Privacy & data protection

Under the NDB scheme, APP entities must notify the OAIC and affected individuals of an eligible data breach likely to cause serious harm — assessed within 30 days.

From a phased commencement, APP entities using ADM must disclose in Privacy Policy.

APP 3 bars collecting sensitive information — health, race, religion, sexual orientation and more — without consent. What counts as sensitive, the exceptions and penalties.

All commercial electronic messages must have consent, identify the sender, and offer a working unsubscribe.

APP 5 requires notice of identity, purposes, recipients, consequences of not providing info, and where Privacy Policy lives.

Before disclosing personal information overseas, APP 8 requires reasonable steps so the recipient meets the APPs — unless an exception applies. Steps and exceptions.

Individuals can ask to access (APP 12) and correct (APP 13) the personal information you hold — the strict response times, allowable refusals and how to comply.

Credit providers and CRBs must adhere to the CR Code on collection, use, disclosure, hardship and dispute resolution.

Banking, energy and (soon) non-bank lending data sharing — accredited participants must comply with privacy safeguards.

Large businesses (>$100M revenue) must report payment times to small business suppliers every 6 months.

From 11 December 2024, using a carriage service to dox personal data with menace is criminal.

NSW employers conducting workplace surveillance must give notice + meet specific conditions.

ACT employers must follow ACT workplace surveillance + privacy framework.

Small companies (<$1M liabilities) can use SDR to restructure without full external admin.

Credit card limit increase offers cannot be sent without prior written consent.

APP 7 restricts using or disclosing personal information for direct marketing and requires a simple opt-out — when it applies, the exceptions and penalties.

Removing the Privacy Act small business exemption (<$3M turnover) is proposed for a future reform tranche — agreed in principle, not yet law.

Tranche 2 reforms in scoping — information controllers + processors regime.

Every APP entity needs a clearly-expressed Privacy Policy covering APP 1.4 requirements.

APP entities making decisions about individuals using ADM must disclose this in privacy policy from December 2026.

From June 2025 — serious invasion of privacy actionable in tort.

OAIC developing mandatory children's online privacy code (in force December 2026).

Energy retailers + distributors must share data via CDR.

Where reasonable, individuals must be able to deal with you anonymously or under a pseudonym.

Commonwealth data sharing regime — accredited users + entities.

SBE asset write-off threshold reset annually; $20,000 for FY25-26.

ACCC + OAIC CDR enforcement progressed in 2024-2025 — first civil penalty proceedings + significant infringement notices.

September 2022 Optus breach exposed ~10M customer records. OAIC alleges APP 11 failures + delayed notification.

OAIC investigated multiple SMB-scale breaches in 2024 — including in legal, retail, healthcare. Most resolved without penalty but documented APP 11 reasonable-steps + NDB notification expectations.

Class action + OAIC determination on Medibank Oct 2022 data breach affecting ~9.7M customers + their families.

Class action by ~9.8M Optus customers affected by September 2022 data breach.

Both retailers operated in-store facial recognition systems for loss-prevention. OAIC found inadequate notification and unjustified breach of APP 3.3 (sensitive information).

Bunnings operated facial recognition in stores for loss prevention without proper notice + consent for sensitive (biometric) information.

Kmart operated facial recognition for loss prevention; same proceedings as Bunnings determination 2024.

Multiple NSW government agency privacy reviews including data breaches + PPIPA failures.

Following the February 2022 Medlab Pathology breach, OAIC alleges ACL failed to take reasonable steps to protect personal information and failed to properly notify the breach.

Periodic ACCC + OAIC compliance reviews of CDR Banking data holders + accredited recipients.

March 2023 Latitude breach exposed personal info of ~14M customers including 7.9M driver licences.

Follow-up compliance from 2021 determination + ongoing biometric processing detected.

Uber sent more than 2 million commercial electronic messages without consent or proper unsubscribe facility.

The October 2022 Medibank breach exposed personal information of approximately 9.7 million current and former customers. OAIC alleges Medibank failed to take reasonable steps to protect personal information.

Health Engine forwarded patient data to insurance brokers without proper consent.

Pizza Hut sent over 10 million marketing messages without consent or proper unsubscribe over 2-year period.

Google misled Android users about the personal location data it collected, retained, and used by representing that the Location History setting controlled all location collection when other settings also collected data.

Clearview AI scraped publicly available images from the web and used them to build a facial-recognition tool that was offered to Australian police agencies.

7-Eleven collected facial images and faceprints from customers via in-store tablets as part of a customer feedback program. Consent processes were inadequate.