Privacy Act 1988 (Cth) & Australian Privacy Principles
Regulates how personal information is collected, used, stored and disclosed. Applies to organisations with annual turnover above $3 million and to smaller organisations in specific classes, including health service providers handling health information and businesses that trade in personal information. Childcare and education activities do not automatically establish coverage.
Office of the Australian Information Commissioner (OAIC)
General information, not legal advice
Australian Digital Duty of Care obligations are subject to legislation and service applicability; this platform does not certify compliance. Digital Care provides tools and records to support your own risk management. It is not legal advice.
The text below is explanatory guidance, not a reproduction of legislation. The official complete text and commencement information control. These steps support your work; they do not guarantee that an obligation is met.
Does it apply to your business?
The APPs generally cover Australian Government agencies and covered private-sector organisations. Most businesses with turnover of $3 million or less are exempt unless an exception applies, such as providing a health service and holding health information, trading in personal information or certain contracting activities. Other exemptions and rules require individual checking.
Privacy amendments can have different commencement dates. Do not assume every new automated-decision transparency provision is already in force; check the current compilation and commencement information.
Detailed guidance
The Privacy Act and its 13 Australian Privacy Principles regulate the personal-information lifecycle for covered entities: governance, collection, use, disclosure, security, access and correction. Sensitive information, overseas disclosure and some specialised information attract additional rules.
Coverage is not determined by the presence of a privacy policy or by a broad industry label. Review the current Act, entity status and exemptions, including employee-record issues where relevant. Policies and records support the work but do not establish that practices satisfy the law.
APP 1 & APP 5
Governance, policy and collection notices
Implement reasonable privacy practices and procedures, maintain a clearly expressed current policy, and take reasonable steps to notify people of relevant matters at or before collection, or as soon as practicable afterwards.
APP 3, APP 6 & APP 8
Collection, use and disclosure
Collect information under the applicable necessity and collection conditions. Sensitive information has stricter rules. Use or disclose for the primary purpose or a permitted exception; assess overseas disclosure obligations where relevant.
APP 11
Security and retention
Take reasonable steps to protect information from misuse, interference, loss and unauthorised access, modification or disclosure. Destroy or de-identify information no longer needed unless a legal retention requirement or another exception applies.
APP 12 & APP 13
Access and correction
Provide an appropriate process for access and correction requests. Apply statutory timeframes, refusal grounds, notices and complaint options where relevant rather than assuming every request must have the same outcome.
Digital Care action checklist
0 of 4 preparation steps checked · This page only; not saved to your assessment or evidence records.
Check turnover, health-service activities, personal-information trading and other exceptions. Identify collection purposes, sensitive information, processors and overseas disclosures.
Keep a record: Coverage decision and personal-information inventory.
Check your published privacy policy and collection notices against the applicable APPs. Establish an access, correction and privacy-complaint process.
Keep a record: Current policy, collection notices and request-handling procedure.
Review account access, sharing, retention and deletion. Protect children’s information proportionately where relevant; do not treat an assessment as a security control.
Keep a record: Access reviews, retention rules and assigned remediation actions.
Check that notices are published, requests reach the right person and deletion processes work. Record unresolved legal questions separately for independent advice.
Keep a record: Dated verification notes and outstanding issues.
Where your plan does not include the risk register or file evidence, retain those records securely outside Digital Care and reference them in your self-review. Legal notifications and technical controls must be completed through the appropriate external channels.
Official full text & sources
Read the complete instrument on the official publisher’s website, including amendments, definitions, exemptions and commencement notes. Official sources may change after this guidance was reviewed.