Privacy Act 1988

Overview

The Privacy Act 1988 was enacted by the Parliament of Australia to protect the privacy of individuals and establish a framework for the handling of personal information. It was introduced to address the growing need to safeguard personal information in an increasingly digital world, balancing the interests of individuals and entities that handle personal information. The Act seeks to promote the protection of privacy, recognise the public interest in protecting privacy, and implement Australia’s international obligations under the International Covenant on Civil and Political Rights. This legislation is essential for ensuring that personal information is managed responsibly and transparently, providing individuals with the right to access and correct their personal information, and imposing obligations on entities to safeguard against unauthorised access and breaches.

Scope and Application

The Privacy Act 1988 is a Commonwealth Act that applies to agencies, organisations, small business operators, and certain other entities and individuals across Australia, including its external Territories. The Act aims to protect the privacy of individuals by setting out the Australian Privacy Principles (APPs) and regulating the handling of personal information by APP entities. It also provides for the handling of credit reporting information by credit reporting bodies and credit providers. The Act binds the Crown and has extra-territorial application to acts and practices outside Australia if they involve Australian citizens or residents, or entities with an Australian link. Notably, the Act does not apply to State and Territory laws that can operate concurrently, except where it specifically extends to them. The Act includes provisions for the registration and enforcement of APP codes and credit reporting (CR) codes, with the Commissioner playing a central role in monitoring compliance and handling complaints. The Act is complemented by subordinate instruments that may extend or modify its application, such as APP and CR codes, and guidelines issued by the Commissioner. Exemptions and exclusions apply to certain acts by journalists, intelligence agencies, law enforcement bodies, and individuals under 18. The Act also includes provisions for the handling of eligible data breaches, public interest determinations, and the functions and powers of the Information Commissioner. The Act's application is not limited by secrecy provisions in other Commonwealth laws, except as expressly provided.

Key Provisions

• The Privacy Act 1988, as amended and in force on 4 June 2026, comprises several key sections that govern the protection of personal information and the handling of privacy-related issues in Australia. Central to the Act are the Australian Privacy Principles (APP), which set out a series of guidelines and requirements for APP entities (agencies, organisations, and small businesses) to manage personal information transparently and with respect for individual privacy. These principles include provisions for the open and transparent management of personal information, the quality and security of such information, and the rights of individuals to access and correct their personal information held by APP entities. Furthermore, the Act delineates specific rules for credit reporting information, including the collection, use, and disclosure of credit-related data by credit providers and credit reporting bodies. Additionally, the Act establishes a framework for the notification and handling of eligible data breaches, requiring entities to notify affected individuals and the Office of the Australian Information Commissioner (OAIC) when a breach occurs. The Act also outlines the functions and powers of the OAIC, including the ability to investigate complaints, issue compliance notices, and recommend the variation of APP codes and credit reporting (CR) codes.
• The obligations imposed by the Act are extensive. APP entities are required to comply with the APPs, ensuring that personal information is collected, used, disclosed, and stored in a manner that respects individual privacy. This includes having a clear privacy policy, notifying individuals about data collection, and implementing measures to protect personal information from unauthorised access or breaches. Credit providers and credit reporting bodies must adhere to specific rules concerning the collection and handling of credit reporting information. They are also mandated to ensure the quality and accuracy of the information they hold and to destroy or de-identify such information once it is no longer needed. Furthermore, entities must notify the OAIC and affected individuals of any eligible data breaches, which are breaches that are likely to result in serious harm to individuals. In cases of unauthorised obtaining of credit reporting information, entities are required to take steps to ensure the information is not used or disclosed without proper authorisation.
• The Act includes provisions for offences and penalties related to breaches of its requirements. Civil penalties can be imposed for serious interferences with privacy, with maximum penalties reaching up to $2.5 million for individuals and $500,000 for corporations. There are also specific penalties for breaches of APPs, CR codes, and the statutory tort for serious invasions of privacy, with fines up to 200 penalty units ($42,500 as of 2024) for non-compliance. Failure to comply with certain provisions, such as unauthorised access to personal information or making false statements, can lead to criminal charges. The Act also allows for the issuance of infringement notices for certain breaches, with penalties up to 60 penalty units ($12,750 as of 2024). Furthermore, the Act provides for the issuance of compliance and infringement notices for specific offences, with fines up to 200 penalty units for individuals and 100 penalty units for corporations.
• Offences under the Act can result in both civil and criminal consequences. For instance, Section 13G imposes civil penalties for serious interferences with privacy, with fines up to $2.5 million for individuals and $500,000 for corporations. Section 13K outlines penalties for breaches of APPs or CR codes, with fines up to 200 penalty units ($42,500 as of 2024) for non-compliance. Criminal offences can include imprisonment terms, with Section 66 specifying a penalty of up to 12 months imprisonment for certain breaches. Additionally, Section 66A provides for a penalty of up to 2 years imprisonment for more serious offences, such as the unauthorised collection, use, or disclosure of personal information. The Act also includes provisions for the issuance of infringement notices for specific offences, with penalties up to 60 penalty units for individuals and 30 penalty units for corporations. These measures are designed to enforce compliance with the Act and protect the privacy rights of individuals.

Legal classification tags

Area of Law

Privacy Law

Human Rights Law

Instrument

Act

Concepts

Definitions & Interpretation

Civil Penalty Provisions

Regulatory Standards

Reporting & Disclosure Obligations

Offence Provisions

Enforcement Powers