The Australian Privacy Principles tell covered organisations how to collect, use, protect, and dispose of personal information.
If they apply to your SMB, your team must decide what to collect, who can see it, which suppliers can hold it, and when to delete it. Customers and insurers may ask you to prove those decisions.
Knowing the rules is only the start. APP 11 tests whether your systems can prove you follow them.
The following discussion will address it.
What Are the Australian Privacy Principles and the Privacy Act 1988?
The Australian Privacy Principles, or APPs, are 13 binding rules under the Privacy Act 1988 for how APP entities handle personal information.
The APPs are principles-based and technology-neutral, so they do not prescribe one tool. Your response should match the information, likely harm, and how your business works.
The Office of the Australian Information Commissioner (OAIC) administers the law and publishes guidance rather than a fixed cybersecurity checklist.
Meanwhile, the Personal Information (PI) covers information or an opinion about an identified or reasonably identifiable person.
PI includes contact, account, financial, location, employment, and health data. Separate details may identify someone when combined.
Who Has to Comply with the Australian Privacy Principles?
The APPs generally apply to Australian Government agencies and organisations with annual turnover above AU$3 million, although several smaller businesses are also covered.
The AU$3 million threshold is only one test. Your small business may still need to comply if it:
- Provides a health service or trades in personal information
- Provides services under a Commonwealth contract
- Is a credit reporting body or covered credit provider
- Is accredited under the Consumer Data Right system
- Is related to a covered organisation, has opted in, or falls within another specified category.
Other rules may cover particular records or activities, including state and territory health-records laws.
Coverage under the Act is not the only question. Customers may put privacy clauses in contracts, require supplier standards, or send security questionnaires.
Your cybersecurity compliance work should track those obligations alongside the APPs.
An exemption will not stop onboarding or a tender from slowing down if your team cannot show how your business handles personal information.
The 13 Australian Privacy Principles Explained
The 13 APPs follow personal information from collection to correction, de-identification, or deletion. APPs 1 to 5 govern management and collection.
APPs 6 to 9 control use and disclosure, while APPs 10 to 13 cover quality, security, access, and correction.
The OAIC’s Australian Privacy Principles guidance gives the regulator’s wording and guidelines.
APP 1 – Open and Transparent Management of Personal Information
APP 1 requires you to manage personal information openly and keep your privacy policy aligned with staff and systems.
Publish it, update it, and name who handles enquiries, complaints, and reviews.
From 10 December 2026, affected entities must also describe specified uses of personal information in certain automated decisions.
APP 2 – Anonymity and Pseudonymity
APP 2 requires you to allow anonymity or a pseudonym when lawful and workable.
An enquiry may not need a legal name, although a regulated account may require verified identity.
Ideally, you ask only when the transaction needs it.
APP 3 – Collection of Solicited Personal Information
APP 3 limits you to personal information that your functions or activities reasonably need, while sensitive information usually requires consent.
Remove form fields, tracking, and imports that your team cannot tie to a current purpose.
APP 4 – Dealing with Unsolicited Personal Information
APP 4 governs personal information that arrives unrequested. Decide whether APP 3 would have allowed collection.
If not, destroy or de-identify it when lawful and reasonable, and tell staff where to hold it while you decide.
APP 5 – Notification of the Collection of Personal Information
APP 5 requires you to tell people specified facts at or before collection, or as soon as practicable afterwards.
Place a tailored notice beside each web form, app screen, call script, or paper form because a general privacy policy does not replace it.
APP 6 – Use or Disclosure of Personal Information
APP 6 generally keeps personal information tied to the purpose for which you collected it.
Before sending data to a partner, analytics platform, or AI tool, write down the new purpose and confirm that consent, reasonable expectation, or another permitted basis allows it.
APP 7 – Direct Marketing
APP 7 limits when you may use or disclose personal information for direct marketing.
Before a campaign, check how you obtained the data, offer a simple opt-out, and honour it within a reasonable period. The Spam Act and Do Not Call Register Act may also apply.
APP 8 – Cross-Border Disclosure of Personal Information
APP 8 generally requires reasonable steps before you disclose personal information overseas, and you may remain accountable for the recipient.
Record where providers store it, which overseas teams can open it, where it goes next, and how providers report breaches or delete copies.
APP 9 – Adoption, Use or Disclosure of Government Related Identifiers
APP 9 restricts your adoption, use, or disclosure of government related identifiers unless an exception applies.
Do not turn a Medicare, tax file, driver licence, or passport number into a convenient customer key, filename, or support reference.
APP 10 – Quality of Personal Information
APP 10 requires reasonable steps to keep collected information accurate, up to date, and complete, while information you use or disclose must also be relevant.
Check important fields, record when you checked them, and send corrections through connected systems.
APP 11 – Security of Personal Information
APP 11 requires reasonable steps, including technical and organisational measures, to protect personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure.
Destroy or de-identify it when you no longer have a permitted reason to keep it. This duty also reaches supplier copies under your control.
APP 12 – Access to Personal Information
APP 12 generally gives a person the right to access personal information you hold about them.
Set one request route, verify identity, search relevant systems and suppliers, apply any lawful exception, and respond within the required period in a usable form where reasonable.
APP 13 – Correction of Personal Information
APP 13 requires reasonable steps to correct information that is inaccurate, out of date, incomplete, irrelevant, or misleading for its purpose.
Record the request, decision, and action, then notify previous recipients when required and practicable.
Penalties for Breaching the Australian Privacy Principles
Breaching an APP can lead to an OAIC investigation, enforceable undertaking, determination, or court action, although the outcome depends on the conduct, the harm caused, and how your organisation responds.
For serious or repeated interference with privacy, a court can impose a civil penalty. The maximum for a body corporate is the greatest of:
- AU$50 million;
- three times the benefit attributable to the contravention; or
- 30% of adjusted turnover during the relevant breach turnover period when the benefit cannot be determined.
For a person other than a body corporate, the maximum is AU$2.5 million. The court decides whether to impose a penalty and how much it should be.
A breach may also trigger notification duties.
Under the Notifiable Data Breaches scheme, you must take all reasonable steps to assess a suspected eligible breach within 30 calendar days.
If you have reasonable grounds to believe an eligible breach occurred and remedial action has not removed the likely risk of serious harm, notify the OAIC and affected people as soon as practicable.
The OAIC received 1,205 notifications in 2025, the highest annual total since mandatory reporting began.
When an incident reaches your team, a writtendata breach response helps you contain it, preserve evidence, and decide whether notification is required.
Australian Privacy Principles Best Practices
APP compliance best practices require your businesses to embed privacy into daily operations through proactive data minimisation, continuous vendor oversight, and timely notices, which together ensure controls remain robust as operational risks evolve.
The following practical steps detail how to manage personal information responsibly across every stage of its lifecycle.
Collect and Retain De-Identified Data Where Possible
Use de-identified data when you do not need to know who the person is. It reduces what an exposed report or test dataset can reveal.
However, if other fields could identify someone, keep treating the dataset as personal information. Delete or de-identify it when retention is no longer permitted.
Obtain Consent for New Uses or Sharing of Personal Data
Ask for consent before a new use or disclosure that the APPs do not otherwise permit. Record what people agreed to and why.
APP 6 sometimes allows an expected secondary use. Check that basis before you connect a new platform, share the data, or reuse it for another purpose.
Check a supplier before it receives personal information.
Put access controls, breach reporting, overseas access, and deletion requirements in its contract.
Review the supplier again when its service, sub-processors, or hosting location changes, because outsourcing the work does not transfer your APP duties.
Notify Individuals When You Collect Their Personal Information
Give people a collection notice before or when they provide personal information.
Put it beside the form, call script, or paper workflow so it reaches them at the right time.
State who collects the data, why it is needed, who usually receives it, whether it may go overseas, and how the person can access, correct, or complain about it.
Protect the Personal Information You Hold
Protect personal information wherever people store, open, share, or delete it.
In this phase, consider using data loss prevention to watch sensitive data as it moves.
MFA, patching, encryption, monitoring, and backups reduce different forms of exposure or loss. Set retention dates and verify disposal once your business no longer needs the data.
What APP 11 Means for an Australian SMB’s Security Controls
APP 11 means your SMB must use security controls that match the personal information it holds and the harm a breach could cause.
The Essential Eight reduces common technical risks, SMB1001 helps you assign the work and keep proof, and insurer questions test whether those controls still run.
Together, they turn reasonable steps into work your team can track.
If you are unsure where to start, weigh the Essential Eight against SMB1001 first.
Mapping Reasonable Steps to the Essential Eight
The Essential Eight reduces the chance that an attacker can run malicious code, exploit an unpatched system, or take over a privileged account.
APP 11 also reaches the data itself, your suppliers, your staff, and the way you retain or delete information. Each Essential Eight measure, therefore, needs the privacy work besides it:
| APP 11 risk | What the Essential Eight does | What you still need to do |
|---|---|---|
| Unauthorised access or code execution | Use MFA, restrict admin rights, control applications, and harden user applications | Classify data, review access, and apply DLP |
| Known weaknesses | Patch applications and operating systems | Track assets and check supplier systems |
| Data loss or destructive attacks | Keep and test regular backups | Encrypt data, monitor activity, and rehearse incident response |
Those pairings only help if you record which systems and data are covered, who runs the control, when it was tested, and which exceptions remain.
Add physical safeguards, staff training, retention rules, and reliable destruction or de-identification where your risks require them.
Where SMB1001 Certification Supports APP Compliance
SMB1001 gives you a sequence for putting controls in place, naming who runs them, and keeping proof for customers or assessors.
A certificate may help show what you have done under APP 11, but it does not prove compliance.
That’s why you should record the tier and systems it covers, then check which data, suppliers, retention rules, and privacy tasks sit outside that scope.
How Cyber Insurers Assess Your Privacy Controls
Cyber insurers commonly ask whether MFA, patching, endpoint protection, log monitoring, protected backups, and incident response still operate.
Answercyber insurance questions from current settings and test records.
If a control lapses after you apply, there may be a gap between what you told the insurer and what was running when an incident occurred.
And, as mentioned earlier, APP compliance does not guarantee cover, so confirm the policy terms with your broker or insurer.
A Practical APP Compliance Checklist for Small Businesses
A usable APP compliance checklist tells each person what to do, what proof to keep, and when to check again.
Start by mapping your information, publishing a privacy policy that matches your work, and rehearsing your breach response as part of your widercybersecurity strategy.
Audit What Personal Information You Hold and Why
To build a useful data audit for customer or regulator enquiries, your register should clearly show what personal information you hold, why you need it, and where it moves across your systems:
- What the data contains, how sensitive it is, where it came from, and why you need it;
- Where it sits, which supplier handles it, who owns it, and who can gain access;
- Which countries, disclosures, integrations, and exports are involved;
- When you will delete it, how you will dispose of it, and when you last checked the controls.
Compare the register with SaaS invoices, single sign-on logs, shared drives, inboxes, endpoints, and backups, then ask staff about unofficial tools.
Keeping it current helps you answer customer questionnaires, prepare tender evidence, and find affected data during an incident.
Write and Publish a Compliant Privacy Policy
Your privacy policy should describe what your business actually does with personal information. State what you collect and why.
Explain how you use or share it, how people can exercise their rights or complain, and whether their data is likely to go overseas.
Publish the policy where people can find it, name someone to maintain it, and update it when your systems or practices change.
Also, keep each collection notice beside the form, call script, or workflow it describes.
Build a Data Breach Response Plan Before You Need It
Your data breach response plan should tell each person when to act and who makes each decision, which is why you should write down:
- Who staff call, how the team contains the incident, and how it preserves evidence
- Who investigates, assesses serious harm, and seeks legal advice
- How the team records decisions and times against the 30-day assessment limit
- Who notifies the OAIC, affected people, suppliers, and the insurer
- Who restores services, reviews the response, and fixes the control that failed.
Then run a tabletop exercise against a realistic event, such as a compromised mailbox sharing customer files.
Check whether your team can find the affected data, stop access, and prepare an accurate notification without rebuilding the facts from scratch.
Meet Your Australian Privacy Principles Obligations with Redscale
Privacy evidence becomes urgent when a customer sends a questionnaire or an insurer asks what you did after an alert.
Someone then has to follow personal information through systems and suppliers while a tender or project approval waits.
When the answer sits in old tickets and separate portals, your team loses time before it can decide what to contain, disclose, or fix.
Redscale helps when you need to see the data and the alert in the same investigation.
Our data loss prevention services identify sensitive information and apply rules as it moves.
Redscale managed security services monitor alerts and investigate suspicious activity.
Where a deeper test is needed, Redscale’s OSCP- and CREST-certified testers examine the attack path that could expose personal information.
Book a free discussion session with Redscale experts today to review your privacy controls before your next tender assessment.
