Australian Privacy Act: APPs, Data Breaches and 2024 Reforms

The Australian Privacy Act 1988 governs how Australian Government agencies and most businesses handle personal information. Its core is the 13 Australian Privacy Principles (APPs), and since 2018 the Notifiable Data Breaches scheme has required organisations to tell the regulator and affected people about serious breaches. After several large breaches, penalties rose sharply in 2022, and the Privacy and Other Legislation Amendment Act 2024 added new enforcement tools, a statutory tort for serious invasions of privacy and transparency rules for automated decisions.

More change is coming: the regulator must register a Children's Online Privacy Code by 10 December 2026, and the government released an exposure draft of a second tranche of reforms in 2026. This guide explains who must comply, the APPs, breach notification, overseas disclosure, penalties and practical steps for SaaS and IT companies.

What is the Privacy Act?

The Privacy Act 1988 (Commonwealth) regulates the handling of personal information by "APP entities". The Office of the Australian Information Commissioner (OAIC) regulates it, issues guidelines and handles complaints. Personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether true or not and whether recorded or not. Sensitive information, such as health, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, criminal record, and biometric and genetic information, gets extra protection.

Who must comply?

• Australian Government agencies and Norfolk Island agencies.
• Organisations with annual turnover above A$3 million, including companies, partnerships, trusts and individuals in business.
• Smaller businesses that fall outside the exemption, including health service providers, businesses that trade in personal information, contracted service providers to the Commonwealth, credit reporting bodies and those that opt in.
• Foreign organisations with an Australian link: since 2022, an organisation carrying on business in Australia is covered whether or not it collects or holds the information in Australia.

The small business exemption and the employee records exemption are long-standing gaps that the reform process has proposed to remove or narrow. State and territory laws cover state public sectors and, in some states, health records.

Is it mandatory or voluntary?

Mandatory for APP entities. There is no certification. Organisations demonstrate compliance through policies, privacy impact assessments, contracts and security evidence, and the OAIC can audit and investigate.

The 13 Australian Privacy Principles

1. APP 1, open and transparent management: have practices, procedures and systems to comply, and a clearly expressed, up-to-date privacy policy.
2. APP 2, anonymity and pseudonymity: let individuals deal anonymously or by pseudonym where practicable.
3. APP 3, collection of solicited information: collect only what is reasonably necessary for functions or activities; sensitive information generally needs consent.
4. APP 4, unsolicited information: deal with information received without asking.
5. APP 5, notification of collection: tell individuals about collection, purposes, disclosures and overseas recipients.
6. APP 6, use or disclosure: use or disclose for the primary purpose, or a secondary purpose the person would reasonably expect or that is otherwise permitted.
7. APP 7, direct marketing: limits and opt-out requirements.
8. APP 8, cross-border disclosure: take reasonable steps so overseas recipients do not breach the APPs.
9. APP 9, government related identifiers: limits on adopting, using or disclosing them.
10. APP 10, quality: keep information accurate, up to date and complete.
11. APP 11, security: take reasonable steps to protect information from misuse, interference, loss and unauthorised access, modification or disclosure, and destroy or de-identify it when no longer needed.
12. APP 12, access: give individuals access to their information on request.
13. APP 13, correction: correct inaccurate, out-of-date, incomplete, irrelevant or misleading information.

APP 11 security in more detail

The 2024 amendments clarified that "reasonable steps" under APP 11 include technical and organisational measures. The OAIC's guidance and enforcement point to practical controls: access control and least privilege, MFA, encryption, patching, logging and monitoring, vendor management, staff training, incident response, and secure destruction or de-identification. Retaining large historic data sets without need has been a major factor in Australian breaches and is a common OAIC finding.

Cross-border disclosure (APP 8)

Before disclosing personal information to an overseas recipient, an APP entity must take reasonable steps to ensure the recipient does not breach the APPs, usually through a contract. Under section 16C, the Australian entity is generally accountable for the overseas recipient's acts. Exceptions include where the recipient is subject to a substantially similar law the individual can enforce, or where the individual consents after being expressly informed. The 2024 amendments allow the government to prescribe countries and certification schemes with substantially similar protection, which would simplify transfers once lists are made.

Using an overseas cloud provider or offshore development team that only stores or processes information under contract, without the provider using it for its own purposes, may be a "use" rather than a "disclosure" in OAIC guidance, but APP 11 security still applies. Privacy policies and collection notices must say whether information is likely to be disclosed overseas and, where practicable, to which countries.

Notifiable Data Breaches scheme

Since 22 February 2018, an APP entity must notify the OAIC and affected individuals of an eligible data breach: unauthorised access to, disclosure of, or loss of personal information that a reasonable person would conclude is likely to result in serious harm to any affected individual, where the entity has not been able to prevent that harm with remedial action.

• If an entity suspects an eligible breach, it must carry out a reasonable and expeditious assessment within 30 days.
• Once it has reasonable grounds to believe an eligible breach occurred, it must notify the OAIC and affected individuals as soon as practicable, using the OAIC form and including recommended steps individuals should take.
• Where a breach involves several entities, such as a client and its vendor, one notification can cover them.

The 2024 amendments allow the Minister to make an eligible data breach declaration permitting information sharing to reduce harm after a major breach.

Access and correction in practice

Under APP 12, an organisation must give an individual access to the personal information it holds about them within a reasonable period, which the OAIC generally treats as 30 calendar days, and in the manner requested where reasonable and practicable. It may refuse only on grounds listed in the principle, such as a serious threat to life or safety, unreasonable impact on others' privacy, frivolous or vexatious requests, or legal proceedings, and must explain refusals in writing with complaint options. Any charge must not be excessive and cannot apply to making the request. APP 13 requires correction where information is inaccurate, out of date, incomplete, irrelevant or misleading, and notifying other APP entities that received the information when the individual asks. For software products, self-service account pages and data export features handle most requests and reduce manual work.

Related Australian privacy rules

Several other rules sit alongside the APPs and may apply to technology businesses:

• Credit reporting under Part IIIA of the Privacy Act and the Credit Reporting Code, for credit providers and credit reporting bodies.
• The Consumer Data Right, which gives consumers rights to share banking and energy data with accredited providers, with its own privacy safeguards enforced by the OAIC and the competition regulator.
• The Spam Act 2003, which requires consent, sender identification and an unsubscribe facility for commercial electronic messages.
• The My Health Records Act 2012 for systems connecting to the national health record.
• The Tax File Number rule, restricting collection and use of tax file numbers.

Penalties and enforcement

Since December 2022, the maximum civil penalty for serious interferences with privacy by a body corporate is the greater of A$50 million, three times the benefit obtained, or 30 percent of adjusted turnover during the breach period. The 2024 amendments added a mid-tier civil penalty for interferences that are not serious, and infringement notices the OAIC can issue for administrative failures such as deficient privacy policies or collection notices. The OAIC can also accept enforceable undertakings, issue determinations requiring remediation and compensation, and conduct assessments. Individuals can complain to the OAIC, and since 10 June 2025 can sue directly under the new statutory tort for serious invasions of privacy, which is in a separate schedule to the Act.

Recent and upcoming changes

• Automated decisions: from 10 December 2026, privacy policies must describe the kinds of personal information used in, and the kinds of decisions made by, computer programs that make or substantially assist decisions significantly affecting individuals' rights or interests.
• Children's Online Privacy Code: the OAIC published an exposure draft in March 2026 and must register the code by 10 December 2026. It is expected to apply to online services likely to be accessed by children, with any transition period set by the code.
• Second tranche of reforms: an exposure draft bill released in 2026 proposes further changes, which may include a fair and reasonable test for handling personal information and narrowing exemptions. Its final content and timing are not settled; check the Attorney-General's Department and OAIC for progress.

How to comply, step by step

1. Confirm whether you are an APP entity, including the Australian link and small business exemption.
2. Map personal information, sensitive information, purposes, overseas recipients and retention.
3. Update the privacy policy and collection notices, including overseas disclosure and, from December 2026, automated decision information.
4. Review consent for sensitive information and direct marketing opt-outs.
5. Strengthen APP 11 security, including retention limits and destruction.
6. Put APP 8 contracts in place with overseas recipients and vendors.
7. Prepare the breach response plan, including the 30-day assessment and OAIC notification.
8. Handle access and correction requests within a reasonable period, generally 30 days.
9. Run privacy impact assessments for new high-risk projects.
10. Watch the children's code and reforms.

Documentation you will need

• Privacy policy and collection notices.
• Data inventory and retention schedule.
• Privacy impact assessments.
• Security policies and evidence of controls.
• Vendor and overseas recipient contracts.
• Data breach response plan, assessment records and OAIC notifications.
• Access and correction request records.
• Consent records for sensitive information and marketing.

Timeline and cost considerations

A business already aligned with the GDPR usually needs a few weeks to adapt notices, overseas disclosure statements and breach procedures. Larger effort goes into retention clean-up and security improvements, which can take months. Costs include legal review, security tooling and testing, and engineering for retention and access requests.

Common mistakes for SaaS and IT companies

• Assuming the small business exemption applies when the business provides health services or trades in personal information.
• Keeping old customer data indefinitely, increasing breach impact.
• Not naming overseas countries where information is disclosed.
• Slow breach assessments that drag past 30 days.
• Collecting identity documents without need.
• Vendor contracts that do not address APP obligations.

Best practices, tools and technologies

• Minimise collection, especially of identity documents, and delete when no longer needed.
• Encrypt data, use MFA and least privilege, and monitor access.
• Align technical controls with the Essential Eight where relevant to Australian clients.
• Use privacy impact assessments for new features and AI use.
• Structure the program with ISO/IEC 27001 and ISO/IEC 27701.

We build data retention, access controls, audit logging and privacy request features into web and SaaS platforms through our web application development service.

How the Privacy Act relates to other laws

Law or framework	Relationship
GDPR	No EU adequacy decision for Australia; GDPR has broader legal bases and rights.
PDPA Singapore	Regional peer with faster breach notification deadlines.
Essential Eight	Government security strategies often used to evidence APP 11.
ISO/IEC 27001	Common certification for security evidence.
SOC 2	Vendor assurance report Australian clients often accept.

Real-world example

An Australian telehealth startup is covered regardless of turnover because it provides a health service. Its Indian development partner works on the platform under a contract requiring APP-consistent handling, MFA, masked test data and incident notice within 24 hours. The startup's privacy policy names India and the US as countries where information may be accessed, it deletes inactive accounts after a set period, and it has a breach response plan that completes assessments within days, not the full 30.

Next steps

1. Confirm APP entity status.
2. Update notices for overseas disclosure and automated decisions.
3. Reduce retained data.
4. Test the breach response plan.
5. Track the children's code and reforms.

Frequently asked questions

Does the Privacy Act apply to small businesses?

Generally not to businesses with turnover of A$3 million or less, but health service providers, businesses trading in personal information and some others are covered regardless.

Does the Act apply to foreign companies?

Yes, if they carry on business in Australia and meet the other criteria.

What is an eligible data breach?

Unauthorised access, disclosure or loss of personal information likely to result in serious harm that remedial action has not prevented.

How quickly must breaches be notified?

As soon as practicable after an entity has reasonable grounds to believe an eligible breach occurred, after an assessment completed within 30 days.

What are the maximum penalties?

For serious interferences, the greater of A$50 million, three times the benefit, or 30 percent of adjusted turnover in the breach period.

Can personal information be sent overseas?

Yes, but the entity must take reasonable steps so the recipient complies with the APPs and generally remains accountable.

What changes in December 2026?

Privacy policies must explain automated decisions that significantly affect individuals, and the Children's Online Privacy Code is due to be registered.

Can individuals sue for privacy breaches?

Since 10 June 2025, there is a statutory tort for serious invasions of privacy.

Is there a certification for the Privacy Act?

No. Organisations use policies, assessments and frameworks such as ISO/IEC 27001 as evidence.

How many APPs are there?

Thirteen, covering the full lifecycle of personal information.

Does the Act cover employee records?

Private sector employee records are largely exempt, but reforms have proposed changes.