Who must comply with APP 3 collection of sensitive information?

APP 3 bars collecting sensitive information — health, race, religion, sexual orientation and more — without consent. What counts as sensitive, the exceptions and penalties.

APP 3 restricts collection of sensitive information (health, religious beliefs, racial/ethnic origin, political opinions, criminal record, biometric data + similar) to circumstances where the individual consents + collection is reasonably necessary, or specified exceptions apply.

Applies when the business has APP-entity status (turnover > $3M or a s 6D(4) carve-out) and sensitive information or children's data.

How the regulator frames it: All APP entities collecting sensitive information.

What triggers it: Collecting sensitive information.

Jurisdiction: Commonwealth law, so the test is the same in every state and territory.

Outcome across the 35 industries Rules Mate maps (35 of 35: no).

The answer is the same in every industry: no. Industry does not change who must comply.

Structure does not change the answer across all industries: for every structure the answer is "no".

Size does not change the answer across all industries: at every size band the answer is "no".

Each line is one run of the Rules Mate applicability engine for a single business profile, with the reason the engine gives:

• Pty Ltd company in real estate agents with 6–19 employees, turnover $1M–$3M: does not apply. Requires APP-entity status (turnover > $3M or a s 6D(4) carve-out) and sensitive information or children's data.

Starting from a small or large professional services company that does not otherwise meet the test, each of these single facts changes the engine's answer:

• The business holds health information: it then applies (annual turnover over $3M — an APP entity under the Privacy Act (s 6D) · Holds health information (sensitive information)).
• The business holds children's personal information: it then applies (annual turnover over $3M — an APP entity under the Privacy Act (s 6D) · Holds children's data).
• The business holds biometric information: it then applies (annual turnover over $3M — an APP entity under the Privacy Act (s 6D) · Holds biometric information (sensitive information)).

When due

At each collection event.

Frequency

Ongoing

Evidence to keep

Consent records; necessity assessment; collection notice.

Status

Current

Priority

Critical

Maximum penalty: Same penalty regime; class action exposure for biometric misuse (Clearview AI, 7-Eleven, Bunnings precedents)

Self-assessment. Authority: Privacy Act 1988 (Cth) ss6D, 33C, Sch 1 APP 1; OAIC Guide to privacy regulatory action Ch 9.

Frequency: Ongoing. No mandated periodic audit. APP 1 requires an up-to-date privacy policy and reasonable practices and procedures.

Who can perform it: The entity itself. The OAIC may conduct a privacy assessment (s33C) at its discretion and can compel documents; you cannot commission an OAIC assessment as an audit.

• OAIC determination — Bunnings facial recognition + biometric (2024): Sensitive-information collection requires consent — loss prevention is not a sufficient justification for facial recognition deployment.

• Automated decision-making transparency in your privacy policy (APP 1.7–1.9): From 10 December 2026, APP entities that use computer programs to make or substantially assist decisions that significantly affect individuals must say so in their APP privacy policy.
• Notifiable Data Breach (NDB) scheme: Under the NDB scheme, APP entities must notify the OAIC and affected individuals of an eligible data breach likely to cause serious harm — assessed within 30 days.
• APP 12 & APP 13 access and correction requests: Individuals can ask to access (APP 12) and correct (APP 13) the personal information you hold — the strict response times, allowable refusals and how to comply.
• APP 7 direct marketing: consent, opt-out & when you can't message (2026): APP 7 restricts using or disclosing personal information for direct marketing and requires a simple opt-out — when it applies, the exceptions and penalties.
• APP 8 cross-border disclosure: Before disclosing personal information overseas, APP 8 requires reasonable steps so the recipient meets the APPs — unless an exception applies. Steps and exceptions.

Rules Mate tracks 20 published obligations tagged "privacy", 3 of them rated critical. For a professional services Pty Ltd company with 6–19 employees operating in every state, 4 of those apply outright. This obligation is rated critical priority, and is an ongoing duty.

Regulated by Office of the Australian Information Commissioner.

OAIC: Privacy and freedom of information regulator. Administers the Privacy Act 1988, the Notifiable Data Breaches scheme, and the Australian Privacy Principles.

• Office of the Australian Information Commissioner

Privacy Act 1988: Federal privacy Act.

• Privacy Act 1988

Free tools that help with this obligation:

• Privacy Act 2026 readiness
• NDB notification timer
• Marketing compliance check (Spam Act)