Updated 5 October 2026Privacy Act 1988 · Schedule 1Includes 2026 reforms
Australian Privacy Principles (APPs): The Complete 2026 Guide for Australian Businesses and Marketers
The 13 Australian Privacy Principles explained in plain English — who must comply, what each APP requires, how they apply to websites, tracking pixels, email and AI, the penalties, the December 2026 changes, and how to work safely with an offshore marketing agency under APP 8.
By Chenna Reddy, Founder, Digital Masters 360 · 100% online digital marketing for Australian businesses · General information, not legal advice.
The Australian Privacy Principles in 50 Words
The Australian Privacy Principles (APPs) are 13 legally binding rules in Schedule 1 of the Privacy Act 1988 (Cth). They govern how Australian Government agencies and most businesses with annual turnover above A$3 million collect, use, disclose, secure, and give people access to and correct their personal information. The OAIC enforces them.
Key takeaways
- There are 13 APPs, grouped into five parts that follow the lifecycle of personal information — from planning to collection, use, security, access and correction.
- They apply to “APP entities”: Australian Government agencies and organisations with turnover above A$3 million, plus some smaller businesses regardless of turnover (e.g. health service providers and businesses that trade in personal information).
- The APPs are principles-based, so they flex to your size and risk — but the penalties are not small: up to the greater of A$50 million, three times the benefit obtained, or 30% of adjusted turnover for serious interferences.
- For marketers, the hot spots are APP 5 (notice), APP 6 (use), APP 7 (direct marketing), APP 8 (overseas disclosure) and APP 11 (security) — especially after the OAIC’s June 2026 tracking-pixel determinations.
- From 10 December 2026, privacy policies must disclose certain automated decision-making (new APP 1.7–1.9).
- A second tranche of reforms (exposure draft released 31 August 2026) proposes around 40 further changes — not yet law.
In this guide
- What are the Australian Privacy Principles?
- The 13 APPs at a glance (table)
- Each APP explained, with marketing examples
- Who must comply (and the small business exemption)
- APPs for marketers: pixels, cookies, email, CRM and AI
- Penalties and enforcement
- Notifiable Data Breaches and APP 11
- What is changing in 2026
- APPs vs GDPR, UK GDPR, CCPA and NZ
- 10-step APP compliance checklist
- Working with an offshore marketing agency under APP 8
- Common mistakes · Glossary · FAQs
What Are the Australian Privacy Principles?
The Australian Privacy Principles are the core obligations of Australia’s federal privacy law. Section 14 of the Privacy Act 1988 (Cth) gives them effect and Schedule 1 sets out their full text. They are technology-neutral and principles-based: instead of prescribing a single way to comply, they require you to take steps that are reasonable in the circumstances — which means a 20-person marketing team and a national bank will comply differently, but both must comply.
Where the APPs sit in Australian law
- Privacy Act 1988 (Cth) — the parent Act. The APPs are in Schedule 1.
- APP Guidelines — the OAIC’s chapter-by-chapter interpretation (not law, but the regulator’s view of how it will apply the law).
- APP codes — binding codes that add detail for a sector, e.g. the Privacy (Australian Government Agencies — Governance) APP Code 2017 and the Children’s Online Privacy Code, which must be registered by 10 December 2026.
- Related laws — the Spam Act 2003, Do Not Call Register Act 2006, state and territory privacy and health records laws, and the Consumer Data Right.
Who enforces the APPs?
The Office of the Australian Information Commissioner (OAIC) handles complaints, investigates, issues determinations, compliance notices and infringement notices, and can seek civil penalties in the Federal Court. Since 10 June 2025, individuals can also sue directly for serious invasions of privacy under the new statutory tort.
Are the APPs legally binding?
Yes. A breach of an APP is an “interference with the privacy of an individual” under the Privacy Act. That opens the door to OAIC complaints, investigations, enforceable undertakings and civil penalties. The OAIC’s APP Guidelines are not law, but they show how the regulator interprets each principle, so treat them as your playbook.
A short history: NPPs and IPPs to APPs
The APPs commenced on 12 March 2014, introduced by the Privacy Amendment (Enhancing Privacy Protection) Act 2012. They replaced two older sets of rules: the National Privacy Principles (NPPs) for the private sector and the Information Privacy Principles (IPPs) for government. If a page you are reading still talks about NPPs, it is out of date.
Key definitions you need first
Personal information
Information or an opinion about an identified individual, or an individual who is reasonably identifiable — whether true or not, and whether recorded or not. Names, emails, phone numbers, IP addresses linked to a profile, device IDs, location trails and website behaviour tied to a person can all be personal information. The 2024 amendments clarified that information can be personal information even without a name attached.
Sensitive information
A higher-risk category that includes health, genetic and biometric information, racial or ethnic origin, political opinions and memberships, religious or philosophical beliefs, trade union membership, sexual orientation or practices, and criminal record. Collecting it generally requires consent, and using it for direct marketing always does.
APP entity
An Australian Government agency or an “organisation” (individual, company, partnership, trust or unincorporated association) that is not exempt — most commonly because its annual turnover exceeds A$3 million.
Consent
Consent under the Privacy Act can be express or implied, but the OAIC expects it to meet four elements:
The four elements of valid consent
- Informed — the person knows what they are agreeing to.
- Voluntary — no bundling or pressure.
- Current and specific — tied to a defined purpose, not a blanket “we may use your data for anything”.
- Capacity — the person can understand and communicate consent (a key issue for children).
Practical tip: pre-ticked boxes and “by using this site you agree” banners rarely meet this standard for sensitive information.
The 13 Australian Privacy Principles at a Glance
Here is the full list of the 13 APPs in order, with what each requires and a real-world marketing example. Bookmark this table — it is the quickest summary of the Australian Privacy Principles you will find.
| APP | Name | What it requires | Marketing example |
|---|---|---|---|
| APP 1 | Open and transparent management of personal information | Have practices, procedures and systems to comply, and a clear, current, free privacy policy. | Your website privacy policy must list the tools (analytics, pixels, CRM) and any overseas recipients. |
| APP 2 | Anonymity and pseudonymity | Let people deal with you without identifying themselves where practicable. | Allow general enquiries or brochure downloads without forcing a full profile. |
| APP 3 | Collection of solicited personal information | Collect only what is reasonably necessary, by lawful and fair means; consent for sensitive information. | Trim lead-form fields; don’t collect date of birth “just in case”. |
| APP 4 | Dealing with unsolicited personal information | If you receive information you didn’t ask for, decide whether you could have collected it; if not, destroy or de-identify it. | CVs or health details emailed to a sales inbox. |
| APP 5 | Notification of the collection of personal information | Tell people at or before collection who you are, why you collect, who you share with and whether it goes overseas. | A collection notice next to every form and a pixel/cookie banner on page load. |
| APP 6 | Use or disclosure of personal information | Use or disclose only for the primary purpose, unless consent or an exception applies. | Using support-ticket emails for ad audiences is a secondary purpose. |
| APP 7 | Direct marketing | Direct marketing only within the APP 7 exceptions, with a simple opt-out; consent for sensitive information. | Retargeting via tracking pixels can be direct marketing. |
| APP 8 | Cross-border disclosure of personal information | Take reasonable steps so overseas recipients don’t breach the APPs; you stay accountable (s 16C). | Offshore agencies, freelancers and SaaS tools with overseas staff. |
| APP 9 | Government related identifiers | Don’t adopt, use or disclose government identifiers (e.g. Medicare or driver’s licence numbers) unless an exception applies. | Don’t use a licence number as a CRM customer ID. |
| APP 10 | Quality of personal information | Take reasonable steps to keep information accurate, up to date, complete and relevant. | Clean CRM lists and honour preference changes promptly. |
| APP 11 | Security of personal information | Protect information from misuse, interference, loss and unauthorised access; destroy or de-identify when no longer needed. | MFA on ad accounts, least-privilege agency access, retention schedules. |
| APP 12 | Access to personal information | Give people access to their information on request, within a reasonable period, subject to exceptions. | A process to export a contact’s CRM and marketing data. |
| APP 13 | Correction of personal information | Correct information that is inaccurate, out of date, incomplete, irrelevant or misleading. | Fix records on request and tell previous recipients if asked. |
The five parts: Part 1 — consideration of personal information privacy (APPs 1–2) · Part 2 — collection (APPs 3–5) · Part 3 — dealing with personal information (APPs 6–9) · Part 4 — integrity (APPs 10–11) · Part 5 — access and correction (APPs 12–13).
Each Australian Privacy Principle Explained (With Marketing Examples)
Most guides stop at a one-line summary. Below, each APP is explained in plain English with what it means for a website, CRM or ad account — because that is where most businesses actually handle personal information.
Part 1 — Consideration of personal information privacy (APPs 1–2)
APP 1 — Open and transparent management of personal information
APP 1 has two jobs. First, you must take reasonable steps to put practices, procedures and systems in place to comply with the APPs and handle complaints. Second, you must have a clearly expressed, up-to-date APP privacy policy, available free and in an appropriate form (usually your website). Under APP 1.4 the policy must cover the kinds of personal information you collect and hold, how you collect and hold it, your purposes, how people can access and correct it, how to complain and how you deal with complaints, and whether you are likely to disclose it overseas — naming the countries where practicable.
What it means for your marketing
A template privacy policy copied from another site almost never matches reality. List your actual tools (e.g. Google Analytics 4, Meta Pixel, LinkedIn Insight Tag, your CRM and email platform), what they collect, and where your agencies and vendors are located.
New from 10 December 2026: automated decision-making disclosures (APP 1.7–1.9)
If a computer program uses personal information to make, or substantially and directly contribute to, a decision that could reasonably be expected to significantly affect someone’s rights or interests, your privacy policy must describe the kinds of personal information used and the kinds of decisions involved. This covers AI tools but also rule-based systems and scoring models.
ADM quick check: automated credit or eligibility decisions, lead scoring that decides who gets an offer or price, automated fraud blocks, and AI screening of job applicants are all worth mapping before December.
APP 2 — Anonymity and pseudonymity
People must have the option of not identifying themselves, or using a pseudonym, unless the law requires identification or it is impracticable. Practical application: let visitors ask a general question via chat or download a guide without demanding a phone number.
Part 2 — Collection of personal information (APPs 3–5)
APP 3 — Collection of solicited personal information
Organisations may only collect personal information that is reasonably necessary for their functions or activities, must collect it by lawful and fair means, and should collect it directly from the individual unless that is unreasonable or impracticable. Sensitive information needs consent (subject to limited exceptions).
What it means for your marketing
Data minimisation is now a conversion tactic as well as a compliance one: shorter forms convert better. Audit every field and ask “do we use this?” If a pixel or form could capture health or other sensitive information (clinics, IVF, mental health, NDIS, insurance), you need consent specific to that collection.
APP 4 — Dealing with unsolicited personal information
If you receive personal information you did not ask for, decide within a reasonable period whether you could have collected it under APP 3. If not — and it isn’t in a Commonwealth record — destroy or de-identify it as soon as practicable, where lawful and reasonable.
APP 5 — Notification of the collection of personal information
At or before the time of collection (or as soon as practicable after), take reasonable steps to tell people: who you are and how to contact you, the fact and circumstances of collection, whether a law requires it, your purposes, what happens if they don’t provide it, who you usually disclose to, how to access your privacy policy and complain, and whether you are likely to send it overseas (and to which countries).
What it means for your marketing
A privacy policy link in the footer is not a collection notice. The OAIC has said tracking pixels need active, timely notice at the point of first interaction — typically a banner that names pixels specifically, not just cookies.
Part 3 — Dealing with personal information (APPs 6–9)
APP 6 — Use or disclosure of personal information
Use or disclose personal information only for the primary purpose it was collected for. A secondary use is allowed only with consent or if an exception applies — for example, the person would reasonably expect it and it is related to the primary purpose (directly related, for sensitive information), it is required or authorised by law, or a permitted general situation applies.
What it means for your marketing
Uploading customer emails to Meta or Google as a Custom Audience, or sending website event data to an ad platform, is a disclosure. Check that it fits the purpose you told people about, or get consent.
APP 7 — Direct marketing
Organisations must not use or disclose personal information for direct marketing unless an exception applies. Broadly: if you collected non-sensitive information from the person and they would reasonably expect the marketing, you can market as long as you provide a simple opt-out and they haven’t opted out. If they wouldn’t reasonably expect it, or you got the information from someone else, you generally need consent (or consent must be impracticable) and every message must include a prominent opt-out. Sensitive information always needs consent. People can also ask where you got their information.
APP 7 vs the Spam Act and Do Not Call Register
APP 7 does not apply to the extent the Spam Act 2003 (commercial email, SMS and instant messages) or the Do Not Call Register Act 2006 (telemarketing) applies. In practice: email/SMS → Spam Act rules (consent, identification, functional unsubscribe); calls → DNCR rules; targeted online ads, direct mail and retargeting → APP 7.
APP 8 — Cross-border disclosure of personal information
Before disclosing personal information to an overseas recipient, take reasonable steps to ensure the recipient does not breach the APPs (other than APP 1). Under section 16C, if the overseas recipient does something that would breach the APPs, you are generally treated as having breached them.
Exceptions to APP 8.1
- You reasonably believe the recipient is bound by a law or binding scheme substantially similar to the APPs, with mechanisms the individual can access to enforce it (the 2024 amendments also allow countries and schemes to be prescribed by regulation).
- The individual consents after being expressly told that APP 8.1 won’t apply.
- The disclosure is required or authorised by Australian law or a court/tribunal order, or a permitted general situation applies.
Watch out: if offshore staff can view or modify readable personal information — even in an Australian-hosted system — the OAIC may treat that as a disclosure. Contract terms and access design matter.
APP 9 — Adoption, use or disclosure of government related identifiers
Organisations must not adopt a government related identifier (such as a Medicare number, passport number or driver’s licence number) as their own identifier, or use or disclose one, unless an exception applies (e.g. verifying identity, or as required by law). Tax file numbers are covered separately by the TFN Rule.
Part 4 — Integrity of personal information (APPs 10–11)
APP 10 — Quality of personal information
Take reasonable steps to ensure the personal information you collect is accurate, up to date and complete — and, when you use or disclose it, also relevant to the purpose.
APP 11 — Security of personal information
Take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. The 2024 amendments clarified that “reasonable steps” include technical and organisational measures. When you no longer need the information for any permitted purpose, destroy or de-identify it (APP 11.2).
What it means for your marketing
- MFA on every ad, analytics, CRM and CMS account.
- Named user access for agencies — never shared passwords.
- Remove leavers and old agencies within 24 hours.
- Retention rules for leads that never converted.
- Encrypted exports, and no customer lists sitting in personal inboxes or chat apps.
Part 5 — Access to, and correction of, personal information (APPs 12–13)
APP 12 — Access to personal information
On request, give people access to the personal information you hold about them, within a reasonable period (the OAIC suggests usually 30 days for organisations), unless an exception applies. Organisations may charge a reasonable fee for giving access, but not for the request itself.
APP 13 — Correction of personal information
Take reasonable steps to correct personal information that is inaccurate, out of date, incomplete, irrelevant or misleading — on your own initiative or on request. If you refuse, explain why and let the person attach a statement; if asked, notify other entities you previously disclosed it to.
Who Must Comply With the Australian Privacy Principles?
The APPs bind APP entities: most Australian Government agencies (and the ACT Government under arrangement) and private sector organisations — including not-for-profits — with annual turnover above A$3 million.
The small business exemption (A$3 million turnover)
A “small business operator” — turnover of A$3 million or less in every financial year since 2001 (or since starting) — is generally outside the APPs. Once you exceed A$3 million in any financial year, you stay covered even if turnover later drops.
Small businesses that must comply anyway
- Private sector health service providers that hold health information (including allied health, gyms offering health assessments, pharmacies and many clinics).
- Businesses that trade in personal information — disclosing it for a benefit, or paying to collect it — e.g. lead generation and list brokers.
- Contracted service providers to Commonwealth contracts.
- Credit reporting bodies, and businesses related to a larger entity in the same group.
- Businesses prescribed by regulation — e.g. AML/CTF reporting entities (for those activities), residential tenancy databases and others.
- Businesses that opt in to the Privacy Act via the OAIC’s register.
Is the exemption going away?
The Government agreed in principle to remove the small business exemption after the Privacy Act Review, subject to impact analysis and support for small businesses. It has not been removed as at October 2026. Even so, small businesses that follow the APPs voluntarily find it easier to win enterprise and government contracts, pass vendor security reviews and earn customer trust.
Do the APPs apply to overseas businesses?
Yes, if they have an “Australian link” — for example, an overseas organisation that carries on business in Australia. A foreign e-commerce brand selling to Australians, or a SaaS platform with Australian customers, can be covered even without an Australian office.
Employee records exemption
Acts and practices of a private sector employer directly related to a current or former employment relationship and an employee record are exempt. It does not cover job applicants or contractors, and it does not cover customer data handled by staff.
Quick test: do the APPs apply to my business?
| Your situation | Do the APPs apply? |
|---|---|
| Australian business, turnover above A$3m | Yes |
| Turnover A$3m or less, general retail/services | Generally no — unless an exception applies |
| Any size, health service holding health information | Yes |
| Any size, selling or buying leads/personal information | Yes (unless every individual has consented) |
| Overseas company carrying on business in Australia (turnover above A$3m) | Yes — via the Australian link |
| Australian Government agency | Yes |
| State government agency | No — state/territory privacy laws apply instead |
Australian Privacy Principles for Marketers: Pixels, Cookies, Email, CRM and AI
This is where most APP problems happen in practice — and where most guides go quiet. As a digital marketing agency, these are the issues we see most often in Australian accounts.
Tracking pixels after the OAIC’s June 2026 determinations
On 24 June 2026 the OAIC published two determinations involving Monash IVF and Medmate over third-party tracking pixels (such as Meta and TikTok pixels) on their websites. The Commissioner considered APP 3.3 (collecting sensitive information without consent), APP 5.1 (failing to notify), and APP 7 (direct marketing) — finding that website activity data collected via pixels can be personal and even sensitive information, and that retargeting ads based on it can be direct marketing. (Bird & Bird summary, Allens analysis)
What the OAIC’s position means
- No name in the data doesn’t mean no personal information — hashed emails, IDs and browsing behaviour can still identify someone.
- A generic cookie banner may not be enough: pixels should be named, along with the platforms receiving the data and the purpose.
- Retargeting and lookalike audiences can be direct marketing under APP 7 — provide a simple opt-out.
- The website owner is accountable, even if an agency or developer installed the pixel.
What to change this quarter
- Inventory every tag: GA4, Google Ads, Meta, TikTok, LinkedIn, Microsoft Ads, Hotjar/Clarity, chat widgets and CRM forms.
- Remove pixels from pages that can reveal sensitive information (booking, symptom, treatment, finance hardship and member pages).
- Implement a consent banner that names pixels, recipients and purposes, and wire it to Google Consent Mode v2 and platform-side consent settings.
- Turn off automatic advanced matching / form-field scraping unless you have clearly disclosed it.
- Prefer server-side tagging with filtered, minimised events.
- Update your privacy policy and collection notices to match.
Cookies and consent banners
Australia has no stand-alone “cookie law” like the EU’s ePrivacy rules, but cookies and similar identifiers fall under the APPs whenever they collect personal information. That means APP 5 notice, APP 6 purpose limits, APP 7 opt-outs and APP 11 security all apply. If you also serve EU or UK visitors, opt-in consent is required for non-essential cookies there anyway — so one well-configured banner can cover both.
Email, SMS and telemarketing: which law applies?
| Channel | Main law | What you need |
|---|---|---|
| Marketing email, SMS, instant messages | Spam Act 2003 (ACMA) | Consent (express or inferred), sender identification, a functional unsubscribe actioned within 5 business days |
| Telemarketing calls and marketing faxes | Do Not Call Register Act 2006 (ACMA) | Wash lists against the Register unless you have consent; follow the industry standard on calling hours |
| Retargeting, social ads, custom audiences, direct mail | APP 7 (OAIC) | Fit an APP 7 exception, a simple opt-out, and consent for sensitive information |
| Data collection on forms and websites | APPs 3, 5 and 11 | Minimal fields, collection notice, secure storage |
CRM, lead forms and Custom Audiences
Your CRM is where APPs 6, 10, 11, 12 and 13 converge. Record the source and consent status for each contact, sync unsubscribes to every platform, set retention periods, and be ready to export or correct a contact’s data on request. Bought lists are high-risk: under APP 7.6 people can ask where you obtained their information, and the seller may be trading in personal information.
AI tools and automated decision-making
Before pasting customer data into a generative AI tool, check APP 6 (is this a purpose the person would expect?), APP 8 (where is the provider located and does it train on your data?) and APP 11 (who can access prompts and outputs?). Use enterprise plans with data-training switched off, strip identifiers where possible, and, from 10 December 2026, describe significant automated decisions in your privacy policy.
APP marketing compliance checklist
| Area | APP(s) | Check |
|---|---|---|
| Privacy policy | 1 | Names real tools, purposes, overseas recipients and countries; dated; easy to find |
| Forms | 3, 5 | Only necessary fields; collection notice beside the submit button |
| Pixels and cookies | 3, 5, 6, 7 | Named in a banner; consent where sensitive; opt-out for targeted ads |
| Custom Audiences | 6, 7, 8 | Uploads match stated purposes; suppression lists synced |
| Email/SMS | Spam Act | Consent logged; unsubscribe works within 5 business days |
| Agency and vendor access | 8, 11 | Named users, MFA, DPA with APP clauses, offboarding process |
| Retention | 11.2 | Delete or de-identify stale leads on a schedule |
| Requests | 12, 13 | Process to find, export and correct a person’s data |
| Automated decisions | 1.7–1.9 | Mapped and disclosed by 10 Dec 2026 |
Penalties for Breaching the Australian Privacy Principles
Since the 2022 and 2024 amendments, the Privacy Act has a tiered penalty regime. Amounts are expressed in Commonwealth penalty units (A$330 per unit at the time of writing — check the current value).
| Tier | Typical trigger | Maximum for a body corporate |
|---|---|---|
| Administrative (with infringement notices) | Specific technical breaches, e.g. a non-compliant privacy policy or missing direct-marketing opt-out | Up to 1,000 penalty units (≈A$330,000) per contravention; the OAIC can issue infringement notices without going to court |
| Mid-tier | An interference with privacy that is not “serious” | Up to 10,000 penalty units (≈A$3.3 million); 2,000 units for individuals |
| Serious interference | Serious or repeated interferences with privacy | The greater of A$50 million, three times the benefit obtained, or 30% of adjusted turnover for the relevant period |
Other consequences
- OAIC determinations requiring you to stop a practice, apologise, change systems or compensate individuals.
- Compliance notices and enforceable undertakings.
- Court action by individuals under the statutory tort for serious invasions of privacy (since 10 June 2025).
- Reputational damage — determinations are published and widely reported.
Notifiable Data Breaches (NDB) Scheme and APP 11
APP entities must notify the OAIC and affected individuals of an eligible data breach — unauthorised access, disclosure or loss of personal information likely to result in serious harm, where remedial action hasn’t removed that risk. If you suspect one, you must carry out a reasonable and expeditious assessment within 30 days, then notify as soon as practicable.
Proposed: a 72-hour notification deadline
The tranche 2 exposure draft proposes requiring notification to the OAIC within 72 hours of having reasonable grounds to believe an eligible data breach occurred, with staged updates allowed. This is a proposal, not law, as at October 2026.
Marketing-specific breach scenarios
- An ex-agency still has admin access to your CRM or ad accounts.
- A lead export is shared via a public link or personal email.
- A form plugin vulnerability exposes submissions.
- A pixel sends sensitive information to an ad platform without consent.
What Is Changing: Privacy Act Reforms 2024–2026
| Date | Change | Status |
|---|---|---|
| 10 Dec 2024 | Privacy and Other Legislation Amendment Act 2024 (tranche 1) receives Royal Assent — new penalty tiers, OAIC powers, APP 11 clarification, overseas-transfer “whitelist” mechanism | In force (staged) |
| 10 Jun 2025 | Statutory tort for serious invasions of privacy commences | In force |
| 24 Jun 2026 | OAIC tracking-pixel determinations (Monash IVF, Medmate) | Published |
| 31 Aug 2026 | Exposure draft Privacy Amendment (Personal Data Protection) Bill 2026 released — about 40 proposals across collection, consent, direct marketing, breach notification and OAIC powers | Consultation closed 18 Sep 2026; introduction to Parliament expected later in 2026 |
| 10 Dec 2026 | Automated decision-making transparency (APP 1.7–1.9) commences; Children’s Online Privacy Code due to be registered | Fixed date |
| TBC | Removal of the small business exemption | Agreed in principle; not yet law |
What tranche 2 could mean for marketers
Commentary on the exposure draft points to a stronger “fair and reasonable” test for handling personal information, tighter consent requirements around direct marketing, data trading and sensitive information, a 72-hour breach notification window, and new complaint-handling expectations. (Corrs, Ashurst) Treat these as direction of travel: the final Bill may change.
Australian Privacy Principles vs GDPR, UK GDPR, CCPA and NZ Privacy Act
If you market to more than one country, it helps to see how the APPs compare. In short, the APPs are principles-based and purpose-led, while the GDPR is rules-based with six lawful bases and broader individual rights.
| Australia (APPs) | EU GDPR | UK GDPR | California (CCPA/CPRA) | New Zealand | |
|---|---|---|---|---|---|
| Law | Privacy Act 1988, Sch 1 (13 APPs) | Regulation (EU) 2016/679 | UK GDPR + Data Protection Act 2018 | Cal. Civ. Code §1798.100 et seq. | Privacy Act 2020 (13 IPPs) |
| Who | Agencies + organisations over A$3m (with exceptions) | Controllers/processors handling EU personal data | Same, for UK | For-profit businesses meeting revenue/data thresholds | Almost all agencies and organisations |
| Legal basis model | Purpose-based; consent for sensitive info | Six lawful bases | Six lawful bases | Notice + opt-out of sale/sharing | Purpose-based |
| Individual rights | Access, correction, opt-out of direct marketing | Access, rectification, erasure, portability, objection and more | As GDPR | Know, delete, correct, opt out, limit sensitive use | Access, correction |
| Overseas transfers | APP 8 + s 16C accountability | Adequacy, SCCs, BCRs | Adequacy, IDTA / UK Addendum | Service-provider contracts | IPP 12 comparable safeguards |
| Breach notice | Eligible breaches: assess within 30 days, notify as soon as practicable | 72 hours to regulator | 72 hours to ICO | Under state breach law | Notifiable privacy breaches as soon as practicable |
| Maximum penalty | Greater of A$50m, 3× benefit or 30% turnover | €20m or 4% of global turnover | £17.5m or 4% of global turnover | Per-violation administrative fines | Up to NZ$10,000 (offences) |
Practical takeaway: if your site already meets GDPR-grade consent and transparency, you are most of the way to APP compliance — but you still need Australian-specific items: an APP 1.4-compliant privacy policy, APP 8 overseas disclosures by country, APP 7 opt-outs and the NDB process.
How to Comply With the Australian Privacy Principles: 10-Step Checklist
Use this as a working plan. Most small and mid-sized businesses can complete steps 1–6 in four to six weeks.
Step 1: Map your personal information
List what you collect, where it lives (CMS, CRM, ad platforms, spreadsheets), who can access it and which countries it flows to.
Step 2: Confirm whether you are an APP entity
Check turnover and the small-business exceptions. If you are exempt, decide whether to comply voluntarily.
Step 3: Rewrite your privacy policy
Cover every APP 1.4 item in plain English, name overseas countries, and add ADM disclosures before 10 Dec 2026.
Step 4: Add collection notices
Place APP 5 notices on forms, chat, checkout and the consent banner.
Step 5: Fix consent and tracking
Audit pixels and cookies; get consent for sensitive information; give a simple targeted-ads opt-out.
Step 6: Govern direct marketing
Align email/SMS with the Spam Act, calls with the DNCR, and ads with APP 7; sync suppression lists.
Step 7: Lock down access
MFA everywhere, named accounts, least privilege, quarterly access reviews, 24-hour offboarding.
Step 8: Contract your vendors and agencies
Data processing agreements with APP 8 and APP 11 clauses, subcontractor flow-down and breach notice duties.
Step 9: Set retention and deletion rules
Define how long leads, customers and recordings are kept; automate deletion or de-identification.
Step 10: Prepare for requests and breaches
Templates for access/correction requests; a tested data breach response plan with the 30-day assessment clock.
Free official resources
Working With an Offshore Marketing Agency Under APP 8
Digital Masters 360 is a Hyderabad, India-based agency delivering SEO, paid media, content and analytics 100% online to Australian and other Tier 1 clients. Here is exactly how we stay on the right side of the Australian Privacy Principles — and what you should demand from any offshore provider.
Is it legal to outsource marketing to India under the APPs?
Yes. Nothing in the Privacy Act prohibits offshore service providers. But APP 8 requires you to take reasonable steps before overseas staff can access personal information, and under section 16C you remain accountable if they mishandle it. The right agency makes those reasonable steps easy to prove.
How we handle your data
1. Minimise what crosses the border
Most marketing work needs no customer-level data at all. We work inside your accounts (Google Ads, GA4, Search Console, Meta, your CMS and CRM) under named logins you control, use aggregated reports wherever possible, and don’t download customer lists unless a task genuinely requires it.
2. Put APP obligations in the contract
Our Data Processing Agreement binds us to handle Australian personal information as if we were an APP entity: purpose limits (APP 6), no direct marketing use (APP 7), security (APP 11), no onward transfer or subcontracting without your written approval, return or deletion at the end of the engagement, audit cooperation, and breach notice to you within 24 hours of discovery.
3. Control access
Our access principles
- Named individual accounts only — no shared logins.
- MFA enforced on every client platform and on our own workspace.
- Least privilege: “standard” or “analyst” roles unless admin is essential.
- Company-managed, encrypted devices with screen lock and remote wipe.
- Access reviewed monthly and removed within 24 hours when a team member rolls off.
You can revoke our access at any time from your own admin panels — no lock-in.
4. Comply with India’s own data law
India’s Digital Personal Data Protection Act 2023 and DPDP Rules 2025 (notified 13 November 2025, with substantive obligations phasing in by May 2027) add a second layer of protection, alongside section 43A of the Information Technology Act 2000.
5. The same standard for every Tier 1 market
For EU clients we sign GDPR Article 28 terms with Standard Contractual Clauses; for UK clients, the IDTA or UK Addendum; for California, CCPA/CPRA service-provider terms; and for New Zealand, comparable-safeguard clauses under the Privacy Act 2020.
Cost: offshore vs Australian agency pricing
Australian SEO retainers commonly range from about A$1,500 to A$5,000 per month, with competitive or national programs higher (Aspect Digital, Caffeinate). Our plans deliver the same senior-led work at a lower cost base:
| Plan (monthly) | AUD | USD | GBP | EUR | Typical AU local agency |
|---|---|---|---|---|---|
| Starter — local SEO + privacy-safe tracking | A$990 | US$649 | £495 | €575 | A$1,500–2,000 |
| Growth — SEO + content + GEO/AEO | A$1,890 | US$1,249 | £950 | €1,099 | A$2,500–4,000 |
| Scale — multi-channel SEO, paid and CRO | A$3,590 | US$2,349 | £1,800 | €2,090 | A$5,000–10,000 |
| White-label (for agencies) | from A$790 | from US$519 | from £395 | from €459 | — |
| One-off: APP-ready tracking and consent setup | A$1,490 | US$979 | £745 | €865 | — |
Time-zone overlap and communication
India Standard Time (IST) is UTC+5:30 with no daylight saving. Our Australia shift runs 06:00–15:00 IST, so Australian clients get a full working session every business day.
| Your city | Your time when we work (Oct–Apr, daylight saving) | Your time (Apr–Oct) | Overlap with 9–5 |
|---|---|---|---|
| Sydney / Melbourne / Canberra / Hobart | 11:30–20:30 AEDT | 10:30–19:30 AEST | 5.5–6.5 hrs |
| Brisbane | 10:30–19:30 AEST | 10:30–19:30 AEST | 6.5 hrs |
| Adelaide | 11:00–20:00 ACDT | 10:00–19:00 ACST | 6–7 hrs |
| Perth | 08:30–17:30 AWST | 08:30–17:30 AWST | Full day |
| Auckland | 13:30–22:30 NZDT | 12:30–21:30 NZST | 3.5–4.5 hrs |
How we communicate
- Shared Slack or Microsoft Teams channel, with replies within 4 business hours.
- Weekly 30-minute Zoom or Google Meet call at a time that suits you.
- Live Looker Studio dashboard plus a monthly written report covering rankings, traffic, leads and next actions.
- Named account lead and a backup — never an anonymous ticket queue.
Contracts, NDAs, payments and onboarding
Contracts and NDAs
Every engagement starts with a mutual NDA, a services agreement with clear scope and KPIs, and the DPA described above. Australian governing law can be agreed. Monthly plans run on 30-day rolling terms after an initial 3-month period — no 12-month lock-ins.
Payments
We invoice in AUD, USD, GBP or EUR. You can pay by international bank transfer, Wise or card. Speak to your accountant about GST treatment of imported services.
Onboarding in 14 days
- Discovery call and free APP-ready marketing audit.
- Proposal, NDA, services agreement and DPA.
- Access granted via named logins (we send a checklist).
- Tracking and consent review (pixels, cookies, forms).
- Keyword, competitor and content plan.
- Kick-off call and shared channel set up.
- First fixes live and the dashboard shared by day 14.
White-label and partner options for Australian agencies
Australian agencies use us as a back-office team for SEO, content and reporting under their own brand. Because you are the APP entity facing the client, we sign your DPA (or ours) with APP 8 and APP 11 flow-down clauses, work under your naming conventions and stay invisible to your clients. Pricing starts from A$790 per month per client.
Common Australian Privacy Principles Mistakes (and How to Fix Them)
| Mistake | APP | Fix |
|---|---|---|
| Copy-paste privacy policy that doesn’t match your tools | 1 | Rewrite from your data map; review every 6 months |
| Footer link treated as a collection notice | 5 | Add notices at the point of collection and a pixel-aware banner |
| Pixels on sensitive pages (health, finance, booking) | 3, 6, 7 | Remove or exclude them; obtain specific consent |
| Uploading all customers to ad platforms | 6, 7 | Upload only those whose purpose fits; sync opt-outs |
| Shared agency logins | 11 | Named users, MFA, offboarding SLA |
| No contract with offshore freelancers | 8 | DPA with APP clauses before access |
| Keeping leads forever | 11.2 | Retention schedule and automated deletion |
| Assuming “we’re under A$3m so nothing applies” | — | Check the exceptions; comply voluntarily for trust |
Australian Privacy Principles Glossary
| Term | Meaning |
|---|---|
| APP entity | An agency or organisation bound by the APPs. |
| APP Guidelines | The OAIC’s interpretation of each APP. |
| Australian link | The connection that brings an overseas organisation under the Privacy Act, e.g. carrying on business in Australia. |
| Consent | Informed, voluntary, current and specific agreement by someone with capacity. |
| De-identified | Information that is no longer about an identifiable individual. |
| Direct marketing | Promoting goods or services directly to an individual, including targeted online ads. |
| Eligible data breach | A breach likely to result in serious harm that must be notified under the NDB scheme. |
| OAIC | Office of the Australian Information Commissioner — the privacy regulator. |
| Personal information | Information or an opinion about an identified or reasonably identifiable individual. |
| Primary purpose | The specific purpose for which information was collected (APP 6). |
| Sensitive information | Health, genetic, biometric, racial, political, religious, sexual and criminal record information, among others. |
| Section 16C | The provision that makes an Australian entity accountable for an overseas recipient’s APP breaches. |
Australian Privacy Principles: Frequently Asked Questions
What are the Australian Privacy Principles?
The Australian Privacy Principles (APPs) are 13 legally binding principles in Schedule 1 of the Privacy Act 1988 (Cth). They set the standards for how Australian Government agencies and most organisations with annual turnover above A$3 million collect, use, disclose, store, secure and give access to personal information.
How many Australian Privacy Principles are there?
There are 13 Australian Privacy Principles, grouped into five parts: consideration of privacy (APPs 1–2), collection (APPs 3–5), dealing with personal information (APPs 6–9), integrity (APPs 10–11), and access and correction (APPs 12–13).
What are the 13 Australian Privacy Principles?
APP 1 open and transparent management; APP 2 anonymity and pseudonymity; APP 3 collection of solicited information; APP 4 unsolicited information; APP 5 notification of collection; APP 6 use or disclosure; APP 7 direct marketing; APP 8 cross-border disclosure; APP 9 government related identifiers; APP 10 quality; APP 11 security; APP 12 access; APP 13 correction.
What is the purpose of the Australian Privacy Principles?
The APPs protect individuals’ privacy while allowing businesses and agencies to carry out their legitimate activities. They give people transparency and control over their personal information and create a nationally consistent standard for handling it.
Who must comply with the Australian Privacy Principles?
Australian Government agencies and private sector organisations (including not-for-profits) with annual turnover above A$3 million must comply. Some smaller businesses must comply regardless of turnover, including health service providers, businesses that trade in personal information, Commonwealth contractors and businesses that opt in. Overseas businesses with an Australian link can also be covered.
Do the Australian Privacy Principles apply to small businesses?
Generally not, if annual turnover has been A$3 million or less, unless an exception applies — for example, providing a health service or trading in personal information. The Government has agreed in principle to remove the small business exemption, but as at October 2026 it has not been removed.
Are the Australian Privacy Principles legally binding?
Yes. A breach of an APP is an interference with the privacy of an individual under the Privacy Act 1988, which can lead to OAIC investigations, determinations, infringement notices and civil penalties.
Who enforces the Australian Privacy Principles?
The Office of the Australian Information Commissioner (OAIC) enforces the APPs. It can investigate complaints, make determinations, issue compliance and infringement notices, accept enforceable undertakings and seek civil penalties in court.
What are the penalties for breaching the Australian Privacy Principles?
For serious interferences with privacy, a company can face penalties up to the greater of A$50 million, three times the benefit obtained, or 30% of adjusted turnover. A mid-tier penalty of up to 10,000 penalty units and lower-tier penalties with infringement notices also apply.
What does APP 6 say?
APP 6 says you may use or disclose personal information only for the primary purpose it was collected for, unless the person consents or an exception applies — such as a related secondary purpose the person would reasonably expect, or a use required or authorised by law.
What does APP 11 require?
APP 11 requires reasonable steps, including technical and organisational measures, to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure, and to destroy or de-identify information once it is no longer needed.
What is APP 8 and can I use an overseas marketing agency?
APP 8 requires reasonable steps before disclosing personal information to an overseas recipient so that the recipient does not breach the APPs. You can use an overseas agency, but you remain accountable under section 16C, so use a contract with APP clauses, minimise the data shared and control access.
How are the Australian Privacy Principles different from the GDPR?
The APPs are principles-based and purpose-led, apply mainly to organisations over A$3 million turnover, and give rights of access and correction. The GDPR is rules-based, requires one of six lawful bases, applies regardless of size and adds rights such as erasure and portability, with fines up to €20 million or 4% of global turnover.
Do the Australian Privacy Principles apply to cookies and tracking pixels?
Yes, whenever cookies or pixels collect personal information. In June 2026 the OAIC found that tracking-pixel data can be personal and even sensitive information, that people must be notified specifically about pixels, and that retargeting can be direct marketing under APP 7.
What is changing with the Australian Privacy Principles in 2026?
From 10 December 2026, privacy policies must disclose certain automated decision-making (APP 1.7–1.9), and the Children’s Online Privacy Code is due to be registered. A tranche 2 exposure draft released on 31 August 2026 proposes about 40 further changes, including a 72-hour breach notification window; it is not yet law.
Does my business need a privacy policy under the APPs?
Yes, if you are an APP entity. APP 1 requires a clearly expressed, up-to-date privacy policy, available free of charge, explaining what you collect, why, how people can access and correct it, how to complain and whether information goes overseas.
Get a Free APP-Ready Marketing Audit
We will check your privacy policy, collection notices, pixels, cookie banner, ad-platform audiences and agency access against the APPs — and send you a prioritised fix list within 5 business days. No obligation.
📧 chennareddy819@gmail.com · 💬 WhatsApp +91 9505971747 · Hyderabad, India · Serving Australia & New Zealand online
About the Author
Chenna Reddy is the founder of Digital Masters 360, a Hyderabad-based digital marketing agency that works 100% online with businesses in Australia, the UK, the USA, Canada and other Tier 1 markets. His team specialises in SEO, GEO/AEO, paid media and privacy-safe analytics setups. Last updated 5 October 2026.
Disclaimer
This guide is general information about the Australian Privacy Principles, not legal advice. Digital Masters 360 is a marketing agency, not a law firm. For advice on your situation, consult an Australian privacy lawyer or the OAIC.
Sources
- OAIC — Australian Privacy Principles
- Privacy Act 1988 (Cth) — Federal Register of Legislation
- OAIC — APP Guidelines, Chapter 8
- OAIC — Notifiable Data Breach scheme
- OAIC — Tracking pixels and privacy obligations
- Lander & Rogers — Australian privacy law update 2026
- Corrs — Tranche 2 exposure draft
- Gilbert + Tobin — Tranche 2 of Privacy Act reform
- King & Wood Mallesons — Tracking pixels
- AZB & Partners — India DPDP phased rollout