What is Australia’s Privacy Act 1988?
The Privacy Act 1988 regulates how Australian Government agencies and many private organisations handle personal information. Its core is the 13 Australian Privacy Principles (APPs). The Notifiable Data Breaches (NDB) scheme has required breach notification since February 2018.
Who does it apply to?
Australian Government agencies, and private organisations, including not-for-profits, with annual turnover above A$3 million. Some smaller businesses are covered regardless, such as health service providers, businesses that trade in personal information, credit reporting bodies and contracted government service providers.
The 13 Australian Privacy Principles
They cover open and transparent management, anonymity and pseudonymity, collection of solicited and unsolicited information, notification of collection, use or disclosure, direct marketing, cross-border disclosure, government-related identifiers, quality, security, access and correction.
Notifiable Data Breaches
When an eligible data breach occurs, organisations must notify the OAIC and affected individuals. An eligible breach is unauthorised access or disclosure, or loss, likely to result in serious harm that remedial action cannot prevent. A suspected breach must be assessed within 30 days.
2024 reforms
The Privacy and Other Legislation Amendment Act 2024 introduced:
- a statutory tort for serious invasions of privacy;
- a Children’s Online Privacy Code to be developed;
- transparency duties for automated decisions, commencing in December 2026;
- clearer security obligations;
- new tiered civil penalties and infringement notices;
- criminal offences for “doxxing”.
Enforcement
For serious interferences with privacy, penalties can reach the greater of A$50 million, three times the benefit obtained, or 30% of adjusted turnover in the relevant period.
How does it relate to other frameworks?
The ASD Essential Eight is the government’s baseline cyber mitigation guidance. Critical infrastructure owners also have duties under the Security of Critical Infrastructure Act 2018.
Sources and official references
- The Privacy Act — Office of the Australian Information Commissioner (official source)
Links go to the publisher's own site. Where a standard is sold or copyrighted, MajorCyber™ summarises it in original words and links to the official listing instead of reproducing its text.
Listen to this page
Read aloud in UK English by your own device. Nothing is sent anywhere, and the voice is whichever one your browser provides.
This page is general educational information, not legal, audit or certification advice. Requirements depend on your organisation's circumstances and the current official text. MajorCyber™ is not affiliated with Commonwealth of Australia; administered by the Office of the Australian Information Commissioner (OAIC).
