Australia. Comprehensive data protection. Act
Privacy ActPrivacy Act 1988 (Cth)
§1Summary
- Synopsis
Australia's federal privacy law, built on 13 Australian Privacy Principles for Commonwealth agencies and private organisations with turnover above A$3 million (plus some smaller businesses). The OAIC enforces through investigations, determinations, infringement notices and civil penalty proceedings.
- Key themes
- Unique features
Small business (<A$3m turnover) exemption and employee records exemption; organisations remain accountable for overseas recipients under APP 8.
- SaaS relevance
Applies to SaaS with an 'Australian link', including foreign companies carrying on business in Australia and collecting or holding data there.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- See NDB scheme: assess within 30 days; notify OAIC and individuals as soon as practicable
- DPO
- No
- Cross-border transfers
- APP 8 accountability, consent or substantially similar law
- Maximum penalty
- Greater of A$50m, 3x benefit, or 30% of adjusted turnover (serious interference); tier of A$3.3m for non-serious
§3Dates
- Key dates
- Adopted
- In force
- Private sector from 2001; APPs from 2014-03-12; NDB scheme 2018-02-22; penalty increase 2022-12-13; POLA Act 2024 (assent Dec 2024) – ADM privacy-policy transparency from 2026-12-10
§4Text and authority
- Text
- Authoritative text legislation.gov.au
- Authority
- Office of the Australian Information Commissioner (OAIC)
§5Where it applies
- Domestic law of
- Australia
- Also applies in
§6Sources and verification
- Sources consulted
- Verification
High confidence.
Tranche 2 reforms (e.g. removing small business exemption, fair and reasonable test) not legislated as of Oct 2026 to our knowledge.