The Australian Privacy Act: Your Rights and How to Use Them

The Australian Privacy Act 1988 is the main federal law on how personal information is handled in Australia. It applies to Australian Government agencies and to most businesses and not-for-profits with an annual turnover above 3 million Australian dollars, plus some smaller ones, and it sets out 13 Australian Privacy Principles (APPs). It gives you the right to access and correct your information and to complain to the Office of the Australian Information Commissioner (OAIC), and 2024 amendments added a new right to sue for serious invasions of privacy.

This guide explains the Australian Privacy Act for individuals: who it covers, what you can ask for, what the recent reforms changed, and where to go when an organization won’t help. It’s general information, not legal advice.

Who the Privacy Act applies to

The Act calls the organizations it covers “APP entities”. They include:

• Australian Government agencies and the Norfolk Island administration.
• Businesses and not-for-profits with annual turnover above 3 million Australian dollars.
• Some smaller businesses regardless of turnover, including private health service providers (such as GPs, pharmacies, gyms and allied health practices that hold health information), businesses that trade in personal information, credit reporting bodies, and contractors providing services under Commonwealth contracts.

Some things are generally outside the Act:

• Most small businesses under the turnover threshold, unless one of the exceptions applies.
• State and territory government agencies, which are covered by state or territory privacy laws instead. Several states also have separate health records laws.
• Individuals acting in a personal capacity.
• Registered political parties, and some acts by politicians.
• Media organizations acting in the course of journalism, where they have publicly committed to privacy standards.
• Employee records held by private-sector employers about current or former employees, in relation to the employment relationship.

“Personal information” means information or an opinion about an identified or reasonably identifiable individual, whether true or not. Sensitive information, such as health, racial or ethnic origin, religious beliefs, sexual orientation and criminal record, gets extra protection.

The 13 Australian Privacy Principles

The APPs are the rules APP entities must follow. They’re designed to be flexible, so organizations apply them to their own circumstances. In plain terms:

APP	What it covers
1	Open and transparent management, including a clear privacy policy
2	Anonymity and pseudonymity: dealing with you without your name where practicable
3	Collecting solicited personal information only where reasonably necessary
4	Dealing with unsolicited personal information
5	Telling you about collection
6	Using or disclosing information only for the purpose it was collected, with exceptions
7	Direct marketing, including your right to opt out
8	Sending personal information overseas
9	Government-related identifiers
10	Quality of personal information
11	Security, and destroying or de-identifying data no longer needed
12	Access to personal information
13	Correction of personal information

Your rights under the Australian Privacy Act

Access to your information

Under APP 12, you can ask an APP entity for access to the personal information it holds about you. Government agencies generally must respond within 30 days and can’t charge. Private organizations must respond within a reasonable period, usually treated as 30 days, and can’t charge for the request itself, although they may charge a reasonable amount for giving access. There are exceptions, for example where access would unreasonably affect someone else’s privacy or relates to legal proceedings. If an organization refuses, it must tell you why in writing and how to complain.

The request doesn’t need special wording. Our guide on how to make a data subject access request has a template you can adapt; refer to APP 12 and the Privacy Act instead of the GDPR.

Correction

Under APP 13, you can ask for inaccurate, out-of-date, incomplete, irrelevant or misleading information to be corrected. If the entity refuses, it must give reasons, and you can ask it to attach a statement that you believe the information is wrong. If it corrects information it has disclosed to another APP entity, you can ask it to notify them.

Opting out of direct marketing

You can ask an organization to stop using your information for direct marketing, and ask where it got your details.

Dealing anonymously

Where it’s lawful and practicable, you can choose not to identify yourself, for example when making a general inquiry.

Is there a right to deletion?

The Australian Privacy Act doesn’t currently contain a general right to erasure like the EU’s, described in our guide to the GDPR right to erasure. Canada’s PIPEDA is similar. However, APP 11 requires entities to take reasonable steps to destroy or de-identify personal information they no longer need. You can point to that when asking a company to delete old data.

The 2024 reforms and the new privacy tort

The Privacy and Other Legislation Amendment Act 2024 made the first major set of changes in years. Some parts started straight away and others commence later. In general terms, the changes include:

• A statutory tort for serious invasions of privacy. Individuals can now sue in court when someone seriously invades their privacy, either by intruding on their seclusion (for example, unlawful surveillance) or by misusing information about them (for example, publishing private details). You’d generally need to show you had a reasonable expectation of privacy, the invasion was intentional or reckless, it was serious, and your privacy interest outweighs any competing public interest, such as freedom of expression. There are exemptions, including for journalism, some law enforcement activity and children. This applies to individuals and organizations, not only APP entities.
• Criminal offenses for doxxing. New offenses cover using a carriage service to release people’s personal data in a way that’s menacing or harassing.
• Stronger enforcement. The OAIC has more options, including new tiers of civil penalties and infringement notices for some breaches.
• A children’s online privacy code, which the OAIC is to develop.
• Transparency about automated decisions, requiring privacy policies to explain when computer programs are used to make significant decisions about people, commencing later.

The government has also discussed further reforms, including proposals for new individual rights. These hadn’t become law at the time of writing, so check the OAIC’s website for the current position.

How to use your rights, step by step

1. Check the organization is covered. Look at its size and type, or its privacy policy, which should explain how to make requests and complaints.
2. Write to the privacy officer. Say what you want (access, correction, marketing opt-out, deletion of data it no longer needs), refer to the relevant APP, and include enough detail for them to find your records.
3. Keep copies and dates of everything you send and receive.
4. Give it time. Generally, allow 30 days for a response.
5. Complain to the organization if you’re unhappy with the answer or get none.
6. Escalate to an external dispute resolution scheme if the organization belongs to one (for example, the Australian Financial Complaints Authority for banks and insurers), or to the OAIC.

A worked example

This is an illustrative scenario, not a real client.

Tom, in Brisbane, applies for a loan and is told his credit report shows a default he doesn’t recognize. He also gets marketing texts from a company he’s never dealt with.

1. He requests a copy of his credit report and asks the credit provider to correct the default, which belonged to someone with a similar name.
2. He writes to the marketing company asking where it got his number and asking it to stop direct marketing.
3. The credit provider investigates and corrects the record. The marketing company says it bought his details from a list provider and stops the texts.
4. When the list provider ignores his follow-up for over a month, he lodges a complaint with the OAIC with copies of his letters.

How to complain to the OAIC

The Office of the Australian Information Commissioner handles privacy complaints about APP entities.

1. Complain to the organization first. The OAIC generally expects you to have done this and waited about 30 days for a response.
2. Lodge your complaint through the OAIC’s official website. It’s free.
3. Include evidence: your complaint to the organization, its reply, and a short timeline.
4. Take part in the process. The OAIC often tries conciliation, where both sides work toward a resolution.

The OAIC may decline to investigate in some cases, for example if another body is better placed. Where it does investigate, it may make a determination, which can require the organization to take steps and, in some cases, pay compensation. If your issue is with a state agency, go to your state or territory privacy commissioner instead.

Common mistakes to avoid

• Assuming every business is covered. Many small businesses are exempt. Check before investing time.
• Using the Privacy Act for posts by individuals. A private person’s social media post usually isn’t covered by the APPs, although the new tort or defamation law might apply. See our guide to Australian defamation law.
• Skipping the organization’s complaint process. The OAIC will usually ask you to go there first.
• Treating the tort as a quick fix. It’s a court action and the threshold is “serious”. Get legal advice.
• Ignoring external dispute schemes. For banks, insurers, telcos and energy companies, an industry ombudsman may be faster.

When to get help

Most requests under the Australian Privacy Act are simple to send yourself. If your address or phone number has been published to harass you, our guide on what to do if you’ve been doxxed covers safety first. If someone is threatening or harassing you, our guide to apprehended violence orders for online abuse explains that route to court protection. If personal information about you is spread across search results and sites, our content removal service can help work out which removal routes fit. For a claim under the new privacy tort, speak to an Australian privacy lawyer.

Frequently asked questions

Does the Australian Privacy Act apply to small businesses?

Generally not if their annual turnover is 3 million Australian dollars or less, but there are important exceptions. Private health service providers, businesses that trade in personal information, credit reporting bodies and some government contractors are covered regardless of size.

Who enforces the Australian Privacy Act?

The Office of the Australian Information Commissioner (OAIC). It handles complaints, investigates, and can take enforcement action. The new statutory tort for serious invasions of privacy is enforced separately through the courts.

Can I make a company delete my information in Australia?

There’s no general right to erasure yet, but APP 11 requires organizations to destroy or de-identify personal information they no longer need. You can ask for deletion on that basis and complain if they refuse without a good reason.

What is the new privacy tort?

Introduced by the 2024 amendments, it lets individuals sue for serious invasions of privacy, such as intrusion into their private space or misuse of their private information, where the invasion was intentional or reckless. Exemptions and a public interest test apply, so get legal advice before bringing a claim.

How long does an organization have to answer an access request?

Government agencies generally have 30 days. Private organizations must respond within a reasonable period, which the OAIC generally treats as 30 days.