Key Facts
- Regulator
- Office of the Australian Information Commissioner (OAIC)
- Latest version
- Privacy Act 1988, Compilation No. 104 (reform under way)
- Effective
- 4 June 2026
- Official text
- www.oaic.gov.au ↗
What is Australian Privacy Act?
The Australian Privacy Act, formally the Privacy Act 1988, is the federal privacy act Australia's government agencies and larger organisations must follow when they handle personal information. Larger means annual turnover above A$3 million, and some smaller businesses are covered too. It sets 13 Australian Privacy Principles, and the Office of the Australian Information Commissioner (OAIC) regulates it.
The current text is Compilation No. 104 of the Act, dated 4 June 2026, on the Federal Register of Legislation. The OAIC's page on the Privacy Act is the regulator's starting point.
The Act is in reform. The Australian Government is reviewing it, and the Privacy and Other Legislation Amendment Act 2024 has already changed parts of it. A further change from that Act, on automated decisions, starts on 10 December 2026 (see the OAIC's announcement). Check the current text before you cite a specific rule.
Why it matters
The Act exists to promote and protect individual privacy. It does that by setting rules for how covered agencies and organisations handle personal information.
For a firm based outside Australia, the first sign is usually indirect. An Australian customer asks how you meet the Australian Privacy Principles, and nobody on your team has read them.
A privacy policy states what you intend. The Australian Privacy Act asks what you actually do with the data.
Who it applies to
The 13 Australian Privacy Principles (APPs) apply to "APP entities". In practice that covers:
- most Australian Government agencies;
- organisations with annual turnover above A$3 million;
- some smaller businesses, even at A$3 million or less, including health service providers, credit reporting bodies, and businesses that sell or purchase personal information.
Other small businesses at or below the threshold generally sit outside the APPs. The OAIC's rights and responsibilities page sets out the detail, and where it differs from the current Act text, the legislation prevails.
The obligation is mandatory. The Act is law for the entities it covers. It is not a voluntary framework you adopt.
The relationship to ISO 27001 is partial. ISO 27001 is a voluntary information security standard. Its nearest control, A.5.34 privacy and protection of PII, asks you to find and meet the privacy laws that apply to you, which would include this Act. A certificate does not show compliance with the Act, which also governs collection, use, disclosure, access and correction.
The UK position
A UK firm meets the Australian Privacy Act when it carries on business in Australia. That gives it an "Australian link" under section 5B, and the APPs then apply to what it does outside Australia, even with no Australian office. The Act does not define "carries on business", so it turns on the facts. The OAIC's APP Guidelines explain the test.
UK GDPR and the Data Protection Act 2018, overseen by the ICO, apply alongside it, not instead of it. A UK firm that does no business in Australia will rarely meet the Act at all.
Key requirements
The core of the Act is the 13 Australian Privacy Principles. They govern how an APP entity handles personal information across its life. The topics they address include:
- Collection and notification. What an entity may collect, and what it must tell people when it does.
- Use and disclosure. The limits on what an entity may do with personal information once held.
- Accuracy. Keeping the information it holds correct and up to date.
- Security. Protecting personal information from misuse, loss and unauthorised access.
- Access and correction. Individuals' rights to see information held about them and have it corrected.
The principle-by-principle wording is on the OAIC site, and it is the text to cite in a questionnaire or contract.
Beyond the APPs, the Act carries separate rules for three areas:
- consumer credit reporting;
- tax file numbers;
- health and medical research.
A principles-based law leaves the "how" to the entity. Two organisations can both comply with the APPs and look quite different.
Frequently asked questions
The 13 Australian Privacy Principles in the Australian Privacy Act govern how APP entities handle personal information. They run from collection through use, disclosure, accuracy and security to access and correction. They are principles rather than detailed rules. The OAIC's APP Guidelines set out how the regulator reads each one, so they show what it expects in practice.
Mostly not, but the exceptions are wide. Below the A$3 million turnover threshold, the Australian Privacy Act still covers health service providers, credit reporting bodies and businesses that sell or buy personal information. It also covers contractors on Australian Government contracts, businesses accredited under the Consumer Data Right, and small businesses that opt in. Check your own activities against the OAIC guidance.
It can. A UK company comes within the Australian Privacy Act's reach if it carries on business in Australia. Before December 2022 it also had to collect or hold personal information in Australia, but amendments that year removed that condition. UK GDPR duties continue to apply alongside. A UK firm that does no business in Australia will rarely meet the Act.
The Australian Privacy Act, often cited by its original year, was introduced to promote and protect individual privacy. For individuals, that means rights: to know why their information is collected, to stay anonymous or use a pseudonym in some cases, to see and correct it, to stop unwanted direct marketing, and to complain about mishandling.
One change to the Australian Privacy Act takes effect on 10 December 2026. From that date, APP entities that use a computer program to make or inform decisions that could significantly affect someone's rights or interests must explain this in their privacy policy. The Privacy and Other Legislation Amendment Act 2024 introduced the duty, and the wider review of the Act continues.