Australia Privacy Act 1988 and the 2024 reforms

Under APP 1, maintain a clearly expressed, up-to-date and freely available APP privacy policy stating the kinds of personal information collected and held, how it is collected and held, the purposes of collection, how individuals may access and correct it, how to complain and how complaints are handled, and whether the entity is likely to disclose to overseas recipients and in which countries. Also implement practices, procedures and systems ensuring compliance with the APPs and enabling inquiries and complaints to be dealt with.

Applies when

APP entities handling personal information in Australia, including Australian entities of Chinese groups.

Evidence to retain

• · Full APP privacy policy with version history
• · Privacy management plan and allocation of compliance responsibility
• · Register of inquiries and complaints
• · Annual policy review records

Estimated first-time effort: 5–12 person-days (estimate, not a commitment)

New APP 1.7 provides that where (a) an APP entity has arranged for a computer program to make, or do a thing substantially and directly related to making, a decision; (b) the decision could reasonably be expected to significantly affect the rights or interests of an individual; and (c) personal information about that individual is used in the operation of the program to make the decision or do that thing — the entity’s APP privacy policy must contain the information covered by APP 1.8, namely: the kinds of personal information used in the operation of such programs; the kinds of such decisions made solely by the operation of such programs; and the kinds of such decisions for which a thing substantially and directly related to making the decision is done by such programs. APP 1.9 confirms that making a decision includes refusing or failing to make one, and doing a thing includes refusing or failing to do it. APP 1.7 is also added to the s.13K list of provisions for which infringement notices may issue.

Applies when

Chinese AI products operating in Australia with automated approval, scoring, screening, pricing, or content or account actioning. Because the rule extends to doing a thing substantially and directly related to making the decision, architectures where the model only pre-screens or scores and a human signs off can still be caught.

Deadline: Applies from 10 December 2026; the privacy policy must be updated before that date

Applies from: 2026-12-10

Evidence to retain

• · Inventory of automated decisions with the significant-effect assessment and the human-machine split described
• · List of personal information fields used for each class of decision
• · The updated APP privacy policy clauses with an effective-date record
• · Coverage check for refusals and failures to decide
• · Mechanism keeping the policy in step with model or rule changes

Estimated first-time effort: 8–20 person-days (estimate, not a commitment)

Collect personal information only where reasonably necessary for the entity’s functions or activities. Sensitive information, including health information, biometric information and biometric templates, generally requires the individual’s consent and must be directly related to the entity’s functions or activities. OAIC states that many photographs or recordings of individuals, including artificially generated ones, contain sensitive information and therefore may not be scraped from the web or taken from a third-party dataset without establishing consent.

Applies when

Chinese AI companies collecting data in Australia for training or operations, particularly products touching facial, voice or health data.

Evidence to retain

• · Collection necessity assessment records
• · Sensitive information identification and consent records
• · Due diligence on third-party dataset provenance and the consent chain
• · Sensitive-information screening report for image and audio datasets

Estimated first-time effort: 8–20 person-days (estimate, not a commitment)

At or before the time of collection, or as soon as practicable after, take reasonable steps to notify the individual of the APP 5.2 matters, including the entity’s identity and contact details, the fact and circumstances of collection (particularly where collected from a third party rather than the individual), the purposes, the consequences of not providing the information, the entities to which it is usually disclosed, how to access, correct and complain, and whether the entity is likely to disclose to overseas recipients and in which countries.

Applies when

Entities obtaining Australian personal information through third-party datasets, partners or scraping must pay particular attention to the notification duty where collection is not from the individual.

Evidence to retain

• · Collection notice text covering every APP 5.2 matter
• · Assessment of the method and reasonable steps used for indirect collection
• · Proof of delivery of the notice
• · List of countries of overseas disclosure

Estimated first-time effort: 4–10 person-days (estimate, not a commitment)

Before disclosing personal information to a recipient outside Australia, take reasonable steps to ensure the recipient does not breach the APPs, subject to the statutory exceptions. Section 16C extends accountability so that, in defined circumstances, an act of the overseas recipient is taken to be an act of the disclosing entity. Routing Australian user data to an affiliate or vendor in China requires contractual and supervisory arrangements built on this basis.

Applies when

Chinese AI companies moving Australian personal information to China for training, inference, annotation, support or operations.

Evidence to retain

• · Overseas disclosure register: recipient, country, data categories, purpose
• · Evidence of the reasonable steps taken: contract clauses, due diligence, audit rights
• · Assessment records where an exception is relied on
• · Disclosure of the countries of overseas recipients in the privacy policy

Estimated first-time effort: 8–20 person-days (estimate, not a commitment)

Take reasonable steps to protect personal information held from misuse, interference, loss, and unauthorised access, modification or disclosure, and to destroy or de-identify it once it is no longer needed for any permitted purpose and is not required to be retained by law or court order. In AI contexts this must expressly cover training sets, prompt logs and vector indexes.

Applies when

All entities handling personal information in Australia or on behalf of Australian customers.

Evidence to retain

• · Inventory of security controls with implementation evidence
• · Retention schedule covering training sets and logs
• · Destruction and de-identification execution records
• · Justification that the steps taken are proportionate to the risk

Estimated first-time effort: 10–25 person-days (estimate, not a commitment)

Where there are reasonable grounds to believe an eligible data breach has occurred, notify the Australian Information Commissioner and affected individuals promptly; where there are only reasonable grounds to suspect one, carry out a reasonable and expeditious assessment to determine whether it is an eligible data breach. The trigger for starting an assessment, the responsible owner and the external notice templates should be settled in advance.

Applies when

APP entities subject to the Privacy Act; Chinese vendors should contractually guarantee immediate notification to Australian customers.

Deadline: Assessment must be reasonable and expeditious once a breach is suspected, and notification prompt once confirmed. The statutory assessment period in days was not verified in this pass

Evidence to retain

• · Incident response plan including the NDB assessment trigger
• · Assessment record and conclusion
• · Statement filed with the Commissioner and its acknowledgement
• · Notice text to affected individuals and proof of dispatch

Estimated first-time effort: 5–15 person-days (estimate, not a commitment)