The rules in plain English
In Australia, personal information is governed by the Privacy Act 1988 and the 13 Australian Privacy Principles (APPs), which apply to most businesses with annual turnover above A$3 million and to some smaller ones, such as health providers. Marketing emails and texts are covered separately by the Spam Act 2003, and the regulator is the Office of the Australian Information Commissioner (OAIC).
A practical checklist
- A clear privacy policy saying what you collect, why, who receives it, where it is stored and how people can access or correct it
- A collection notice on every form, shown where the information is collected
- Consent for direct marketing, with a working unsubscribe link in every message as the Spam Act requires
- A cookie and analytics notice that matches what your site really does
- A simple process for access and correction requests and for complaints
- Care with overseas disclosure: know which providers store data outside Australia and tell people when you send information abroad
Security and breaches
Use HTTPS, keep software updated, limit who can see personal information and keep audit logs. Under the Notifiable Data Breaches scheme, if a breach is likely to result in serious harm you must notify the OAIC and the affected people as soon as practicable, and suspected breaches must be assessed within 30 days.
Records and retention
Keep personal information only as long as you need it, delete or de-identify it when it is no longer required and write down who can access each system. Check the OAIC’s guidance and your industry rules before launch, because health, finance and education providers can have extra obligations.
This article is general information, not legal advice. For decisions that affect your business, speak to a qualified Australian lawyer.