Provide an APP 5 collection notice at or before collection
APP 5 requires notice of identity, purposes, recipients, consequences of not providing info, and where Privacy Policy lives.
Who must comply
All APP entities collecting personal information.
What triggers it
Collecting personal information.
When due
At or before collection (or as soon as practicable thereafter).
Evidence required
Collection notices, signup flows, consent dashboards.
Max penalty
Same penalty regime as broader Privacy Act breaches (up to $50M / 30% turnover)
Summary
APP 5 requires APP entities to take reasonable steps to notify individuals (or otherwise make information available) when collecting personal information. Mandatory matters: entity identity, purpose of collection, kinds of recipients, that the Privacy Policy contains information about access/correction, and consequences of not providing the info.
Enforced by
Source legislation
Topics
Related obligations
- CWLTHAPP 3 collection of sensitive informationAPP 3 bars collecting sensitive information — health, race, religion, sexual orientation and more — without consent. What counts as sensitive, the exceptions and penalties.
- CWLTHPublish a Privacy Policy compliant with APP 1Every APP entity needs a clearly-expressed Privacy Policy covering APP 1.4 requirements.
- CWLTHAPP 8 cross-border disclosureBefore disclosing personal information overseas, APP 8 requires reasonable steps so the recipient meets the APPs — unless an exception applies. Steps and exceptions.
- CWLTHAPP 12 & APP 13 access and correction requestsIndividuals can ask to access (APP 12) and correct (APP 13) the personal information you hold — the strict response times, allowable refusals and how to comply.
- CWLTHAPP 7 direct marketingAPP 7 restricts using or disclosing personal information for direct marketing and requires a simple opt-out — when it applies, the exceptions and penalties.
- CWLTHAPP 2 — anonymity + pseudonymity for individualsWhere reasonable, individuals must be able to deal with you anonymously or under a pseudonym.
Frequently asked questions
- Who must comply with an APP 5 collection notice at or before collection?
- All APP entities collecting personal information.
- What triggers an APP 5 collection notice at or before collection?
- Collecting personal information.
- When is an APP 5 collection notice at or before collection due?
- At or before collection (or as soon as practicable thereafter).
- What is the maximum penalty for an APP 5 collection notice at or before collection?
- Same penalty regime as broader Privacy Act breaches (up to $50M / 30% turnover)
- What evidence is required for an APP 5 collection notice at or before collection?
- Collection notices, signup flows, consent dashboards.
Source: https://oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-guidelines/chapter-5-app-5-notification-of-the-collection-of-personal-information. Rules Mate is not a law firm. Always verify against the live regulator source before acting.