Australia Privacy Act 1988 (Australian Privacy Principles)
- ClassificationCategoryData Protection & PrivacyDomainPrivacyFramework FamilyGlobal Privacy Regulations
- Regulatory ContextTypeFrameworkLegal InstrumentActSectorCross-SectorIndustryCross-Industry
- Region / PublisherRegionAustralia & New ZealandRegion DetailAustraliaPublisherAustralian Parliament (Privacy Act 1988); regulated by the Office of the Australian Information Commissioner (OAIC)
- VersioningVersionPrivacy Act 1988 (current consolidated version with amendments)Effective Date12 March 2014 (Australian Privacy Principles); Act commenced 1989Issue Date1988
- AdoptionAdoption ModelRegulatory ComplianceImplementation ComplexityMedium
- Official ReferenceOpen Link in New TabSource
License included / downloadable: Yes
The Privacy Act 1988 is Australian national legislation and is publicly available through official government sources.
Framework text is licensed by its publisher and is included only where stated above.
- The Privacy Act 1988 (Cth) is Australia's federal privacy law, regulated by the Office of the Australian Information Commissioner.
- Its 13 Australian Privacy Principles apply to government agencies and organizations with annual turnover above $3 million, called APP entities.
- The APPs have applied since March 12, 2014, and the Notifiable Data Breaches scheme has required breach notification since 2018.
- The Privacy and Other Legislation Amendment Act 2024 made further changes, most commencing on December 11, 2024.
- SmartSuite Privacy Management holds the data inventory, assessments, and requests, with Workflow Orchestration for breach assessment and notification.
Overview
The Privacy Act 1988 (Cth) is Australia's federal privacy law. Its 13 Australian Privacy Principles (APPs) set the standards for how Australian Government agencies and organizations with an annual turnover of more than $3 million, and some other organizations, collect, use, disclose, secure, and give access to personal information. These bodies are called APP entities. Parliament passed the Act at the end of 1988, it commenced in 1989, and the APPs have applied since 12 March 2014. The Office of the Australian Information Commissioner (OAIC) regulates it.
A breach of an APP is an interference with the privacy of an individual and can lead to regulatory action and penalties. The Act also regulates the privacy component of consumer credit reporting, tax file numbers, and health and medical research. Since 2018 the Notifiable Data Breaches scheme has required APP entities to notify affected individuals and the OAIC of a data breach that is likely to result in serious harm. The Privacy and Other Legislation Amendment Act 2024 made further changes, most of them commencing on 11 December 2024.
Organizations implement the APPs by keeping a clear and current APP privacy policy, mapping the personal information they hold, giving collection notices, controlling use and disclosure including disclosure overseas, taking reasonable steps to protect information, and handling access and correction requests. Breach response follows the Notifiable Data Breaches scheme.
Why does it matter?
The APPs are principles-based and technology neutral, so the same 13 principles apply to a mobile app, a software platform, or paper files, and what regulators look at is whether an organization took reasonable steps.
Key benefits include:
- One structure for any sector
The 13 APPs cover collection, use and disclosure, governance and accountability, integrity and correction, and access, so one program covers most personal information handling.
- A reasonable-steps standard
APP 10 and APP 11 require reasonable steps to keep information accurate, up to date, and protected from misuse, interference, loss, and unauthorized access, modification, or disclosure.
- Higher standards for sensitive information
APP 3 applies higher standards to the collection of sensitive information, so teams know where to concentrate controls.
- Accountability for overseas disclosure
APP 8 sets the steps an APP entity must take to protect personal information before it is disclosed overseas.
- A defined breach duty
The Notifiable Data Breaches scheme requires notice to affected individuals and the OAIC when a breach is likely to result in serious harm.
How does it work?
The 13 APPs are: APP 1 open and transparent management of personal information; APP 2 anonymity and pseudonymity; APP 3 collection of solicited personal information; APP 4 dealing with unsolicited personal information; APP 5 notification of the collection of personal information; APP 6 use or disclosure; APP 7 direct marketing; APP 8 cross-border disclosure; APP 9 adoption, use or disclosure of government related identifiers; APP 10 quality; APP 11 security; APP 12 access; and APP 13 correction.
Coverage turns on who the organization is. The Act covers Australian Government agencies and organizations with an annual turnover above $3 million. Some smaller operators are covered, such as private health service providers, businesses that sell or purchase personal information, credit reporting bodies, and contracted service providers for an Australian Government contract. State and territory agencies, individuals acting in their own capacity, public schools, and registered political parties are not covered, and handling of employee records is exempt in some situations.
In SmartSuite, Privacy Management holds data inventories, privacy assessments, and requests, Workflow Orchestration runs breach assessment and notification steps, and Third Party Risk Management tracks overseas recipients for APP 8.
Key Elements
- Open and transparent management (APP 1) and anonymity (APP 2)
APP entities manage personal information openly, with a clearly expressed and up-to-date APP privacy policy, and give individuals the option of not identifying themselves or of using a pseudonym, with limited exceptions.
- Collection (APPs 3 to 5)
APP 3 sets when solicited personal information may be collected, with higher standards for sensitive information. APP 4 covers unsolicited information, and APP 5 sets when and what an entity must tell an individual at collection.
- Use, disclosure, and marketing (APPs 6 to 9)
APP 6 limits use or disclosure, APP 7 sets conditions for direct marketing, APP 8 sets steps before overseas disclosure, and APP 9 limits adopting, using, or disclosing government related identifiers.
- Quality and security (APPs 10 and 11)
Reasonable steps to ensure information is accurate, up to date, and complete, and to protect it from misuse, interference, and loss. APP 11 also requires destroying or de-identifying information in certain circumstances.
- Access and correction (APPs 12 and 13)
APP 12 requires access to personal information on request unless an exception applies, and APP 13 sets the obligations for correcting information.
- Notifiable Data Breaches scheme
Introduced by the Privacy Amendment (Notifiable Data Breaches) Act 2017. Organizations and agencies with security obligations under the Act must notify affected individuals and the OAIC of a data breach likely to result in serious harm.
- Credit reporting, tax file numbers, and health research
The Act also regulates consumer credit reporting (Part IIIA), tax file numbers under the Privacy (Tax File Number) Rule 2015, and the use of personal information in health and medical research.
What does it cover?
The Act applies to APP entities: Australian Government agencies and organizations with an annual turnover above $3 million, plus the smaller operators and activities the Act names. It covers personal information in any form. State and territory government agencies are covered by state and territory privacy laws, and the Australian Capital Territory has its own Territory Privacy Principles, which are similar to the APPs.
What are its objectives?
The Act was introduced to promote and protect the privacy of individuals and to regulate how covered entities handle personal information.
Give individuals control: to know why information is collected, use a pseudonym in some cases, access and correct information, stop unwanted direct marketing, and complain.
Give effect to Australia's agreement to implement the OECD Guidelines on privacy and its obligations under Article 17 of the International Covenant on Civil and Political Rights.
Keep the APPs principles-based and technology neutral so organizations can tailor their practices.
Regulate credit reporting, tax file numbers, and health and medical research.
Enforce through OAIC investigations, privacy assessments, and penalties.
Framework in Context
The APPs replaced the Information Privacy Principles and the National Privacy Principles when the Privacy Amendment (Enhancing Privacy Protection) Act 2012 commenced on 12 March 2014. Organizations commonly map the APPs to the GDPR, the APEC Privacy Framework, ISO/IEC 27701, and the NIST Privacy Framework.
Common Framework Mappings
Organizations that handle personal information in Australia and elsewhere map the APPs to the frameworks below to reuse privacy controls.
Mapped frameworks include:
APEC PF
CCPA/CPRA
GDPR
ISO 27001:2022
ISO 27701
NIST Privacy Framework v1.0
How SmartSuite Supports the Australian Privacy Act
SmartSuite provides the system for managing controls, evidence, mappings, assessments, and reporting.
Use Privacy Management for the data inventory, assessments, and requests, and Workflow Orchestration for breach assessment and notification steps.
APP-to-control library
Map each of the 13 APPs to policies, controls, and owners, including the APP privacy policy review date.
Personal information inventory
Record what personal information is collected, why, where it is held, and who receives it, including overseas recipients, using Privacy Management data inventories.
Collection notices and marketing
Track collection notices, sensitive information handling, and direct marketing opt-outs for each channel.
Access and correction requests
Run APP 12 access and APP 13 correction requests as tracked tasks with owners and dates, using Privacy Management requests.
Breach assessment and notification
Run the assessment of whether a breach is likely to result in serious harm, and the notices to individuals and the OAIC, with Workflow Orchestration.
Privacy program reporting
Use Enterprise Reporting to show open requests, incidents, and control status for privacy leadership.
Related frameworks
The APEC Privacy Framework (2015) sets nine information privacy principles that APEC economies use to protect personal information while keeping data flowing across the region.
The CCPA, as amended by the CPRA, gives California residents rights to know, delete, correct and opt out, and is enforced by the California Privacy Protection Agency.
The GDPR (Regulation (EU) 2016/679) sets principles, lawful bases, individual rights and accountability duties for personal data, with fines up to EUR 20 million or 4 percent of turnover.
ISO/IEC 27001:2022 specifies requirements for an information security management system: Clauses 4 to 10, risk treatment, the Statement of Applicability and 93 Annex A controls.
ISO/IEC 27701:2025 specifies requirements for a stand-alone privacy information management system (PIMS) for PII controllers and processors, replacing the 2019 edition.
Frequently Asked Questions For Australia Privacy Act 1988 (Australian Privacy Principles)
Australian Government agencies and organizations with an annual turnover of more than $3 million, plus some smaller operators such as private health service providers, businesses that sell or purchase personal information, credit reporting bodies, and contracted service providers for an Australian Government contract. These are known as APP entities.
They cover open and transparent management, anonymity and pseudonymity, collection of solicited information, unsolicited information, notification of collection, use or disclosure, direct marketing, cross-border disclosure, government related identifiers, quality, security, access, and correction of personal information (APPs 1 to 13).
Generally not for businesses with an annual turnover of $3 million or less, unless an exception applies. Exceptions include private health service providers, businesses that sell or purchase personal information, credit reporting bodies, contracted service providers for an Australian Government contract, and businesses that have opted in.
If the Privacy Act covers the organization or agency, it must notify affected individuals and the OAIC when a data breach involving personal information is likely to result in serious harm. This is the Notifiable Data Breaches scheme, in place since 2018.
APP 8 sets the steps an APP entity must take to protect personal information before it is disclosed overseas. Teams usually keep a register of overseas recipients and the safeguards in place for each.
Put this framework to work in SmartSuite
Manage controls, risks, evidence, and audits in one platform designed for modern governance, risk, and compliance.