Australian Privacy Principles: all 13 APPs explained

What are the Australian Privacy Principles?

The Australian Privacy Principles (APPs) are the 13 rules in the Privacy Act 1988 (Cth) that set out how a business collects, uses, stores and shares personal information. They cover everything from your privacy policy to your marketing list, and if the Act covers your business, they shape how you handle every customer’s details.

They are written as principles rather than a checklist, on purpose. A cafe, a physio clinic and a real estate agency handle information very differently, so the rules are designed to flex. The trade-off is that nobody hands you a tick list. This page gives you the plain English version of each principle with an everyday example, and the Privacy Act checklist turns them into questions you can answer.

Do the Australian Privacy Principles apply to your business?

The APPs apply to Australian Government agencies and to organisations with an annual turnover of more than $3 million. Some smaller businesses are covered regardless of turnover, including:

• health service providers that hold health information, such as medical practices, pharmacies, allied health practitioners and some gyms

• businesses that trade in personal information

• contracted service providers under an Australian Government contract

• operators of a residential tenancy database

• small businesses that have chosen to opt in

Some of these are only covered for certain activities rather than everything they do. If none of them fit and you turn over $3 million or less, the APPs may not apply to you. The Spam Act 2003 (Cth) still applies to your marketing emails and SMS whatever your size.

Whether you are covered depends on your situation, so check rather than assume. The OAIC’s small business guidance sets out the categories, and our guide to whether the Privacy Act covers small business walks through them.

APP 1: open and transparent management of personal information

APP 1 requires you to manage personal information openly. That means taking reasonable steps to put practices in place for handling privacy questions and complaints, and having a clearly expressed, up to date privacy policy that is free to access. For most small businesses, that is a privacy policy page linked from the website footer that names the tools you actually use and tells people how to reach you. A common slip is a policy copied from a template that describes systems you don’t have. Our guide to privacy policy requirements in Australia covers what it has to include.

APP 2: anonymity and pseudonymity

APP 2 says people should have the option of dealing with you without identifying themselves, or by using a pseudonym. The exceptions are where the law requires or authorises you to deal with identified people, or where it is impracticable to help someone who stays anonymous. A real estate agency’s general enquiry form (“What are rents like in this suburb?”) doesn’t need a full name and phone number to be answered, so making those fields optional is an easy win.

APP 3: collection of solicited personal information

APP 3 says you can only collect personal information that is reasonably necessary for your business’s functions or activities, and only by lawful and fair means. Sensitive information, such as health information, racial or ethnic origin, religious beliefs, sexual orientation or criminal record, is held to a higher standard: you generally need the person’s consent as well, although some exceptions apply, including some for health services. A physio clinic needs injury history to treat someone, but asking for marital status on the booking form probably isn’t necessary. Health businesses carry extra weight here, which our healthcare privacy page and guide to tracking pixels on health websites cover in more detail.

APP 4: dealing with unsolicited personal information

APP 4 covers personal information that arrives without you asking for it. Within a reasonable period, you need to work out whether you could have collected it under APP 3. If you couldn’t, you generally need to destroy or de-identify it as soon as practicable, where it is lawful and reasonable to do so. Say a stranger emails an agency scans of their bank statements and passport before any rental application exists. If the agency decides it couldn’t have collected them, they shouldn’t sit in the inbox.

APP 5: notification of the collection of personal information

APP 5 requires you to take reasonable steps to tell people certain things when you collect their information, at or before the time you collect it or as soon as practicable afterwards. That includes who you are and how to contact you, why you are collecting it, who you usually share it with, and whether it is likely to go overseas. A newsletter sign-up form on a WordPress site should have a short line under it explaining what the email address is used for, with a link to the privacy policy. That short line is usually called a collection notice.

APP 6: use or disclosure of personal information

APP 6 says information collected for one purpose generally can’t be used or disclosed for another purpose unless the person consents or an exception applies. One common exception is a secondary purpose the person would reasonably expect that is related to the original one, or directly related if the information is sensitive. A physio clinic shouldn’t confirm to a client’s employer that they attended an appointment unless the client has agreed or another exception applies. Website tools can raise APP 6 questions too, which our guide to tracking pixels and your privacy obligations covers.

APP 7: direct marketing

APP 7 says you can only use or disclose personal information for direct marketing if certain conditions are met. Where you collected the details from the person and they would reasonably expect the marketing, you still need to give them a simple way to opt out and respect it when they do. Using sensitive information, such as health information, for direct marketing requires consent. A real estate agency posting past clients a letter about a free appraisal needs a clear way for them to say no more letters. For email and SMS, the Spam Act generally takes over, with its own consent and unsubscribe rules.

APP 8: cross-border disclosure of personal information

APP 8 says that before you disclose personal information to someone overseas, you generally need to take reasonable steps to make sure they don’t breach the APPs in handling it. Some exceptions apply, and in certain circumstances you can be held responsible for what the overseas recipient does. Sending customer details to an email platform, booking system or CRM based overseas can count as an overseas disclosure, depending on the arrangement. The website privacy scanner is a quick way to see which third-party tools load on your site, so you know which ones to look into.

APP 9: adoption, use or disclosure of government related identifiers

APP 9 says an organisation generally can’t adopt a government related identifier, such as a Medicare number or driver licence number, as its own identifier for a person. It can only use or disclose one in limited circumstances, such as where that is reasonably necessary to verify someone’s identity or to meet its obligations to a government agency. A pharmacy may record a Medicare number where it needs it for a claim, but shouldn’t use it as the customer number in its loyalty program. Tax file numbers have their own separate rules.

APP 10: quality of personal information

APP 10 requires you to take reasonable steps to make sure the personal information you collect is accurate, up to date and complete, and that what you use or disclose is also relevant to the purpose. An allied health practice that confirms a returning client’s contact details and current medications at each visit is applying APP 10. Out of date records cause real problems when they drive billing, reminders or treatment decisions.

APP 11: security of personal information

APP 11 requires you to take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, change or disclosure. It also requires you to take reasonable steps to destroy or de-identify information you no longer need, unless the law requires you to keep it. A real estate agency that deletes rejected tenancy applications once they are no longer needed, rather than keeping years of ID scans in a shared drive, is doing both halves. If information is lost or accessed without authorisation and serious harm is likely, the notifiable data breaches scheme may also apply.

APP 12: access to personal information

APP 12 says that if someone asks for the personal information you hold about them, you generally have to give them access unless a specific exception applies. You need to respond within a reasonable period, and the OAIC generally considers 30 days reasonable. Any charge for giving access can’t be excessive, and you can’t charge for the request itself. If a former patient asks a clinic for everything it holds on them, knowing where records live (practice software, email, spreadsheets) is what makes the request manageable.

APP 13: correction of personal information

APP 13 requires you to take reasonable steps to correct personal information when someone asks, or when you are satisfied it is inaccurate, out of date, incomplete, irrelevant or misleading. You can’t charge for a correction request. If the person asks, you also need to take reasonable steps to tell any other business you previously shared the information with. When a customer tells an online store their address has changed, updating the store system but not the email platform leaves a wrong copy behind.

What does Australian Privacy Act compliance look like for a small business?

For most small businesses, it comes down to knowing what you collect, saying so honestly and keeping it safe. You don’t need a compliance team. Start here:

1. Map what you collect

List every form, booking system, checkout field and spreadsheet. If you can’t explain why you collect a field, stop collecting it.

2. List your tools

Note your email platform, analytics, ad pixels, CRM and booking software, and which of them send data overseas.

3. Check your privacy policy and collection notices

Make sure the policy names the tools you actually use, and that each form has a short line explaining why you need the details.

4. Set a deletion habit

Decide how long you keep each kind of record, then delete or de-identify it on schedule.

5. Review regularly

Recheck once a year, and whenever you add a new tool.

To go principle by principle, work through the Privacy Act checklist.

Source: Read the Australian Privacy Principles, Office of the Australian Information Commissioner, updated 25 July 2022.

This is general information, not legal advice. Every business handles information a bit differently, so if you’re not sure how this applies to yours, it’s worth checking with a lawyer or privacy adviser.