Privacy Act Compliance for Australian Businesses: APPs, Data Breaches and Penalties

Key takeaways

The Privacy Act 1988 (Cth) imposes obligations on organisations with annual turnover above $3 million through the 13 Australian Privacy Principles (APPs), covering collection, use, storage, disclosure and destruction of personal information.
The Notifiable Data Breaches (NDB) scheme requires organisations to notify affected individuals and the OAIC of eligible data breaches that are likely to result in serious harm, with strict assessment and notification timeframes.
Maximum civil penalties for serious or repeated interference with privacy are the greater of $50 million, three times the benefit obtained or 30% of adjusted turnover, following the Privacy Legislation Amendment (Enforcement and Other Measures) Act 2022.
The Australian Government has proposed removing the small business exemption, which would extend Privacy Act obligations to all businesses regardless of turnover.
Businesses must treat personal information as a regulated asset requiring active governance, including privacy impact assessments, data retention policies, breach response plans and staff training on APP obligations.

The Privacy Act 1988 (Cth) is the primary legislation governing how Australian businesses handle personal information. It establishes the Australian Privacy Principles (APPs), which regulate the collection, use, disclosure, storage and destruction of personal information. With the introduction of the Notifiable Data Breaches (NDB) scheme in 2018, increasing enforcement activity by the Office of the Australian Information Commissioner (OAIC) and proposed reforms that will further expand the scope of the Act, privacy compliance is now a core business obligation. At Astris Law, we advise businesses on Privacy Act compliance, data breach response and APP audit programs.

Has your business experienced a data breach or need to review APP compliance? We advise on privacy obligations, breach response and compliance programs. Call (07) 3519 5616.

Who Must Comply with the Privacy Act?

The Privacy Act applies to "APP entities" which include:

Australian Government agencies
Organisations with annual turnover of more than $3 million
Private health service providers (regardless of turnover)
Organisations that trade in personal information (regardless of turnover)
Credit reporting bodies and credit providers
Organisations that have opted in to the Privacy Act
Certain small businesses that are related to larger entities

Importantly, the proposed Privacy Act reforms may remove the $3 million turnover exemption entirely, which would bring all Australian businesses within scope. Businesses currently below the threshold should prepare for this change.

The Australian Privacy Principles (APPs)

The 13 APPs cover the full lifecycle of personal information. Key principles include:

APP 1 - Open and Transparent Management

Organisations must have a clearly expressed and up-to-date privacy policy that describes how personal information is managed, including the types of information collected, how it is held, the purposes of collection and how individuals can access or correct their information.

APP 3 - Collection of Solicited Personal Information

Personal information may only be collected where it is reasonably necessary for the organisation's functions or activities. Sensitive information (including health, biometric and criminal record data) requires consent and must be directly related to a function or activity.

APP 6 - Use or Disclosure of Personal Information

Personal information may only be used or disclosed for the primary purpose for which it was collected, or for a secondary purpose where the individual would reasonably expect such use and it is related to the primary purpose.

APP 8 - Cross-Border Disclosure

Before disclosing personal information to an overseas recipient, the disclosing entity must take reasonable steps to ensure the recipient complies with the APPs. If the overseas recipient breaches the APPs, the disclosing entity is accountable.

APP 11 - Security of Personal Information

Organisations must take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. Information that is no longer needed must be destroyed or de-identified.

Privacy Breach Reporting: The Notifiable Data Breaches Scheme

Privacy breach reporting in Australia runs through the Notifiable Data Breaches (NDB) scheme in Part IIIC of the Privacy Act. Since February 2018, the scheme has required APP entities to notify affected individuals and the OAIC when a data breach is likely to result in serious harm.

What counts as a notifiable ("eligible") data breach?

An eligible data breach occurs when all three of the following are satisfied:

There is unauthorised access to, disclosure of or loss of personal information held by the entity
A reasonable person would conclude that the breach is likely to result in serious harm to any of the individuals to whom the information relates
The entity has not been able to prevent the likely risk of serious harm through remedial action

"Serious harm" is not defined but includes identity theft, financial loss, threats to physical safety, humiliation and damage to reputation or relationships. The assessment weighs the kind and sensitivity of the information, whether it is protected (for example, encrypted) and who is likely to have obtained it. A lost laptop with full-disk encryption and a promptly remote-wiped phone may not be notifiable; an exfiltrated customer database almost certainly is.

The 30-day assessment obligation

When an entity becomes aware of reasonable grounds to suspect an eligible data breach, it must carry out a reasonable and expeditious assessment within 30 calendar days. That is a maximum, not a target - the OAIC expects most assessments to conclude much faster, and the clock runs from suspicion, not confirmation. Document the assessment as you go: if the conclusion is "not notifiable", the contemporaneous record is your defence to any later OAIC inquiry.

How privacy breach reporting works in practice

If the assessment concludes the breach is an eligible data breach, the entity must, as soon as practicable, prepare a statement to the OAIC (lodged through the OAIC's online NDB form) setting out the entity's identity and contact details, a description of the breach, the kinds of information involved and the steps recommended for individuals. Affected individuals must then be notified, using whichever of the three statutory options applies: notify all individuals whose information was involved; notify only those at likely risk of serious harm; or, if neither is practicable, publish the statement on your website and take reasonable steps to publicise it.

Remedial action can change the answer: if you contain the breach and prevent the likely serious harm before it eventuates, the breach may cease to be notifiable. That is one of several reasons the first 24 to 48 hours matter so much.

Consequences of failing to report

Failing to assess or notify is an interference with privacy that engages the OAIC's full enforcement toolkit, which since the December 2024 amendments includes mid-tier civil penalties and infringement notices for less serious contraventions alongside the headline penalty regime described below. Non-reporting also compounds exposure in any subsequent regulatory investigation or class action: the breach becomes a cover-up.

Data Breach Response Checklist for Directors

When a breach is live, directors need a working checklist, not a policy document. Use this one (each item can be ticked off as your response progresses):

First 24-48 hours: contain and convene

Contain the breach: isolate affected systems, revoke compromised credentials, preserve logs and evidence
Activate the data breach response plan and convene the response team with a single decision-maker
Engage external advisors early: legal (privilege over the investigation), forensic IT and, if held, cyber insurer (many policies require immediate notification)
Start the 30-day assessment clock record: note the date and time reasonable suspicion arose

First week: assess and decide

Identify what information was accessed, whose it is and how sensitive it is
Assess likelihood of serious harm and whether remedial action can prevent it
Decide notifiability and document the reasoning, whichever way it goes
If notifiable, lodge the OAIC statement and notify affected individuals as soon as practicable - do not wait for day 30
Check contractual and other reporting duties: customer contracts, APRA CPS 234 (if regulated), the ASX (if listed), law enforcement via ReportCyber

Aftermath: remediate and record

Support affected individuals: credit monitoring, ID document replacement, a staffed contact channel
Complete a post-incident review and remediate the root cause; the OAIC may ask what changed
Brief the board and minute the breach, decisions and remediation - directors' oversight of cyber risk is itself a duty-of-care issue

Individuals affected by a serious breach now also have a direct avenue of their own: the statutory tort for serious invasions of privacy, introduced by the December 2024 reforms. We cover it in detail in our guide to Australia's privacy tort.

Penalties for Non-Compliance

The Privacy Legislation Amendment (Enforcement and Other Measures) Act 2022 significantly increased penalties for serious or repeated interferences with privacy:

For bodies corporate: The greater of $50 million, three times the value of any benefit obtained from the contravention or 30% of the entity's adjusted turnover during the relevant period
For individuals: Up to $2.5 million

These penalties place privacy compliance on a comparable enforcement footing to competition law and financial services regulation. The OAIC also has powers to accept enforceable undertakings, make determinations requiring compensation and seek Federal Court injunctions.

Practical Compliance Steps

Privacy policy: Review and update your privacy policy to ensure it accurately describes your information handling practices and meets APP 1 requirements
Data mapping: Understand what personal information your business collects, where it is stored, who can access it, whether it is disclosed overseas and when it is destroyed
Consent mechanisms: Review how you collect consent, particularly for sensitive information, direct marketing and cross-border disclosures
Data breach response plan: Develop and test a data breach response plan that enables your business to assess and notify breaches within the statutory timeframe
Third-party contracts: Ensure contracts with service providers (including cloud providers and offshore processors) include appropriate privacy protections and data breach notification obligations
Staff training: Train employees on privacy obligations, data handling procedures and breach reporting protocols

Conclusion

Privacy compliance in Australia is no longer a back-office issue. With penalties now reaching $50 million and the OAIC stepping up enforcement, businesses must treat personal information as a regulated asset requiring active management. The proposed removal of the small business exemption will further expand the reach of the Privacy Act. Astris Law's IP, technology and data practice advises businesses on Privacy Act compliance, APP audits, data breach response and the design of privacy governance frameworks.