Introduction: Privacy Compliance Is No Longer Optional
Australia’s privacy landscape has changed dramatically in the past decade — and the pace of change is accelerating. The Privacy Legislation Amendment (Enhancing Online Privacy and Other Measures) Act 2021 raised maximum penalties for serious privacy breaches to $50 million or more. The Attorney-General’s Privacy Act Review Report 2022 proposed sweeping reforms including removing the small business exemption, introducing a right to erasure, and creating a direct right of action for individuals. The Notifiable Data Breaches scheme, now well established, requires organisations to notify both the OAIC and affected individuals when a data breach is likely to result in serious harm.
Against this backdrop, treating privacy compliance as a low-priority administrative task is increasingly difficult to justify. The regulatory scrutiny is real, the penalties are significant, and the reputational consequences of a high-profile privacy breach — as demonstrated by several major Australian incidents in recent years — can be severe and long-lasting. For further context, see our guide on legal compliance obligations.
This guide provides a practical overview of Australia’s privacy legislation framework — what it requires, who it applies to, how it is enforced, and how organisations can use a legal compliance register to manage their privacy obligations systematically. It also covers the proposed reforms that organisations should be preparing for now, even before they are enacted.
The Privacy Act 1988: An Overview
The Privacy Act 1988 (Cth) is the primary legislation governing the handling of personal information in Australia. It applies to the Australian Government and to private sector organisations that are “APP entities” — primarily those with an annual turnover exceeding $3 million, though there are important exceptions that bring smaller organisations into scope regardless of turnover.
The Act defines “personal information” as information or an opinion about an identified individual or an individual who is reasonably identifiable — whether the information or opinion is true or not, and whether or not it is recorded in a material form. This broad definition encompasses names, contact details, financial information, employment records, health information, and a wide range of other data that organisations routinely collect and process.
“Sensitive information” receives heightened protection under the Act. It includes racial or ethnic origin, political opinions, religious beliefs, sexual orientation or practices, criminal records, health and genetic information, and biometric information. Organisations handling sensitive information must meet additional requirements compared to ordinary personal information — in most cases, they need explicit consent from the individual.
The Act is administered by the Office of the Australian Information Commissioner (OAIC), which has powers to receive and investigate privacy complaints, conduct audits, issue determination notices, and bring proceedings in the Federal Court. The OAIC’s enforcement activity has increased substantially in recent years, reflecting a more assertive regulatory posture that organisations need to factor into their compliance risk assessments.
Who Must Comply with the Privacy Act?
The Privacy Act applies to Australian Government agencies (including government business enterprises) regardless of size or turnover. For private sector organisations, the primary threshold is an annual turnover exceeding $3 million — but this threshold has numerous exceptions that draw smaller businesses into scope.
Private sector organisations are covered regardless of turnover if they provide health services, are a related body corporate of an entity that is covered, are a credit reporting body, provide services to the Australian Government under a contract, operate a residential tenancy database, or are a media organisation that satisfies the journalistic activities exemption (but only in relation to activities outside that exemption).
Proposed reforms under the Attorney-General’s Privacy Act Review would remove the $3 million threshold entirely, bringing all private sector organisations into the Act’s scope regardless of size. If enacted, this would be one of the most significant expansions of privacy regulation in Australia’s history, drawing hundreds of thousands of small businesses into the APP compliance framework for the first time. Organisations planning ahead for this possibility — by building their privacy compliance infrastructure now — will be significantly better positioned than those that wait for the law to change before acting.
The Australian Privacy Principles: What They Require
The substantive privacy obligations for organisations covered by the Privacy Act are set out in Schedule 1 — the Australian Privacy Principles (APPs). There are 13 APPs, divided broadly between principles governing the collection and use of personal information (APPs 1–7) and principles governing access, correction, and the integrity of personal information (APPs 8–13).
APP 1: Open and Transparent Management
APP 1 requires organisations to manage personal information in an open and transparent way. This includes having an up-to-date Privacy Policy that sets out how the organisation manages personal information, what it collects and why, to whom it discloses personal information, and how individuals can access or correct their information. The Privacy Policy must be freely available — typically on the organisation’s website — and it must be kept current as the organisation’s data practices evolve.
Compliance with APP 1 is foundational — many other APP obligations assume that individuals have been informed of their rights through the Privacy Policy. An outdated or inaccurate Privacy Policy is a common finding in OAIC investigations and is often indicative of broader weaknesses in a privacy program.
APPs 3 and 5: Collection and Notification
APP 3 requires organisations to collect personal information only if it is reasonably necessary for their functions or activities. For sensitive information, collection generally requires consent. APP 5 requires organisations to notify individuals of certain matters at or before the time they collect their personal information — including the identity of the collector, the purposes of collection, and the consequences of not providing the information.
Together, APPs 3 and 5 regulate the front-end of the personal information lifecycle — what is collected and whether individuals are informed about it. Organisations with complex digital collection mechanisms (websites, apps, analytics tools) need to ensure that their collection practices are properly scoped and that their notifications cover all the ways information is collected, including passive collection through cookies and tracking technologies.
APP 6: Use and Disclosure
APP 6 governs what organisations can do with personal information after they have collected it. The primary rule is that personal information collected for one purpose generally cannot be used or disclosed for another purpose — the “secondary use” restriction. There are exceptions: secondary use may be permitted with consent, where the individual would reasonably expect the secondary use, or where it falls within one of the statutory exceptions.
APP 6 is one of the most commonly misunderstood privacy principles. Many organisations collect information for one purpose (for example, processing a transaction) and then use it for another (for example, marketing) without considering whether APP 6 permits that secondary use or whether consent is required. A compliance register that maps data flows against APP 6 requirements is an effective tool for identifying and addressing these gaps.
APP 8: Cross-Border Disclosure
APP 8 applies when an organisation discloses personal information to an overseas recipient — including cloud service providers with data centres in other countries. Before making a cross-border disclosure, an organisation must take reasonable steps to ensure that the overseas recipient does not breach the APPs in relation to that information. This obligation effectively places Australian privacy standards on the organisation’s overseas data flows.
For organisations using cloud services (which is most organisations), APP 8 compliance requires careful attention to where data is stored and processed, what contractual protections are in place with cloud providers, and whether those protections are adequate. This is an area where many organisations have compliance gaps — APP 8 requirements are often not fully mapped through to specific cloud contracts and data processing agreements.
APP 11: Security
APP 11 requires organisations to take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure. It also requires organisations to destroy or de-identify personal information when it is no longer needed for any purpose for which it could be used or disclosed under the APPs.
What constitutes “reasonable steps” under APP 11 is context-dependent — it depends on the volume and sensitivity of information held, the nature of the organisation’s operations, and the state of relevant technology and security practice. The OAIC has been clear that reasonable steps include technical security controls (encryption, access controls, multi-factor authentication) as well as organisational controls (staff training, security policies, incident response procedures).
APPs 12 and 13: Access and Correction
APP 12 gives individuals a right to access the personal information that an organisation holds about them. On receipt of a valid access request, an organisation must provide that access within 30 days, unless an exception applies. Fees for access are not permitted unless they are not excessive. APP 13 gives individuals a right to have their personal information corrected if it is inaccurate, out of date, incomplete, irrelevant, or misleading.
Compliance with APPs 12 and 13 requires organisations to have processes for receiving and responding to access and correction requests — a dedicated contact point, a defined response workflow, and systems that allow them to identify and retrieve the personal information held about a specific individual. Without these processes, even organisations that are broadly privacy-compliant may struggle to meet their access and correction obligations when requests arrive.
The Notifiable Data Breaches Scheme
The Notifiable Data Breaches (NDB) scheme, introduced in 2018 as Part IIIC of the Privacy Act, requires organisations covered by the Act to notify both the OAIC and affected individuals when a data breach is likely to result in serious harm to any of the individuals whose information was compromised.
A “data breach” under the NDB scheme occurs when personal information held by the organisation is lost, accessed, or disclosed without authorisation. “Serious harm” includes physical, psychological, emotional, economic, or reputational harm to the individual. The assessment of whether serious harm is likely must be made as quickly as possible — the Act contemplates notification within 30 days of becoming aware of an eligible data breach.
The NDB scheme has generated significant reporting since its introduction. The OAIC publishes quarterly and annual NDB statistics that show the number, type, and cause of reported breaches. The most common causes are malicious or criminal attacks (including phishing and ransomware), human error (including sending information to the wrong recipient), and system faults.
Compliance with the NDB scheme requires organisations to have a documented data breach response plan — a process for detecting, assessing, containing, and notifying data breaches. The plan should include clear roles and responsibilities, defined timelines, and escalation procedures. Without a plan, the pressure of responding to an actual breach while simultaneously trying to figure out the notification requirements creates risk of both delayed and inadequate responses.
Proposed Privacy Act Reforms: What to Prepare For
The Attorney-General’s Privacy Act Review Report, published in 2022, proposed 116 recommendations for reform of the Privacy Act. The Australian Government has agreed to or agreed in principle to the majority of those recommendations, and legislative reform has been progressing through Parliament in stages. Organisations should treat these reforms as likely rather than speculative and begin preparing their compliance programs accordingly.
The removal of the small business exemption is among the most significant proposed changes. If enacted, it would bring all private sector businesses in Australia within the scope of the Privacy Act, regardless of annual turnover. For businesses that currently rely on the exemption, this would require building an APP compliance program from scratch — developing a Privacy Policy, implementing collection and consent processes, establishing access and correction procedures, and deploying security measures sufficient to meet APP 11 requirements.
The proposed “right to erasure” mirrors the right to be forgotten under Europe’s General Data Protection Regulation (GDPR). It would give individuals the right to request that an organisation delete their personal information, with exceptions for obligations that require retention (such as tax records). For organisations that currently retain data indefinitely, implementing erasure capability requires technical changes to data systems and processes.
The “fair and reasonable” test is perhaps the most conceptually significant proposed reform. Rather than relying solely on the specific rules in each APP, the proposal would introduce an overarching requirement that the collection, use, and disclosure of personal information be fair and reasonable in the circumstances. This standard-based approach would give the OAIC greater flexibility to act against data practices that are technically compliant with the specific APPs but are nevertheless unfair or unreasonable from the individual’s perspective.
Managing Privacy Obligations with a Legal Compliance Register
A legal compliance register provides the foundation for managing privacy obligations systematically. By mapping each APP to specific operational obligations, assigning owners, setting review cycles, and linking obligations to evidence of compliance, organisations can demonstrate to the OAIC that their privacy program is structured, maintained, and genuinely functional — not just paper compliance.
For each of the 13 APPs, the compliance register should capture the specific obligations that the APP creates for the organisation’s activities, the person or team responsible for meeting each obligation, the current compliance status, the date of the last review, and the evidence of compliance. For APP 1, this might include the date the Privacy Policy was last reviewed and a link to the current version. For APP 11, it might include the date of the last security assessment, the current security controls in place, and the date of the last penetration test.
The compliance register should be linked to the legislation library so that changes to the Privacy Act — including the staged reforms currently progressing through Parliament — trigger reviews of the relevant obligations. When a new provision of the Privacy Act comes into force, the owners of the affected obligations in the register are automatically notified to review and update. This ensures that the organisation’s privacy compliance program remains current as the legislative landscape evolves.
For the proposed new obligations that have not yet been enacted — the right to erasure, the fair and reasonable test, the removal of the small business exemption — organisations should consider creating “watch list” entries in their compliance register or legislation library. These are obligations that do not yet apply but are likely to do so, for which preparation can and should begin now. When the legislation is enacted, these entries are activated and assigned review dates — rather than starting from scratch at the moment the obligation becomes live.
How Lahebo Supports Privacy Compliance Management
Lahebo’s Compliance Register and Legislation Library are designed to manage privacy obligations alongside an organisation’s other compliance requirements — WHS, environmental, employment, financial services, and industry-specific regulation — in a single, integrated platform.
Within Lahebo, organisations can create compliance obligations linked specifically to the Privacy Act 1988 and each of the 13 APPs. Each obligation can be assigned to the appropriate functional owner — IT for APP 11 security obligations, marketing for APP 6 and 7 obligations, legal for APP 8 cross-border obligations, and so on. Review cycles can be configured at whatever frequency is appropriate for each obligation, and automated reminders ensure that reviews are completed before they become overdue.
The Legislation Library monitors the Privacy Act for amendments — including the staged reform legislation currently progressing — and alerts relevant obligation owners when changes occur. This means that when a new provision of the Privacy Act comes into force, the owners of affected obligations receive an immediate notification to review and update their compliance status, without requiring the compliance team to monitor the legislative calendar manually.
For organisations navigating the proposed Privacy Act reforms, Lahebo provides a structured environment for both tracking current obligations and preparing for new ones — allowing compliance teams to map the impact of proposed changes against their existing program before those changes become law.
Conclusion
Australia’s privacy legislation landscape is in a period of significant evolution. The Privacy Act 1988 and the 13 Australian Privacy Principles impose substantive obligations on covered organisations today, with penalties that can reach $50 million or more for serious breaches. Proposed reforms will expand the Act’s scope, strengthen individual rights, and introduce new compliance requirements — most likely within the next few years.
Managing privacy compliance effectively requires more than a Privacy Policy on a website. It requires a structured approach to mapping obligations, assigning ownership, monitoring legislative change, documenting compliance activities, and responding to incidents and access requests. A legal compliance register, integrated with a legislation library and supported by automated workflows, provides the infrastructure for this approach.
For organisations that want to build or strengthen their privacy compliance program — whether to address current obligations, prepare for proposed reforms, or demonstrate due diligence to regulators — Lahebo provides the purpose-built platform for Australian compliance management.