Regulations › Rest of world › Australia
Privacy Act (AU)
Privacy Act 1988 (Australia)
WhenIn effect since 1 January 1989
Who enforces itOffice of the Australian Information Commissioner
Who it applies toMost organizations with annual turnover above AU$3 million, and some smaller ones.
Tell the regulatorAssess suspected breaches within 30 days
DPO requiredNot required for organizations
RegistrationNo registration of organizations
Transfers abroadTake reasonable steps so overseas recipients comply with APPs
Request deadlineAgencies 30 days
Maximum fineBody corporate: greater of AUD 50 million, 3x the benefit, or 30% of adjusted turnover for ser…
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Reach and lawful basis
Reach abroad
2
Applies to organizations abroad with an Australian link, including carrying on business in Australia.s.5B(3) · source ↗
Section from the Act; legislation.gov.au not fetched this session.
Lawful basis
1
No lawful-basis list; collection must be reasonably necessary, and secondary use needs consent, reasonable expectation or an exception.APP 3, APP 6 · source ↗
Tranche 2 exposure draft (2026) would add a 'fair and reasonable' test; not enacted.
Consent
0
Consent may be express or implied.s.6(1) · source ↗
Section from the Act; legislation.gov.au not fetched this session.
Sensitive data
2
Sensitive information may be collected only with consent and where reasonably necessary, or under listed exceptions.APP 3.3-3.4 · source ↗
Children
1
No statutory age; OAIC guidance presumes capacity at 15. Children's Online Privacy Code (under 18) due by 10 Dec 2026.s.26GC (code power); OAIC guidance · secondary source · source ↗
Code was an exposure draft (consultation closed 5 Jun 2026); not yet registered on 18 Oct 2026.
People's rights
Rights
1
Access and correction; no statutory erasure, portability or objection rights (direct marketing opt-out aside).APP 12, APP 13 · source ↗
Automated-decision disclosure in privacy policies starts 10 Dec 2026 (notice duty, not a right).
Request deadline
0
Agencies 30 days; organizations within a 'reasonable period' (OAIC guidance: usually 30 days).APP 12.4 · source ↗
Scored for private organizations, which have no fixed period.
Marketing
2
APP 7 requires opt-out; Spam Act 2003 requires opt-in consent for commercial electronic messages.APP 7; Spam Act 2003 s.16 · source ↗
Spam Act section from recall.
Governance
DPO required
1
Not required for organizations; Australian Government agencies must appoint a privacy officer under the Agencies Code.APP 1.2; Privacy (Australian Government Agencies - Governance) APP Code 2017 · source ↗
Agency code not fetched this session.
Registration
0
No registration of organizations.None · source ↗
Section from the Act; legislation.gov.au not fetched this session.
DPIA
1
Agencies must do PIAs for high privacy risk projects; recommended for organizations.s.33D; Agencies Code s.12 · source ↗
Section from the Act; legislation.gov.au not fetched this session. Commissioner may direct an agency PIA (s.33D).
Records
1
Only a privacy policy and some use/disclosure notes (e.g. enforcement-related disclosures); no general ROPA.APP 1.3, APP 6.5 · source ↗
Retention
2
Destroy or de-identify personal information once no longer needed for any permitted purpose.APP 11.2 · source ↗
Breaches
Tell the regulator
1
Assess suspected breaches within 30 days; notify OAIC as soon as practicable for eligible data breaches.ss.26WH, 26WK · source ↗
Section from the Act; legislation.gov.au not fetched this session.
Tell people
2
Notify individuals at likely risk of serious harm as soon as practicable.s.26WL · source ↗
Section from the Act; legislation.gov.au not fetched this session.
Transfers
Transfers abroad
1
Take reasonable steps so overseas recipients comply with APPs; discloser stays accountable. Whitelist power added in 2024.APP 8.1; s.16C · source ↗
Whitelist commenced 11 Dec 2024; no countries listed yet per MinterEllison.
Localization
1
Sectoral only, e.g. My Health Record data must stay in Australia.My Health Records Act 2012 s.77 · source ↗
Section number from recall; not verified this session.
Enforcement
Maximum fine
3
Body corporate: greater of AUD 50 million, 3x the benefit, or 30% of adjusted turnover for serious interferences.s.13G · source ↗
Criminal liability
1
Limited: few Privacy Act offenses; 2024 amendments added Criminal Code doxxing offenses up to 7 years.Criminal Code ss.474.17C-474.17D · secondary source · source ↗
Section numbers from recall.
Private action
2
Statutory tort for serious invasions of privacy (from 10 Jun 2025); representative complaints to OAIC.Privacy Act Sch. 2; s.38 · secondary source · source ↗
Tort commencement 'on or by 10 June 2025'. No general private right for APP breaches.
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws