Shield
Start free trialFree trial
Menu
For your teamFrameworksHow it worksPricingSecurityQuestionsCompareSign in

Frameworks · Privacy Act

The Australian Privacy Principles, with the evidence behind each one.

Map your privacy policy, collection notices, data handling procedures, access requests and breach response plan to each Australian Privacy Principle and the Notifiable Data Breaches scheme.

Start a 14-day free trialHow a programme works

The framework

NamePrivacy Act 1988 (Cth)
Who it applies toAPP entities: Australian Government agencies and organisations. An organisation is an individual, body corporate, partnership, other unincorporated association or trust that is not a small business operator, a registered political party, an agency, a State or Territory authority or a prescribed State or Territory instrumentality. A small business operator (one that carries on only businesses with an annual turnover of $3,000,000 or less) is outside the Act unless an exception in section 6D(4) applies, regulations or section 6E treat it as an organisation, or it has chosen to be treated as one under section 6EA. The Notifiable Data Breaches scheme also covers credit reporting bodies, credit providers and holders of tax file number information.
ss 6(1) (APP entity), 6C(1), 6D, 6E, 6EA, 15 and 26WE(1), Compilation No. 104 (C2026C00227), in force from 4 June 2026; text identical in Compilations No. 101–103 (from 11 December 2024), read 10 November 2026
RegulatorOffice of the Australian Information Commissioner
In force on 11 November 2026From 11 December 2024 (Compilation No. 101 onwards)
Sch 1 (APPs 1–13); Part IIIC; ss 6(1), 6C–6EA, 7B(3), 11, 15, 16B(2), Compilation No. 104 (C2026C00227), in force from 4 June 2026; text identical in Compilations No. 101–103 (from 11 December 2024), read 10 November 2026

What a Privacy Act programme does

Every principle as a control

Each APP, and the Act's breach notification duties, is a control with its section and the version in force, including amendments published before they start.

Breach assessments on the clock

Record a suspected eligible data breach and assess it against the scheme's elements and timeframe. The decision and any statement are your organisation's to make and lodge.

Personal information handled carefully

Flag documents as personal or sensitive. Board views and the read API withhold them by default, and the evidence trail never copies personal information into itself.

Changes published before they start

When a change is published before it starts, made. Shield lists the controls to re-map and the date.

From 10 December 2026

From 10 December 2026: automated decisions in APP privacy policies (APP 1.7–1.9)

From 1 January 2027

From 1 January 2027: APP 7.8 also names subsection 62P(2) of the Interactive Gambling Act 2001

Versions

VersionFromUntilSource
From 11 December 2024 (Compilation No. 101 onwards)11 December 20249 December 2026Sch 1 (APPs 1–13); Part IIIC; ss 6(1), 6C–6EA, 7B(3), 11, 15, 16B(2)
From 10 December 2026: automated decisions in APP privacy policies (APP 1.7–1.9)10 December 202631 December 2026Sch 1, Part 15, items 87–89; s 2(1) table item 7
From 1 January 2027: APP 7.8 also names subsection 62P(2) of the Interactive Gambling Act 20011 January 2027CurrentSch 1, Part 2, items 46–47; s 2(1) table item 2

Controls (56)

From 11 December 2024 (Compilation No. 101 onwards). Each control cites its source; your programme holds made.'s plain-English summary of each obligation beside it.

Who the Act covers

RefControlCitation
s 15Comply with the APPs as an APP entityPrivacy Act 1988 (Cth) s 15; s 6(1) (APP entity); s 6C(1) (organisation)
s 6DSmall business exemption and its limitsPrivacy Act 1988 (Cth) ss 6D, 6DA
ss 6E, 6EASmall business operators treated as organisationsPrivacy Act 1988 (Cth) ss 6E, 6EA
s 7B(3)Employee records exemptionPrivacy Act 1988 (Cth) s 7B(3); s 6(1) (employee record)

Consideration of personal information privacy (APPs 1–2)

RefControlCitation
APP 1Open and transparent management of personal informationPrivacy Act 1988 (Cth) Sch 1, APP 1
APP 1.2Practices, procedures and systems for APP compliancePrivacy Act 1988 (Cth) Sch 1, APP 1.2
APP 1.3A clearly expressed and up-to-date APP privacy policyPrivacy Act 1988 (Cth) Sch 1, APP 1.3–1.4
APP 1.5Privacy policy available free and in an appropriate formPrivacy Act 1988 (Cth) Sch 1, APP 1.5–1.6
APP 2Anonymity and pseudonymityPrivacy Act 1988 (Cth) Sch 1, APP 2

Collection of personal information (APPs 3–5)

RefControlCitation
APP 3Collection of solicited personal informationPrivacy Act 1988 (Cth) Sch 1, APP 3
APP 3.1Collect only personal information that is reasonably necessaryPrivacy Act 1988 (Cth) Sch 1, APP 3.1–3.2
APP 3.3Collect sensitive information only with consent or under an exceptionPrivacy Act 1988 (Cth) Sch 1, APP 3.3–3.4
APP 3.5Collect personal information by lawful and fair meansPrivacy Act 1988 (Cth) Sch 1, APP 3.5
APP 3.6Collect personal information from the individualPrivacy Act 1988 (Cth) Sch 1, APP 3.6
APP 4Dealing with unsolicited personal informationPrivacy Act 1988 (Cth) Sch 1, APP 4
APP 4.1Decide whether unsolicited information could have been collectedPrivacy Act 1988 (Cth) Sch 1, APP 4.1–4.2
APP 4.3Destroy or de-identify unsolicited information that couldn't have been collectedPrivacy Act 1988 (Cth) Sch 1, APP 4.3–4.4
APP 5Notification of the collection of personal informationPrivacy Act 1988 (Cth) Sch 1, APP 5

Dealing with personal information (APPs 6–9)

RefControlCitation
APP 6Use or disclosure of personal informationPrivacy Act 1988 (Cth) Sch 1, APP 6
APP 6.1Use or disclose only for the primary purpose or a permitted secondary purposePrivacy Act 1988 (Cth) Sch 1, APP 6.1–6.3, 6.6
APP 6.4De-identify health information before disclosing it (organisations)Privacy Act 1988 (Cth) Sch 1, APP 6.4; s 16B(2)
APP 6.5Written note of enforcement-related use or disclosurePrivacy Act 1988 (Cth) Sch 1, APP 6.5
APP 7Direct marketingPrivacy Act 1988 (Cth) Sch 1, APP 7
APP 7.1Direct marketing only within the APP 7 exceptionsPrivacy Act 1988 (Cth) Sch 1, APP 7.1–7.5
APP 7.7Act on opt-out and source requests without chargePrivacy Act 1988 (Cth) Sch 1, APP 7.6–7.7
APP 8Cross-border disclosure of personal informationPrivacy Act 1988 (Cth) Sch 1, APP 8
APP 9Adoption, use or disclosure of government related identifiersPrivacy Act 1988 (Cth) Sch 1, APP 9
APP 9.1Don't adopt a government related identifier as the organisation's ownPrivacy Act 1988 (Cth) Sch 1, APP 9.1, 9.3
APP 9.2Use or disclose government related identifiers only as permittedPrivacy Act 1988 (Cth) Sch 1, APP 9.2–9.3

Integrity of personal information (APPs 10–11)

RefControlCitation
APP 10Quality of personal informationPrivacy Act 1988 (Cth) Sch 1, APP 10
APP 10.1Personal information collected is accurate, up to date and completePrivacy Act 1988 (Cth) Sch 1, APP 10.1
APP 10.2Personal information used or disclosed is accurate, up to date, complete and relevantPrivacy Act 1988 (Cth) Sch 1, APP 10.2
APP 11Security of personal informationPrivacy Act 1988 (Cth) Sch 1, APP 11
APP 11.1Protect personal information from misuse, interference, loss and unauthorised accessPrivacy Act 1988 (Cth) Sch 1, APP 11.1, 11.3
APP 11.2Destroy or de-identify personal information no longer neededPrivacy Act 1988 (Cth) Sch 1, APP 11.2, 11.3

Access to, and correction of, personal information (APPs 12–13)

RefControlCitation
APP 12Access to personal informationPrivacy Act 1988 (Cth) Sch 1, APP 12
APP 12.1Give individuals access to their personal informationPrivacy Act 1988 (Cth) Sch 1, APP 12.1–12.3
APP 12.4Respond to access requests in time and in the manner requestedPrivacy Act 1988 (Cth) Sch 1, APP 12.4
APP 12.5Give access another way when refusingPrivacy Act 1988 (Cth) Sch 1, APP 12.5–12.6
APP 12.7Charges for accessPrivacy Act 1988 (Cth) Sch 1, APP 12.7–12.8
APP 12.9Written notice of refusal to give accessPrivacy Act 1988 (Cth) Sch 1, APP 12.9–12.10
APP 13Correction of personal informationPrivacy Act 1988 (Cth) Sch 1, APP 13
APP 13.1Correct inaccurate, out-of-date, incomplete, irrelevant or misleading informationPrivacy Act 1988 (Cth) Sch 1, APP 13.1
APP 13.2Notify other APP entities of a correction on requestPrivacy Act 1988 (Cth) Sch 1, APP 13.2
APP 13.3Written notice of refusal to correctPrivacy Act 1988 (Cth) Sch 1, APP 13.3
APP 13.4Associate a statement with information on requestPrivacy Act 1988 (Cth) Sch 1, APP 13.4
APP 13.5Respond to correction requests in time and without chargePrivacy Act 1988 (Cth) Sch 1, APP 13.5

Notifiable Data Breaches (Part IIIC)

RefControlCitation
s 26WE(1)Information the Notifiable Data Breaches scheme coversPrivacy Act 1988 (Cth) ss 26WB, 26WC(1), 26WE(1); s 11 (file number recipients)
s 26WE(2)Recognise an eligible data breachPrivacy Act 1988 (Cth) s 26WE(2)–(3)
s 26WGMatters relevant to likely serious harmPrivacy Act 1988 (Cth) s 26WG
s 26WFRemedial action that prevents an eligible data breachPrivacy Act 1988 (Cth) s 26WF
s 26WHAssess a suspected eligible data breach within 30 daysPrivacy Act 1988 (Cth) s 26WH
s 26WKPrepare a statement and give it to the CommissionerPrivacy Act 1988 (Cth) s 26WK
s 26WLNotify individuals, or publish the statementPrivacy Act 1988 (Cth) s 26WL
s 26WRComply with a Commissioner's direction to notifyPrivacy Act 1988 (Cth) s 26WR
ss 26WD, 26WJ, 26WM, 26WN, 26WP, 26WQRecord reliance on a notification exceptionPrivacy Act 1988 (Cth) ss 26WD, 26WJ, 26WM, 26WN, 26WP, 26WQ, 26WS, 26WT

Other frameworks

Facts are as shipped in made. Shield, read from each primary source on the date shown. They describe the law; they aren't legal advice, and your organisation decides how they apply to it.