Meet the Australian Privacy Principles (APPs) with less manual work

The Australian Privacy Principles (APPs) are 13 legally binding principles in Schedule 1 of the Privacy Act 1988. They govern how APP entities collect, use, disclose, store and secure personal information, and give individuals rights to access and correct it. They took effect on 12 March 2014 and are regulated by the Office of the Australian Information Commissioner (OAIC), which publishes detailed guidelines on each principle.

APP entities must comply: Australian Government agencies and private sector organisations, including not-for-profits, with annual turnover above AUD 3 million. Some smaller businesses are covered regardless of turnover, including health service providers, businesses that trade in personal information and contracted service providers to the Commonwealth. Overseas organisations can be covered if they carry on business in Australia and handle personal information there.

For serious interferences with privacy, a company can face a civil penalty of up to the greater of AUD 50 million, three times the benefit obtained, or 30% of adjusted turnover in the relevant period. Lower civil penalty tiers and infringement notices also apply to less serious breaches. The OAIC can also investigate complaints, accept enforceable undertakings and make determinations requiring a business to remedy the harm.

APP 11 requires an APP entity to take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. It must also destroy or de-identify personal information it no longer needs, unless a law requires it to be kept. Reasonable steps typically include access controls, encryption, logging, staff training, vendor oversight and incident response.

The Notifiable Data Breaches scheme sits alongside the APPs in Part IIIC of the Privacy Act and has applied since 22 February 2018. If an APP entity has an eligible data breach likely to cause serious harm, it must notify the affected individuals and the OAIC. Strong APP 11 security controls reduce the chance of a notifiable breach occurring.

The APPs are similar to GDPR in purpose, covering transparency, collection limits, cross-border transfers and individual rights, but they are Australian law with their own thresholds and definitions. ISO 27001 is a voluntary security standard rather than a privacy law. An ISO 27001 information security management system gives strong support for APP 11 security, but it does not cover every APP on its own.

No, there is no official certification for the Australian Privacy Principles. Compliance is an ongoing legal obligation, and the OAIC can assess, investigate and enforce it. Organisations usually show compliance through a published privacy policy, documented procedures, privacy impact assessments and evidence that security controls are working, often supported by an ISO 27001 certificate or SOC 2 report.

Yes, OneClickComply supports the Australian Privacy Principles today. The platform maps all 13 APPs to controls, generates policies with AutoComplete, collects security evidence automatically and monitors controls continuously. Our in-house audit team and Ask an Auditor can answer questions about applying the principles. OneClickComply helps you build and evidence your programme but does not certify compliance or replace legal advice.