Meet the Australian Privacy Act and its 13 APPs with less effort

The Privacy Act 1988 is Australia's main federal privacy law. It sets 13 Australian Privacy Principles that govern how covered organisations collect, use, disclose, store and secure personal information, and gives individuals rights to access and correct it. The Act also contains the Notifiable Data Breaches scheme and a credit reporting framework, and it is regulated by the Office of the Australian Information Commissioner (OAIC).

Australian Government agencies and private organisations with annual turnover above AU$3 million must comply. Some smaller businesses are also covered regardless of turnover, including private health service providers, businesses that trade in personal information and contracted service providers to the Australian Government. Overseas organisations, including UK businesses, can be covered when they carry on business in Australia and handle personal information there.

The 13 APPs cover open and transparent management of personal information, anonymity and pseudonymity, collection of solicited information, unsolicited information, notification of collection, use or disclosure, direct marketing, cross-border disclosure, government related identifiers, quality of personal information, security, access and correction. They are principles based, so each organisation decides how to meet them in a way that suits its size and risks.

For serious interferences with privacy, a company can face a civil penalty of up to the greater of AU$50 million, three times the benefit obtained, or 30% of adjusted turnover during the relevant period. Amendments in 2024 added lower penalty tiers and OAIC infringement notices for less serious breaches. The OAIC can also investigate, accept enforceable undertakings and make determinations requiring compensation.

The Notifiable Data Breaches scheme, in Part IIIC of the Act, requires covered entities to notify affected individuals and the OAIC when a data breach is likely to result in serious harm. It has applied since 22 February 2018. Entities must carry out a reasonable and expeditious assessment of a suspected breach, generally within 30 days, and take steps to contain it and reduce harm.

The Privacy Act and GDPR share similar ideas, such as transparency, purpose limits, security and access rights, but the Act uses principles rather than legal bases and has a small business exemption. ISO 27001 is a voluntary security standard, not a privacy law, but its controls give strong evidence for APP 11 security obligations. Many controls overlap, so evidence can often be reused across all three.

Start by mapping what personal information you hold and where it goes, then publish an APP privacy policy and collection notices. Put reasonable security safeguards in place under APP 11, set up processes for access and correction requests, check overseas recipients under APP 8 and prepare a data breach response plan. There is no certification, so keep records that show how you meet each principle.

Yes. OneClickComply supports the Privacy Act today, mapping its 13 Australian Privacy Principles to controls in the platform. Evidence is collected automatically from connected tools, policies are generated from your environment and controls are monitored for drift. Because controls are mapped across frameworks, work done for ISO 27001, SOC 2 or GDPR counts towards the Privacy Act. OneClickComply does not certify or guarantee compliance.