Australian Privacy Principles: the 13 APPs explained
The Australian Privacy Principles are 13 legally binding rules in Schedule 1 of the Privacy Act 1988. They set how government agencies, businesses with annual turnover over A$3 million and some smaller businesses collect, use, secure and give access to personal information.
The Australian Privacy Principles are the 13 rules that decide how your business may collect, use, store and share personal information. If the Privacy Act covers you, they cover the personal information you hold about clients, from the first form a client fills in to the day you destroy the file.
What are the Australian Privacy Principles?
The APPs are Schedule 1 of the Privacy Act 1988. They took effect on 12 March 2014 and replaced the Information Privacy Principles and National Privacy Principles.
The Office of the Australian Information Commissioner (OAIC) calls them principles-based law. They set outcomes rather than exact methods, so each business decides how to meet them for the information it holds.
Personal information is information or an opinion about an identified person, or someone who is reasonably identifiable. Our guide to what counts as personal information in Australia covers the edge cases.
Who has to follow the APPs?
- The law
- 13 APPs, in Schedule 1 of the Privacy Act 1988In force since 12 March 2014
- Who it covers
- Government agencies, and organisations with annual turnover over A$3 millionSome smaller businesses too, such as health service providers and AML/CTF reporting entities
- Regulator
- OAICHandles complaints, investigates and enforces the Act
- Access requests
- 30 days for agenciesOrganisations: within a reasonable period (APP 12)
- Maximum civil penalty, company
- The greatest of A$50 million, 3 times the benefit, or 30% of adjusted turnoverFor a serious interference with privacy, under Australia’s Privacy Act 1988 (s 13G). The turnover test applies when a court cannot value the benefit
Sources: OAIC, Read the Australian Privacy Principles; OAIC, Small business; Privacy Act 1988 (ss 13G, 26WH, 26WK, 26WL; Schedule 1) Reviewed
The APPs bind Australian Government agencies and organisations with annual turnover over A$3 million. Turnover means all income from all sources, not just profit.
A smaller business is still covered if it is one of these:
- a health service provider
- a business that trades in personal information
- a contractor providing services under a Commonwealth contract
- a credit reporting body
- a reporting entity under the AML/CTF Act
- a business that has opted in to the Act
Key point
Under Australia’s Privacy Act 1988, an anti-money laundering and counter-terrorism financing (AML/CTF) reporting entity must follow the APPs whatever its annual turnover.
That last point matters for accounting practices, law firms and real estate agencies newly regulated by the Australian Transaction Reports and Analysis Centre (AUSTRAC). A small firm that was outside the Privacy Act can be inside it once it provides a designated service. Our PII compliance requirements guide sets out the other laws that may apply alongside it.
What do the 13 APPs require?
The 13 APPs, in the five parts of Schedule 1
| Part of Schedule 1 | APPs | What you must do |
|---|---|---|
| 1. Consideration of personal information privacy | APP 1 open and transparent management; APP 2 anonymity and pseudonymity | Keep a clear, current privacy policy. Let people deal with you without identifying themselves where that is practicable and lawful |
| 2. Collection | APP 3 solicited information; APP 4 unsolicited information; APP 5 notification | Collect only what is reasonably necessary, destroy what you could not have collected, and tell people why you are collecting |
| 3. Dealing with personal information | APP 6 use or disclosure; APP 7 direct marketing; APP 8 cross-border disclosure; APP 9 government related identifiers | Use information for its purpose, offer a marketing opt-out, check overseas recipients, and do not adopt government identifiers as your own |
| 4. Integrity | APP 10 quality; APP 11 security | Keep information accurate and secure, and destroy or de-identify it when you no longer need it |
| 5. Access and correction | APP 12 access; APP 13 correction | Give people access to their information and correct it when it is wrong |
Sources: OAIC, Read the Australian Privacy Principles; Privacy Act 1988 (ss 13G, 26WH, 26WK, 26WL; Schedule 1) Reviewed
Schedule 1 groups the principles into five parts that follow information through its life. The table gives each part in one line; the paragraphs below cover the rules most businesses trip on.
Collection: APPs 3 to 5
You may collect personal information only if it is reasonably necessary for your functions or activities. Sensitive information, such as health information, generally needs the person’s consent.
You must tell people why you are collecting their information at or before the time you collect it. If that is not practicable, you tell them as soon as practicable after.
Use, disclosure and identifiers: APPs 6 to 9
You use or disclose information for the purpose you collected it, unless an exception applies. Direct marketing must offer a simple way to opt out.
Before you send information overseas, including to a cloud provider, you take reasonable steps to make sure the recipient does not breach the APPs. You cannot adopt a government related identifier as your own customer number.
Security, access and correction: APPs 10 to 13
You keep information accurate and protect it from misuse, interference, loss and unauthorised access. When you no longer need it for any purpose and the law does not require you to keep it, you destroy or de-identify it.
People can ask to see and correct what you hold. Agencies answer within 30 days. Organisations answer within a reasonable period and may charge a fee that is not excessive for giving access, but not for the request.
What do the APPs mean when you verify a client’s identity?
Client onboarding is where most of your sensitive information arrives. Identity documents, dates of birth and addresses all fall under APPs 3, 5 and 11 the moment you collect them, whether through our Intake workflow or a paper form.
AML/CTF law sets how long you keep the evidence, and it asks for less than many firms assume.
Key point
Under Australia’s AML/CTF Act, a reporting entity must keep initial customer due diligence records for 7 years but need not keep copies of identity documents.
AUSTRAC’s initial customer due diligence guidance asks for records of the type and content of the data you collected and the decisions you made. Holding fewer scans means less to secure under APP 11 and less to lose in a breach.
Our customer due diligence checklist lists what to record at each step.
How do you put the APPs into practice?
Start with the privacy policy, because APP 1 says what it must contain and it is the first document a complainant or the OAIC will read. It must cover:
- the kinds of personal information you collect and hold
- how you collect and hold it, and why
- how people can access and correct their information
- how people can complain, and how you will deal with a complaint
- whether you are likely to disclose information overseas, and to which countries if practicable
Then map where personal information lives: your customer relationship management (CRM), email, shared drives and every app that touches client files. The map shows what you can delete under APP 11 and which overseas services fall under APP 8.
Name one person who owns privacy, and train the staff who handle access requests and complaints. Our guide on how to protect PII data covers the security controls.
What happens if you breach the APPs?
How a privacy complaint reaches the OAIC
Privacy Act 1988, as the OAIC handles complaints
- Step 1
The person complains to your business
Some sectors use an external dispute scheme first, such as AFCA for financial services.
- Up to 30 days
You respond
No response in 30 days, or an answer they do not accept, opens the way to the OAIC.
- Step 2
They complain to the OAIC
The OAIC may decline, conciliate or investigate.
-
Determination
If not resolved, a formal decision on what you must do: an apology, access or correction, changed practices, staff training or compensation.
Sources: OAIC, Lodge a privacy complaint with us; OAIC, How we investigate and resolve your complaint Reviewed
A person must complain to you first. If you do not respond within 30 days, or they are unhappy with your answer, they can complain to the OAIC.
The OAIC may conciliate or investigate. If the matter is not resolved, it can make a determination that states what you must do, which can include an apology, changed practices, staff training or compensation.
For serious interference with privacy, courts can impose civil penalties under section 13G of the Privacy Act. For a company, the maximum is the greatest of A$50 million, 3 times the benefit obtained, or 30% of adjusted turnover.
A data breach likely to cause serious harm also triggers the Notifiable Data Breaches (NDB) scheme, covered in our PII compliance guide.
StackGo’s IdentityCheck runs intake, verification and screening from inside the CRM you already use. The record of each check sits with the client it belongs to.
Frequently asked questions
Do the APPs apply to sole traders?
Only if the business is covered. A sole trader with annual turnover of A$3 million or less is outside the Act unless an exception applies, such as providing a health service or being an AML/CTF reporting entity.
Can a business charge for access to personal information?
An organisation may charge a fee for giving access, if the fee is not excessive. It cannot charge for making the request. Government agencies cannot charge for either.
Is a privacy policy the same as a collection notice?
No. The privacy policy under APP 1 describes how you handle information in general. The APP 5 notice tells a person, at the point of collection, why you are collecting their information.
Sources
- OAIC, Read the Australian Privacy Principles, checked 21 October 2026
- OAIC, Small business, checked 21 October 2026
- OAIC, History of the Privacy Act, checked 21 October 2026
- OAIC, How we investigate and resolve your complaint, checked 21 October 2026
- Privacy Act 1988 (s 13G, Schedule 1), checked 21 October 2026
- AUSTRAC, Overview of initial customer due diligence, checked 21 October 2026