- 18 Nov 2026 UK Have your directors and PSCs verified with Companies House?
- 1 Dec 2026 AU Will your onboarding accept private-sector Digital IDs?
- 10 Dec 2026 AU Does your privacy policy explain your automated KYC decisions?
- End 2026 EU Is your ID verification ready for EUDI Wallets?
- 1 Jan 2027 US Can your age checks keep up state by state?
- 1 Apr 2027 JP Is your eKYC ready for the IC-chip mandate?
- 10 Jul 2027 EU Is your CDD flow ready for the AMLR?
- 1 Jan 2028 US Are your adviser clients ready for FinCEN’s AML rule?
- 31 Mar 2029 AU Is your initial CDD on the new AUSTRAC model?
- Now AU Tranche 2 is live. Is your AML/CTF program running?
Privacy Act 1988: what it asks of firms that run KYC and AML checks
The Privacy Act 1988 and its 13 Australian Privacy Principles govern how you collect, use, store and destroy client information. Since 1 July 2026 they also cover small Tranche 2 firms for everything they handle for AML/CTF.
- The Privacy Act 1988 sets 13 Australian Privacy Principles (APPs) and the OAIC enforces them.
- Small businesses with turnover of $3 million or less are generally exempt, but the OAIC says small AML/CTF reporting entities and their authorised agents must comply for personal information handled for AML/CTF.
- Tranche 2 firms became reporting entities on 1 July 2026, so the Privacy Act now applies to their client due diligence records.
- The OAIC treats biometric information used for verification as sensitive information and says consent should generally be sought before a biometric check for CDD.
What it is
The Privacy Act 1988 is Australia's main privacy law. Its core is the 13 Australian Privacy Principles, which cover the whole life of personal information: why you collect it, what you tell people, how you use and disclose it, how you secure it, and when you destroy it. It also sets up the Notifiable Data Breaches scheme.
This page covers the base law as it applies to identity checks, screening and client records. For what the 2024 amendments changed and what is still proposed, see Privacy Act reforms. For each principle in turn, see the Australian Privacy Principles explained.
Who it applies to
The APPs bind APP entities: Australian Government agencies and organisations with annual turnover above $3 million. Small businesses are generally exempt, with named exceptions. Being an AML/CTF reporting entity is one of them.
- Organisations with annual turnover above $3 million, for all their activities
- Small AML/CTF reporting entities, for personal information handled for, or in connection with, their AML/CTF obligations
- Tranche 2 accountants, lawyers, conveyancers, real estate agents and trust and company service providers from 1 July 2026, when they became reporting entities
- Authorised agents that carry out identification or verification for a reporting entity, including small agents
The OAIC says this coverage does not reach a small firm's other activities. A firm AUSTRAC later exempts from some obligations is still a reporting entity for Privacy Act purposes.
What you have to do
These are the APP duties that touch client onboarding, identity checks and screening. The OAIC's guidance for reporting entities sets them out in more detail.
- Have a privacy policy and give collection notices
APP 1 requires an up to date privacy policy, and APP 5 requires reasonable steps to tell clients about a collection when it happens. The OAIC says a notice need not include anything that would breach tipping off rules.
- Collect only what is reasonably necessary
APP 3 limits collection to what is reasonably necessary, which for CDD means your AML/CTF obligations. The OAIC suggests limiting free text fields on onboarding forms.
- Treat biometric checks as sensitive information
Biometric information used for automated verification, and biometric templates, are sensitive information under section 6(1). The OAIC says collection must be necessary and proportionate, and consent should generally be sought before biometric verification for CDD.
- Use screening data only for its purpose
APP 6 lets you use and disclose information for the purpose you collected it, or where the AML/CTF Act requires or authorises it, such as a suspicious matter report. Other uses need consent or another exception.
- Secure records and respond to breaches
APP 11 requires reasonable security steps, expressly including technical and organisational measures since 11 December 2024. A breach likely to cause serious harm must be notified to affected individuals and the OAIC, and the OAIC treats 30 days as the outside limit to assess a suspected breach.
Governance - Destroy what you no longer need
Keep AML/CTF records for as long as the AML/CTF Act requires, then destroy or de-identify what has no lawful purpose left. The OAIC says to keep the details extracted from an ID document and destroy full copies once no longer needed.
What firms get wrong
Many Tranche 2 firms were never covered by the Privacy Act before, so old assumptions break.
The OAIC says small businesses that are AML/CTF reporting entities must comply with the Privacy Act for personal information handled for AML/CTF, whatever their turnover. The exemption still covers their other activities.
The OAIC says the AML/CTF Act does not require scanned copies or photocopies of identity documents from 31 March 2026 for existing reporting entities and 1 July 2026 for Tranche 2. Holding copies you do not need adds breach risk under APP 11.
Collection required or authorised by the AML/CTF Act is an exception to the consent rule for sensitive information. The OAIC still says consent should generally be sought before biometric verification for CDD, and any use outside AML/CTF purposes needs its own basis.
What happens when
- In force
APP 11.3 commences: reasonable security steps include technical and organisational measures Source
- In force
AML/CTF changes for existing reporting entities; ID document copies no longer required for record keeping Source
- In force
Tranche 2 firms become reporting entities and must follow the Privacy Act for AML/CTF handling Source
- Commencing
Automated decision-making transparency in privacy policies (APP 1.7 to 1.9) starts Source
Related guides
Questions people ask
What is the Privacy Act 1988?
It is the Commonwealth law that regulates how Australian Government agencies and many private organisations handle personal information. Its 13 Australian Privacy Principles set the rules, and the OAIC enforces them. See the Australian Privacy Principles explained.
Does the Privacy Act apply to my small accounting or law firm?
If you are an AML/CTF reporting entity, yes, for personal information you handle for AML/CTF. Tranche 2 firms became reporting entities on 1 July 2026. See AML/CTF Tranche 2.
Do we need consent to run a biometric identity check?
Biometric information used for verification is sensitive information. Collection that the AML/CTF Act requires or authorises is an exception to the consent rule, but the OAIC says consent should generally be sought before biometric verification for CDD, with a clear collection notice. See biometric identity verification.
What has changed in the Privacy Act recently?
The 2024 amendments added stronger OAIC powers, a statutory privacy tort and an automated decision-making duty from 10 December 2026. A further tranche is at exposure draft. See Privacy Act reforms.
Primary sources
Checked 5 Nov 2026. We review this page every 90 days and when the rules change.
- Federal Register of Legislation, Privacy Act 1988
- OAIC, Australian Privacy Principles
- OAIC, Privacy guidance for reporting entities under the AML/CTF Act
- OAIC, About the Notifiable Data Breaches scheme
- OAIC, Part 4: Notifiable Data Breach (NDB) Scheme
- Federal Register of Legislation, Privacy and Other Legislation Amendment Act 2024 (commencement table)
Where StackGo fits
Privacy compliance is policy, notices, consent and governance, and those stay with your firm. IdentityCheck can reduce how much client data spreads through your own systems.
- By default, connected systems (Xero Practice Manager, Xero, Karbon and HubSpot) receive a link to the result plus the outcome and status, with no personal details written back
- Onboarding forms where you choose which questions to ask, including risk assessment forms with scoring and enhanced due diligence steps
- Biometric identity checks using a photo of a government ID document and a live selfie with liveness
- It does not write your privacy policy, collection notices, consent wording or data breach response plan
- It does not notify the OAIC or clients of a data breach, and it does not give legal advice
Ready to make onboarding minutes, not hours?
Start free and run your first check today, or book a demo and we will walk you through it.