The Privacy Act 1988,
the 13 APPs and what changed in 2024.

The Privacy Act 1988 (Cth) is Australia's main privacy law. It regulates how "APP entities" handle personal information: information or an opinion about an identified individual, or an individual who is reasonably identifiable. It is administered by the Office of the Australian Information Commissioner (OAIC). The Act contains the 13 Australian Privacy Principles, credit reporting rules, tax file number rules, the Notifiable Data Breaches scheme and, since June 2025, a separate statutory tort for serious invasions of privacy.

It applies to an organisation outside Australia too if it has an "Australian link", which includes carrying on business in Australia. A SaaS company selling to Australian customers should assume it is in scope unless the small business exemption applies.

The APPs bind Australian Government agencies and "organisations". A business with an annual turnover of $3 million or less is generally a small business operator and exempt (section 6D). The exemption does not apply, whatever the turnover, if the business:

• provides a health service and holds health information (other than in employee records);
• discloses personal information to anyone else for a benefit, service or advantage, or pays to collect it;
• is a contracted service provider under a Commonwealth contract;
• is a credit reporting body; or
• falls into a category the Act or regulations bring in, such as reporting entities under the AML/CTF Act for those activities.

Removing the exemption was discussed in the Privacy Act Review but was not part of the 2024 Act; as of the June 2026 compilation, section 6D still stands. Enterprise customers often require the APPs by contract anyway.

An eligible data breach happens when there is unauthorised access to, or disclosure or loss of, personal information you hold, and a reasonable person would conclude it is likely to result in serious harm to any of the people it relates to (Part IIIC of the Act). If you take remedial action in time so serious harm is no longer likely, it is not notifiable.

1. Assess. If you suspect an eligible breach, carry out a reasonable and expeditious assessment and take all reasonable steps to finish it within 30 days (section 26WH).
2. Notify the OAIC. Once you have reasonable grounds to believe there has been an eligible breach, prepare a statement and give it to the Commissioner as soon as practicable (section 26WK). It must set out your identity and contact details, a description of the breach, the kinds of information involved, and the steps people should take.
3. Notify individuals as soon as practicable after that: everyone affected, or everyone at risk, or if neither is practicable, publish the statement on your website and publicise it (section 26WL).

There is no fixed hour count as under the GDPR, but the 30-day assessment limit is real and the OAIC expects speed. Since 11 December 2024 a breach statement that is missing the required content can attract an infringement notice. Our incident management page covers the response workflow.

Teams that already work to the GDPR have most of the building blocks, but the two laws are not interchangeable:

• Lawful basis. The APPs do not require a lawful basis for every processing activity; they control collection, use and disclosure by purpose, with consent required mainly for sensitive information.
• Exemptions. The small business and employee records exemptions have no GDPR equivalent.
• Transfers. APP 8 makes you accountable for an overseas recipient rather than requiring a transfer mechanism; the 2024 Act allows countries to be prescribed, but check whether any have been.
• Breach timing. "As soon as practicable" after a 30-day assessment window, rather than 72 hours.
• Data subject rights. Access and correction only; there is no general right to erasure or portability under the APPs.
• Cookies. No ePrivacy-style cookie rule, but identifying tracking data is personal information. The free cookie scanner shows what your site collects.