book a free discussion with the Redscale expert team to review your security stance and prepare for your next major contract.
