Privacy & data protection in Queensland

APP 3 collection of sensitive information

APP 3 bars collecting sensitive information — health, race, religion, sexual orientation and more — without consent. What counts as sensitive, the exceptions and penalties.

Automated decision-making transparency in your privacy policy (APP 1.7–1.9)

From 10 December 2026, APP entities that use computer programs to make or substantially assist decisions that significantly affect individuals must say so in their APP privacy policy.

Notifiable Data Breach (NDB) scheme

Under the NDB scheme, APP entities must notify the OAIC and affected individuals of an eligible data breach likely to cause serious harm — assessed within 30 days.

APP 8 cross-border disclosure

Before disclosing personal information overseas, APP 8 requires reasonable steps so the recipient meets the APPs — unless an exception applies. Steps and exceptions.

Lodge Payment Times Reports (large business)

Large businesses (>$100M revenue) must report payment times to small business suppliers every 6 months.

Comply with doxxing criminal offence (Criminal Code s 474.17C)

From 11 December 2024, using a carriage service to dox personal data with menace is criminal.

Publish a Privacy Policy that meets APP 1

Every APP entity needs a clearly-expressed Privacy Policy covering APP 1.4 requirements.

APP 12 & APP 13 access and correction requests

Individuals can ask to access (APP 12) and correct (APP 13) the personal information you hold — the strict response times, allowable refusals and how to comply.

Consumer Data Right (CDR) participant accreditation + compliance

Banking, energy and (soon) non-bank lending data sharing — accredited participants must comply with privacy safeguards.

Simplified Debt Restructuring (small business)

Small companies (<$1M liabilities) can use SDR to restructure without full external admin.

Provide an APP 5 collection notice at or before collection

APP 5 requires notice of identity, purposes, recipients, consequences of not providing info, and where Privacy Policy lives.

Comply with the Spam Act 2003 (consent, identify, unsubscribe)

All commercial electronic messages must have consent, identify the sender, and offer a working unsubscribe.

APP 7 direct marketing: consent, opt-out & when you can't message (2026)

APP 7 restricts using or disclosing personal information for direct marketing and requires a simple opt-out — when it applies, the exceptions and penalties.

CDR Energy sector — phased

Energy retailers + distributors must share data via CDR.

Pre-2025 ban on unsolicited credit limit increase invitations

Credit card limit increase offers cannot be sent without prior written consent.

Privacy Act Reform — information controllers regime (proposed Tranche 2)

Tranche 2 reforms in scoping — information controllers + processors regime.

Prepare for the proposed removal of the small business exemption

Removing the Privacy Act small business exemption (<$3M turnover) is proposed for a future reform tranche — agreed in principle, not yet law.

Comply with credit reporting obligations (Part IIIA Privacy Act)

Credit providers and CRBs must adhere to the CR Code on collection, use, disclosure, hardship and dispute resolution.

Privacy statutory tort (serious invasions of privacy)

From June 2025 — serious invasion of privacy actionable in tort.

Children's Online Privacy Code 2026

OAIC developing a mandatory children's online privacy code — must be registered by 10 December 2026 (commencement not yet fixed).

APP 2 — anonymity + pseudonymity for individuals

Where reasonable, individuals must be able to deal with you anonymously or under a pseudonym.

Instant Asset Write-Off (annually re-set threshold)

SBE asset write-off threshold reset annually; $20,000 for FY25-26.

Data Availability and Transparency Act 2022

Commonwealth data sharing regime — accredited users + entities.