The Australian Privacy Principles are the 13 rules in Schedule 1 to the Privacy Act 1988 that govern how Australian Government agencies and many businesses collect, use, store and disclose personal information. This list sets out each numbered sub-requirement, then the Act's own duties on data breaches, penalties, the privacy tort and the 2024 reforms.
Free account needed to download. You come straight back to the file.
Who it is for. Australian Government agencies, and organisations with annual turnover above A$3 million, plus some smaller ones such as health service providers. It can also reach overseas organisations that carry on business in Australia.
What this list covers. Written from the Federal Register of Legislation compilation of the Privacy Act 1988, Compilation No. 104, registered C2026C00227, which shows the law in force on 4 June 2026, and from the as-made Privacy and Other Legislation Amendment Act 2024 for the automated decision rule and its commencement. Check the Register for later compilations and the OAIC for guidance.: 101 requirements. Each has a reference, a heading and a sentence in plain English.
| Ref | Control | What it requires |
|---|---|---|
| APP 1.2 | Practices, procedures and systems | Take reasonable steps to put in place practices, procedures and systems that keep you in line with the APPs and any registered APP code that binds you, and that let you handle privacy enquiries and complaints. |
| APP 1.3 | Keep a privacy policy | Have a clearly written, up-to-date policy about how you manage personal information. |
| APP 1.4 | What the policy must say | Cover the kinds of information you collect and hold, how and why you handle it, how people can access and correct it, how to complain, and whether you disclose overseas and, where practicable, to which countries. |
| APP 1.5 | Make the policy available | Take reasonable steps to make the policy available free of charge and in a suitable form, which usually means putting it on your website. |
| APP 1.6 | Policy in the form requested | If someone asks for a copy of the policy in a particular form, take reasonable steps to give it to them in that form. |
| APP 2.1 | Anonymity and pseudonyms | Give people the option of not identifying themselves, or of using a pseudonym, when they deal with you on a particular matter. |
| APP 2.2 | When identification can be required | You may insist on identification where an Australian law or a court or tribunal order requires you to deal with identified people, or where dealing with an anonymous or pseudonymous person is impracticable. |
| Ref | Control | What it requires |
|---|---|---|
| APP 3.1 | Collection by agencies | An agency may collect personal information, other than sensitive information, only if it is reasonably necessary for, or directly related to, one of its functions or activities. |
| APP 3.2 | Collection by organisations | An organisation may collect personal information, other than sensitive information, only if it is reasonably necessary for one or more of its functions or activities. |
| APP 3.3 | Sensitive information needs consent | Collect sensitive information only with the person's consent, and only if it meets the same necessity test, unless one of the exceptions in APP 3.4 applies. |
| APP 3.4 | Exceptions for sensitive information | Sensitive information may be collected without consent where law or a court order requires or authorises it, a permitted general or health situation exists, an enforcement body meets its test, or a non-profit collects it about its members. |
| APP 3.5 | Lawful and fair means | Collect personal information only by lawful and fair means. |
| APP 3.6 | Collect from the person | Collect personal information from the person themselves unless that is unreasonable or impracticable. Agencies may also collect from others with consent or where an Australian law or court order requires or authorises it. |
| APP 3.7 | Solicited information | APP 3 governs the information you solicit, meaning information you ask for or go and get. Information that simply arrives unasked is dealt with under APP 4. |
| APP 4.1 | Assess unsolicited information | If you receive personal information you did not ask for, decide within a reasonable period whether you could have collected it under APP 3 had you asked for it. |
| APP 4.2 | Use it to make that decision | You may use or disclose the unsolicited information for the purpose of deciding whether you could have collected it. |
| APP 4.3 | Destroy or de-identify | If you could not have collected it and it is not in a Commonwealth record, destroy it or de-identify it as soon as practicable, provided that is lawful and reasonable. |
| APP 4.4 | If you keep it | If you do not have to destroy or de-identify the information, APPs 5 to 13 apply to it as if you had collected it under APP 3. |
| APP 5.1 | Notify at collection | At or before collection, or as soon as practicable afterwards, take the steps that are reasonable to tell the person about the matters in APP 5.2, or to make sure they are already aware of them. |
| APP 5.2(a) | Who you are | Tell the person your identity and contact details. |
| APP 5.2(b) | Indirect or unaware collection | If you collect from someone other than the person, or they may not realise you have collected it, tell them that you did and the circumstances. |
| APP 5.2(c) | Collection required by law | If an Australian law or court or tribunal order requires or authorises the collection, say so and name the law or give details of the order. |
| APP 5.2(d) | Purposes of collection | Tell the person why you are collecting the information. |
| APP 5.2(e) | Consequences of not providing it | Tell the person the main consequences, if any, of not giving you all or some of the information. |
| APP 5.2(f) | Who you usually disclose to | Tell the person which other bodies or people, or which types of them, you usually disclose this kind of information to. |
| APP 5.2(g) and (h) | Pointers to your policy | Say that your privacy policy explains how to access and correct the information and how to complain about a breach, and how you will deal with a complaint. |
| APP 5.2(i) and (j) | Overseas disclosure | Say whether you are likely to disclose the information to overseas recipients and, where practicable, in which countries they are likely to be. |
| Ref | Control | What it requires |
|---|---|---|
| APP 6.1 | Use and disclosure for the primary purpose | Do not use or disclose information for a purpose other than the one you collected it for unless the person consents or APP 6.2 or 6.3 applies. |
| APP 6.2 | Permitted secondary purposes | A secondary use or disclosure is allowed where the person would reasonably expect it and it is related (directly related, for sensitive information), or law, a permitted general or health situation, or an enforcement activity covers it. |
| APP 6.3 | Biometrics to enforcement bodies | An agency that is not an enforcement body may disclose biometric information or templates to an enforcement body only in line with the Commissioner's guidelines. |
| APP 6.4 | De-identify research health data | If an organisation collected health information under the research and statistics situation in s 16B(2), take reasonable steps to de-identify it before disclosing it. |
| APP 6.5 | Written note | If you use or disclose information because you reasonably believe it is necessary for an enforcement body's enforcement activities, make a written note of the use or disclosure. |
| APP 6.6 | Related bodies corporate | When a body corporate collects information from a related body corporate, the purpose the related company had counts as your primary purpose. |
| APP 6.7 | Exclusions | APP 6 does not govern an organisation's use or disclosure of information for direct marketing, which APP 7 covers, or of government related identifiers, which APP 9 covers. |
| APP 7.1 | No direct marketing by default | An organisation must not use or disclose personal information for direct marketing unless an exception in APP 7 applies. |
| APP 7.2 | Marketing to people who gave you the data | You may market using non-sensitive information collected from the person where they would reasonably expect it, you offer a simple opt-out and they have not used it. |
| APP 7.3 | Marketing without that expectation | Where the person would not expect it, or you got the data from someone else, you need consent (or it must be impracticable to get), a simple opt-out, a prominent opt-out statement in each message and no earlier opt-out. |
| APP 7.4 | Sensitive information for marketing | Use or disclose sensitive information for direct marketing only if the person has consented to that use or disclosure. |
| APP 7.5 | Contracted service providers | A contracted service provider for a Commonwealth contract may use or disclose information for direct marketing where that is necessary to meet its obligations under the contract. |
| APP 7.6 | Opt-out and source requests | People can ask you to stop marketing to them, to stop passing their information to others for marketing, and to say where you got their information. |
| APP 7.7 | Acting on those requests | Do not charge for the request or for acting on it, act on an opt-out within a reasonable period, and tell the person your source within a reasonable period unless that is impracticable or unreasonable. |
| APP 7.8 | Other marketing laws | APP 7 does not apply to the extent the Spam Act 2003, the Do Not Call Register Act 2006, certain Interactive Gambling Act rules or other prescribed laws apply instead. |
| APP 8.1 | Overseas recipients | Before disclosing personal information to someone outside Australia who is not you or the person concerned, take reasonable steps to make sure they do not breach the APPs, other than APP 1, in handling it. |
| APP 8.2 | When APP 8.1 does not apply | The duty falls away if you reasonably believe the recipient is bound by a substantially similar law with enforcement routes, the person consents after being told, or an Australian law or a permitted general situation applies. |
| APP 8.3 | Prescribed countries and schemes | APP 8.1 does not apply where the recipient is subject to the law of a country, or is in a binding scheme, that the regulations prescribe, and any conditions are met. |
| APP 9.1 | Do not adopt government identifiers | An organisation must not adopt a government related identifier of a person as its own identifier for them, unless law or a regulation allows it. |
| APP 9.2 | Use or disclosure of government identifiers | Use or disclose a government identifier only where it is needed to verify identity, meet obligations to an agency, or fits another listed case such as a legal requirement, a permitted general situation or enforcement. |
| APP 9.3 | Prescribed identifiers | The regulations may allow the adoption, use or disclosure of a named identifier by named organisations in set circumstances. |
| Ref | Control | What it requires |
|---|---|---|
| APP 10.1 | Quality on collection | Take reasonable steps to make sure the personal information you collect is accurate, up to date and complete. |
| APP 10.2 | Quality on use or disclosure | Take reasonable steps to make sure the information you use or disclose is accurate, up to date, complete and relevant for the purpose of that use or disclosure. |
| APP 11.1 | Protect personal information | Take reasonable steps to protect the information you hold from misuse, interference and loss, and from unauthorised access, modification or disclosure. |
| APP 11.2 | Destroy or de-identify | When you no longer need information for any permitted purpose, take reasonable steps to destroy or de-identify it, unless it is in a Commonwealth record or the law requires you to keep it. |
| APP 11.3 | Technical and organisational measures | The reasonable steps under APP 11.1 and 11.2 include technical measures, such as access controls and encryption, and organisational ones, such as policies, training and vendor oversight. |
| Ref | Control | What it requires |
|---|---|---|
| APP 12.1 | Give access on request | If you hold personal information about a person, give them access to it when they ask. |
| APP 12.2 | Agency refusal grounds | An agency need not give access to the extent that the Freedom of Information Act or another Commonwealth access law requires or allows it to refuse. |
| APP 12.3 | Organisation refusal grounds | An organisation may refuse access on listed grounds, including a serious threat to safety, harm to other people's privacy, a frivolous request, legal proceedings, unlawfulness, enforcement, or commercially sensitive evaluations. |
| APP 12.4 | Respond and give access | Respond within 30 days if you are an agency, or within a reasonable period if you are an organisation, and give access in the manner requested if reasonable and practicable. |
| APP 12.5 | Other means of access | If you refuse access, or refuse the form requested, take reasonable steps to give access in a way that meets both your needs and the person's. |
| APP 12.6 | Mutually agreed intermediary | Access may be given through an intermediary that you and the person agree on. |
| APP 12.7 | No charge by agencies | An agency must not charge for the request or for giving access. |
| APP 12.8 | Charges by organisations | An organisation may charge for giving access, but the charge must not be excessive and must not apply to making the request. |
| APP 12.9 | Written notice of refusal | When you refuse access, give a written notice with the reasons (unless unreasonable), how to complain, and anything else the regulations require. |
| APP 12.10 | Commercially sensitive decisions | If you refuse because access would reveal evaluative information about a commercially sensitive decision, the reasons may include an explanation of that decision. |
| APP 13.1 | Correct information | If you are satisfied the information is inaccurate, out of date, incomplete, irrelevant or misleading, or the person asks, take reasonable steps to correct it so it is accurate, current, complete, relevant and not misleading. |
| APP 13.2 | Tell others about the correction | If you corrected information you had disclosed to another APP entity and the person asks you to tell it, take reasonable steps to do so unless impracticable or unlawful. |
| APP 13.3 | Written notice of refusal | If you refuse to correct, give a written notice with the reasons (unless unreasonable), how to complain, and anything else the regulations require. |
| APP 13.4 | Associate a statement | If you refuse and the person asks you to attach a statement that the information is wrong, take reasonable steps to attach it so that users of the information can see it. |
| APP 13.5 | Timing and cost of requests | Respond to correction and statement requests within 30 days if you are an agency, or a reasonable period if an organisation, and never charge for the request, the correction or attaching the statement. |
| Ref | Control | What it requires |
|---|---|---|
| s 15 | Duty to comply with the APPs | An APP entity must not do an act or engage in a practice that breaches an Australian Privacy Principle. |
| s 26A | Duty to comply with binding codes | An APP entity must not breach a registered APP code that binds it, so check the Codes Register for any code that covers your sector or activity. |
| s 6D | Small business exemption | A business with annual turnover of $3,000,000 or less is generally outside the APPs, but not if it, for example, provides a health service, trades in personal information or is a credit reporting body. |
| s 5B | Reach beyond Australia | The Act reaches acts done overseas by an organisation with an Australian link, including a foreign business that carries on business in Australia. |
| s 16 | Personal and household affairs | The APPs do not apply to an individual handling personal information only for personal, family or household affairs. |
| s 16A | Permitted general situations | Several APPs allow handling without consent in listed situations, such as preventing a serious threat, acting on suspected serious misconduct, locating a missing person or establishing or defending a legal claim. |
| s 16B | Permitted health situations | Organisations may collect, use or disclose health information without consent in the listed health situations, such as providing a health service or specified research and statistics work. |
| s 16C | Overseas recipients' breaches count as yours | If you disclose to an overseas recipient under APP 8.1 and they do something that would breach the APPs, you are treated as having done it and as having breached the APPs. |
| Ref | Control | What it requires |
|---|---|---|
| s 26WE | What is an eligible data breach | Unauthorised access, unauthorised disclosure, or loss likely to lead to either, of information you hold, that a reasonable person would think likely to cause serious harm to someone it concerns. |
| s 26WE(1) | Entities the scheme covers | The scheme applies to APP entities bound by APP 11.1 and, for their own information, to credit reporting bodies, credit providers and tax file number recipients. |
| s 26WC | Information held by overseas recipients | Information you disclosed to an overseas recipient under APP 8.1 is treated as still held by you, so a breach there can be your eligible data breach. |
| s 26WG | Judging serious harm | Weigh the kind and sensitivity of the information, the protections on it and how easily they could be beaten, who has or could get it, the nature of the harm, and any other relevant matter. |
| s 26WH | Assess suspected breaches | If you suspect, on reasonable grounds, a breach may have happened, assess it reasonably and quickly and take all reasonable steps to finish within 30 days of becoming aware. |
| s 26WF | Remedial action | If you act before serious harm results and a reasonable person would then conclude serious harm is not likely, the breach is not an eligible data breach. |
| s 26WK | Statement to the Commissioner | Once you know of reasonable grounds to believe a breach is eligible, prepare a statement with your identity, a description, the kinds of information and recommended steps, and give it to the OAIC as soon as practicable. |
| s 26WL | Notify the people affected | As soon as practicable after the statement is ready, tell each affected person, or those at risk, its contents. If neither is practicable, publish it on your website and publicise it. |
| s 26WR | Commissioner's direction | The Commissioner may direct you to prepare and share a statement and notify people. You get a chance to make a submission first, and the direction can be reviewed in the Administrative Review Tribunal. |
| ss 26WJ, 26WM to 26WQ | Exceptions | Narrow exceptions cover breaches already handled by another entity, enforcement activities, inconsistent secrecy laws and declarations by the Commissioner, including extending the time to notify. |
| Ref | Control | What it requires |
|---|---|---|
| s 13G(1) | Serious interference with privacy | A serious interference with a person's privacy is a civil penalty contravention. Added in 2012 and amended in 2022 and 2024, it is the main route to the largest penalties. |
| s 13G(1B) | Factors for seriousness | A court may weigh the kind and sensitivity of the information, the consequences, how many people were affected, whether a child or vulnerable person was involved, repetition, and any failure to maintain compliance systems. |
| s 13G(2) | Maximum penalty, other than companies | For a person who is not a body corporate, the maximum penalty is $2,500,000 per contravention. |
| s 13G(3) | Maximum penalty for companies | For a body corporate the cap is the greatest of $50,000,000, three times the benefit obtained if the court can value it, or 30% of adjusted turnover in the breach period if it cannot. |
| s 13H | Other interferences with privacy | Where an interference is not serious, a contravention carries a maximum penalty of 2,000 penalty units. A court may substitute this for s 13G under s 13J. |
| s 13K | Infringement and compliance notices | Listed breaches (APP 1.3, 1.4, 2.1, 6.5, 7 opt-out duties and 13.5) and a non-compliant breach statement under s 26WK(3) carry up to 200 penalty units and can draw infringement or compliance notices. |
| s 80UA | Orders to put things right | A court that finds a civil penalty breach can order action to redress loss, compensation, a change of conduct or a published statement. The court can act on its own or on an application, made within 6 years by the Commissioner or an affected person. |
| Ref | Control | What it requires |
|---|---|---|
| Sch 2 cl 7 | Tort for serious invasions of privacy | A person can sue over an intentional or reckless, serious invasion of privacy by intrusion on seclusion or misuse of information, where they had a reasonable expectation of privacy and the public interest favoured them. Started 10 June 2025. |
| Sch 2 cl 8 | Defences | Defences include lawful authority, consent, preventing a serious threat to life, health or safety, proportionate defence of people or property, and certain defamation-style defences for publications. |
| Sch 2 cl 11 and 12 | Remedies | A court may award damages, including for emotional distress, subject to a cap on non-economic and exemplary damages of the greater of $478,550 or the defamation cap. It may also order apologies, corrections and account of profits. |
| Sch 2 cl 14 | Time limits | Proceedings generally must start within 1 year of becoming aware or 3 years of the invasion, whichever is earlier. For a child, before the 21st birthday. |
| Sch 2 cl 15 to 18 | Exemptions | The tort does not apply to journalists, to intelligence and law enforcement bodies, to agencies and their staff acting in good faith in their functions, or to people under 18. |
| APP 1.7 to 1.9 | Automated decision transparency | From 10 December 2026, if a computer program makes, or substantially and directly supports, a decision that could significantly affect a person's rights or interests, the privacy policy must say what data it uses and the kinds of decisions. |
| s 26GC | Children's Online Privacy Code | The OAIC must register a children's online privacy code by 10 December 2026 (a draft at its 5 August 2026 update). It binds social media, electronic and internet services likely to be used by children, other than health services. |
| Ref | Control | What it requires |
|---|---|---|
| Part IIIA | Credit reporting rules | Credit reporting bodies and credit providers follow separate rules for credit reporting information, including notification of breaches under Part IIIC. |
Alongside the list above, SecureXcel keeps a unified set of practical controls. For each control the workbook gives the risk it addresses, the objective, a description, whether it is preventive or detective, how often to run it, the design and operating test procedures, and the evidence to collect, with the references it covers in this framework. There is one workbook per framework, supplied as it is, with a Version History sheet for document control. Free account needed; you come straight back to the file.
Federal agencies and organisations with annual turnover above A$3 million, and some smaller organisations, for example those that provide health services or trade in personal information. The Act can also reach overseas organisations with an Australian link.
Unauthorised access or disclosure of personal information, or loss that is likely to lead to it, where a reasonable person would think serious harm to someone is likely and remedial action has not prevented that. Those must be reported.
You must take all reasonable steps to finish a reasonable and expeditious assessment within 30 days of becoming aware of the suspicion. If you then have reasonable grounds to believe it is an eligible breach, tell the OAIC and the affected people as soon as practicable.
For a serious interference with privacy, a company faces up to the greatest of $50,000,000, three times the benefit obtained, or 30% of adjusted turnover. Other interferences carry up to 2,000 penalty units.
No. It is a plain-English summary in our own words. The Privacy Act 1988 on the Federal Register of Legislation and the OAIC's guidance are the authority, so check them before you rely on a requirement.