Privacy Act 1988 & Australian Privacy Principles (APPs)
Australia's principal privacy law, built around 13 Australian Privacy Principles covering collection, use, disclosure and security of personal information. Recent reforms have significantly increased penalties and introduced new enforcement powers.
Who it applies to
- Australian and certain overseas organisations with an Australian link
- Commonwealth government agencies
- Businesses with annual turnover above the statutory threshold, plus specific sectors regardless of size
Key requirements
- Compliance with the 13 Australian Privacy Principles
- An up-to-date, accessible privacy policy
- Notifiable Data Breaches scheme reporting to the OAIC and affected individuals
- Reasonable steps to secure personal information
- Cross-border disclosure accountability
Maximum penaltyUp to the greater of AUD $50 million, three times the benefit obtained, or 30% of adjusted turnover for serious or repeated breaches
Official resources
Praeferre's summary is a starting point, not legal advice. For the authoritative text and current guidance, go directly to the governing body.
Questions we get asked
The Privacy Act 1988 applies to: Australian and certain overseas organisations with an Australian link; Commonwealth government agencies; Businesses with annual turnover above the statutory threshold, plus specific sectors regardless of size.
The core obligations are: Compliance with the 13 Australian Privacy Principles; An up-to-date, accessible privacy policy; Notifiable Data Breaches scheme reporting to the OAIC and affected individuals; Reasonable steps to secure personal information; Cross-border disclosure accountability. Each is summarised in plain English above, with a link to the official text.
Effective: 1988, with major reform amendments from 2022 onward. Regulator: Office of the Australian Information Commissioner (OAIC).
Up to the greater of AUD $50 million, three times the benefit obtained, or 30% of adjusted turnover for serious or repeated breaches.
Praeferre's GRC Automation engine monitors the policies, document repositories and web pages that carry your risk under the Privacy Act 1988, on a cadence you set, and turns every scan into an audit trail you can put in front of an auditor or regulator.
See how Praeferre automates Privacy Act 1988 compliance
Continuous monitoring, evidence and reporting for Privacy Act 1988 — alongside every other framework you need to satisfy.