Understanding the Privacy Act in Australia
Protecting personal information is an important responsibility for Australian businesses. From customer details and employee records to financial information and confidential business documents, organisations handle large amounts of information that must be managed responsibly.
The Australian Privacy Act 1988 establishes the main federal framework governing how certain Australian Government agencies and private sector organisations collect, use, store, disclose and protect personal information.
Understanding the Australian Privacy Act is essential for businesses that want to protect their customers, maintain trust and meet their privacy obligations. Importantly, these responsibilities extend beyond digital information. Physical documents containing personal information must also be stored securely and disposed of appropriately when they are no longer required.
In this guide, we explain how the Privacy Act works, what information it protects, the responsibilities businesses need to understand and why secure document destruction plays an important role in protecting privacy.
What Is the Australian Privacy Act?
The Privacy Act 1988 (Cth) is Australia’s principal federal privacy legislation. It was introduced to protect individuals’ personal information and regulate how Australian Government agencies and covered private sector organisations handle that information.
The legislation establishes rules for collecting, using, storing, accessing, disclosing and destroying personal information.
A central part of the Act is the Australian Privacy Principles (APPs). These are 13 principles that establish standards for how covered organisations must manage personal information throughout its lifecycle.
The Australian Privacy Principles cover areas including:
How organisations collect personal information.
When personal information can be used or disclosed.
How information must be stored and protected.
Individual rights to access and correct personal information.
How information should be destroyed or de-identified when it is no longer required.
The Office of the Australian Information Commissioner (OAIC) oversees the Privacy Act and provides guidance to organisations and individuals about their privacy rights and responsibilities.
What Is Personal Information Under Australian Privacy Law?
Under the Australian Privacy Act, personal information generally means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information is accurate or not.
This definition is broad and covers more than just someone’s name or contact details.
Examples of personal information include:
Full names and residential addresses.
Telephone numbers and email addresses.
Dates of birth.
Bank account and financial details.
Employee and employment records.
Medical and health information.
Customer records and identification documents.
Photographs and biometric information.
Signatures and other identifying details.
Personal information can exist in both electronic and physical formats.
For example, a printed customer application containing someone’s name, address and financial details is personal information. So is an employee file containing employment history, contact information and other identifying details.
What Is Sensitive Information
Sensitive Information is a category of personal information that receives additional protection under the Privacy Act.
It includes information relating to an individual’s:
Racial or ethnic origin.
Political opinions or associations.
Religious or philosophical beliefs.
Sexual orientation or practices.
Criminal record.
Health or genetic information.
Certain biometric information
Businesses handling sensitive information should pay particular attention to how these records are collected, accessed, stored and disposed of.
Who Must Comply With the Privacy Act un Australia?
The Privacy Act applies to most Australian Government agencies and many private sector organisations.
Generally, private sector organisations with an annual turnover of more than $3 million are covered by the Act. However, some smaller businesses must also comply, even when their annual turnover is $3 million or less.
These include certain organisations that:
Provide health services and hold health information.
Trade in personal information.
Operate residential tenancy databases.
Provide services under Commonwealth Government contracts.
Are covered by specific credit reporting or other statutory requirements.
Small businesses should not automatically assume they are exempt from privacy obligations simply because their annual turnover is below $3 million.
The application of the Privacy Act depends on the organisation’s activities and circumstances.
Businesses should also be aware that other federal, state and territory privacy legislation may apply to their operations.
What Are the 13 Australian Privacy Principles?
The Australian Privacy Principles (APPs) form the foundation of the Australian Privacy Act. They explain how covered organisations must manage personal information.
The 13 principles are divided into five main areas.
1. Open and Transparent Management
APP 1 – Open and transparent management of personal information
Organisations must manage personal information openly and transparently. This includes having a clearly expressed and accessible privacy policy explaining how personal information is handled.
2. Collection of Personal Information
APP 2 – Anonymity and pseudonymity
Where practical, individuals should have the option of dealing with an organisation anonymously or using a pseudonym.
APP 3 – Collection of solicited personal information
Organisations must only collect personal information that is reasonably necessary for their functions or activities, with additional requirements for sensitive information.
APP 4 – Dealing with unsolicited personal information
Organisations must assess unsolicited personal information they receive and determine whether they are permitted to retain it.
APP 5 – Notification of the collection of personal information
Individuals must generally be informed about why their information is being collected, how it will be used and other relevant details.
3. Use and Disclosure of Personal Information
APP 6 – Use or disclosure of personal information
Personal information generally must only be used or disclosed for the purpose for which it was collected, unless an exception applies.
APP 7 – Direct marketing
Rules apply to the use of personal information for direct marketing activities.
APP 8 – Cross-border disclosure of personal information
Organisations must take appropriate steps when disclosing personal information to overseas recipients.
APP 9 – Adoption, use or disclosure of government-related identifiers
Restrictions apply to the use and disclosure of government-related identifiers, such as certain identification numbers.
4. Maintaining the Quality and Security of Information
APP 10 – Quality of personal information
Organisations must take reasonable steps to ensure personal information they collect, use or disclose is accurate, up to date and complete.
APP 11 – Security of personal information
Organisations must take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification or disclosure.
APP 11 also requires organisations to take reasonable steps to destroy or de-identify personal information when it is no longer needed, subject to applicable exceptions.
5. Access and Correction
APP 12 – Access to personal information
Individuals generally have the right to request access to personal information an organisation holds about them, subject to certain exceptions.
APP 13 – Correction of personal information
Organisations must take reasonable steps to correct personal information that is inaccurate, out of date, incomplete, irrelevant or misleading in the circumstances.
Together, these principles establish a framework for responsible personal information management.
What Does APP 11 Mean for Businesses?
APP 11 is particularly important when discussing the security and disposal of business documents.
It requires organisations covered by the Privacy Act to take reasonable steps to protect the personal information they hold.
This responsibility applies throughout the information lifecycle, including when records are being stored, accessed, transferred and eventually destroyed.
For example, businesses should consider:
Restricting access to confidential documents.
Using secure storage facilities and lockable filing cabinets.
Establishing procedures for handling sensitive paperwork.
Preventing unauthorised access to customer and employee records.
Training employees in privacy and information security.
Using secure methods to dispose of documents containing personal information.
Importantly, APP 11.2 requires organisations to take reasonable steps to destroy or de-identify personal information they no longer need for permitted purposes, unless an applicable retention requirement or exception applies.
Simply placing confidential paperwork in ordinary rubbish or recycling bins would not ordinarily be considered adequate destruction.
The OAIC identifies methods such as shredding, disintegrating and pulping as examples of technical measures that can be used to destroy personal information.
This makes secure document destruction an important part of a business’s overall privacy and information security practices.
How Long Should Businesses Keep Personal Information?
The Australian Privacy Act does not establish one universal retention period for every type of business record.
Instead, organisations must consider why information was collected, whether it is still needed and whether another law or legal obligation requires it to be retained.
Different records may have different retention requirements.
For example, financial documents, employment records, tax information, customer contracts and health records may be subject to specific retention obligations.
Before destroying business records, organisations should:
Identify the type of information contained in the records.
Check whether the information is still required for business or legal purposes.
Identify any applicable record-keeping requirements.
Establish which records are approved for destruction.
Arrange secure destruction when the information is no longer required.
It is important not to destroy records prematurely. Businesses should have a documented retention and disposal policy to ensure records are retained for the required period and securely destroyed when appropriate.
Why Is Secure Document Destruction Important for Privacy Compliance?
Many businesses focus on protecting their digital information through passwords, firewalls, access controls and cybersecurity systems.
However, confidential paper documents can create privacy and security risks if they are not handled correctly.
Printed invoices, customer applications, employee files, medical records, financial statements and archived business documents can contain information that identifies individuals.
If these documents are placed in ordinary rubbish or recycling bins without being securely destroyed, the information may remain accessible to unauthorised people.
Secure document destruction helps businesses reduce these risks.
Professional document shredding services can assist organisations by providing a controlled process for collecting and destroying confidential paperwork.
Depending on the service arrangement, this may include:
Secure, lockable document shredding bins.
Scheduled collection of confidential documents.
Secure transportation to a destruction facility.
Controlled document destruction procedures.
A Certificate of Destruction to document completed destruction.
For businesses handling large volumes of confidential paperwork, using a professional document destruction provider can help establish a more consistent and secure disposal process.
What Are the Risks of Improperly Disposing of Personal Information?
Failing to protect personal information can expose individuals and organisations to significant risks.
Some potential consequences include:
Identity theft: Personal information such as names, addresses, dates of birth and financial details can be misused by criminals.
Fraud: Confidential business and customer documents may contain information that can be used for fraudulent activities.
Privacy complaints: Individuals may raise complaints if an organisation fails to handle their personal information appropriately.
Reputational damage: Customers and business partners may lose confidence in an organisation that does not protect confidential information.
Regulatory consequences: Organisations covered by the Privacy Act may face investigations, regulatory action and penalties for serious privacy failures.
Proper information management, including secure storage and appropriate document destruction, can help reduce these risks.
Recent Changes to Privacy Legislation in Australia
Australian privacy legislation continues to evolve as technology, data collection and information security practices change.
The Privacy and Other Legislation Amendment Act 2024 introduced several changes to Australia’s privacy framework.
The reforms include stronger privacy protections, a statutory tort for serious invasions of privacy and new transparency requirements relating to certain automated decision-making practices.
One important upcoming change is the automated decision-making transparency obligation under APP 1, which is scheduled to commence on 10 December 2026.
This requirement will mean covered organisations must include certain information in their privacy policies about automated decisions that use personal information and could significantly affect individuals.
Businesses should monitor updates from the Office of the Australian Information Commissioner to understand how these changes affect their privacy obligations.
Staying informed about privacy legislation in Australia is important for organisations that collect, store or process personal information.
How Can Australian Businesses Improve Their Privacy Practices?
Protecting personal information requires more than having a privacy policy. Businesses should establish practical procedures covering how information is managed from collection through to disposal.
Here are several steps organisations can take.
1. Review your privacy policy
Ensure your privacy policy clearly explains what personal information your organisation collects, why it is collected and how it is handled.
2. Control access to confidential information
Only authorised employees should have access to personal information. Secure storage and appropriate access controls can help reduce the risk of unauthorised disclosure.
3. Establish a document retention policy
Identify how long different categories of records need to be retained and when they can be securely destroyed.
4. Train employees
Staff should understand their responsibilities when handling confidential paperwork, customer information and employee records.
5. Use secure document destruction
Ensure confidential paperwork is not placed in ordinary rubbish or recycling bins before it has been securely destroyed.
6. Review your information disposal procedures
Regularly review how your organisation disposes of physical and electronic information to ensure appropriate security measures are in place.
7. Keep appropriate destruction records
Maintain documentation of your organisation’s disposal procedures. A Certificate of Destruction can provide a record that a professional document destruction service has completed the destruction of collected documents.
Protect Personal Information With Secure Document Shredding
The Australian Privacy Act highlights the importance of protecting personal information throughout its lifecycle, including when business records are no longer required.
While organisations must consider their individual legal and record-retention obligations, secure disposal is an important part of responsible information management.
National Document Shredding Service helps Australian businesses securely dispose of confidential paperwork through professional document shredding services.
Whether your organisation needs secure shredding bins, scheduled document collections or one-off document destruction, having an appropriate disposal process can help reduce the risks associated with confidential paper records.
Don’t leave confidential documents exposed in ordinary waste or recycling bins.
Book a secure document shredding service with NationalShred and take an important step towards protecting your business’s confidential information.
Visit NationalShred to learn more about our secure document destruction services.
Frequently Asked Questions About the Australian Privacy Act
1. What is the Australian Privacy Act 1988?
The Australian Privacy Act 1988 is the main federal legislation regulating how Australian Government agencies and covered private sector organisations collect, use, store, disclose and protect personal information.
2. What are the Australian Privacy Principles?
The Australian Privacy Principles (APPs) are 13 principles established under the Privacy Act. They set standards for how covered organisations manage personal information, including its collection, use, storage, security and disposal.
3. Does the Privacy Act apply to small businesses in Australia?
Generally, businesses with an annual turnover of $3 million or less are exempt from the Privacy Act. However, several exceptions apply, including certain health service providers, businesses that trade in personal information and Commonwealth Government contractors.
4. What is considered personal information under Australian privacy laws?
Personal information includes details or opinions about an identified or reasonably identifiable individual. Examples include names, addresses, phone numbers, financial details, medical records, photographs and employee records.
5. What does APP 11 mean for document destruction?
APP 11 requires covered organisations to take reasonable steps to protect personal information and to destroy or de-identify it when it is no longer needed, subject to applicable exceptions. Secure shredding is one recognised method of destroying physical records.
6. Can businesses throw confidential documents into recycling bins?
Ordinary recycling or rubbish disposal would not ordinarily constitute adequate destruction of personal information under APP 11. Confidential paperwork should be securely destroyed before it enters general waste or recycling streams.
7. Is a Certificate of Destruction important?
A Certificate of Destruction can provide documentary evidence that a professional document destruction provider has completed the destruction of collected records. It can support an organisation’s record-keeping and information disposal procedures, although it does not by itself establish legal compliance.
8. How long should businesses keep personal information?
There is no single retention period for all personal information. Businesses must consider the purpose for which information is held and any applicable legal, regulatory or record-keeping requirements before arranging destruction.
