Privacy Act 1988 · Australian Privacy Principles
Australian Privacy Act compliance and requirements, handled the way the 13 principles expect.
Turn the Australian Privacy Principles into everyday practice: know what personal information you hold, say openly how you handle it, secure it, answer access and correction requests, and act fast when a breach could cause serious harm. Sterling's expert and experienced consultants build the programme with your privacy, technology and legal people and keep the evidence ready for a customer or the OAIC, in 60+ countries. We help our clients put it into practice and prove it.
- Fixed scope, one proposal: consulting, Effivity software, Sterling Academy access and internal auditor training, as applicable to your standard, in one proposal
- A team of expert and experienced privacy and information security consultants, delivering data protection programmes across sectors and countries since 2003
- The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. The Privacy Act has no certificate; the OAIC regulates it, and Sterling does not certify
8,100+ client engagements in 60+ countries.
Why clients choose Sterling
What it is
What is the Australian Privacy Act 1988 and what is it used for?
The Privacy Act 1988 is Australia's main federal law on personal information. Its core is the Australian Privacy Principles, thirteen principles-based rules on collecting, using and disclosing personal information, on governance and accountability, on keeping information accurate and secure, and on letting people see and correct what is held about them. The Act calls the organisations and agencies it covers APP entities, and the Office of the Australian Information Commissioner (OAIC) is the regulator that handles complaints, receives breach notifications and enforces the Act.
Because the principles describe outcomes rather than one method, each entity decides how they apply to its own information flows and must be able to show that decision later.
Law in force. The APPs were introduced by the Privacy Amendment (Enhancing Privacy Protection) Act 2012 and commenced on 12 March 2014. The Notifiable Data Breaches scheme was added by the Privacy Amendment (Notifiable Data Breaches) Act 2017. The Privacy and Other Legislation Amendment Act 2024 commences on various dates set out in its section 2; the OAIC states that most amendments within the Commissioner's remit commenced on 11 December 2024, and new privacy policy content on automated decisions applies from 10 December 2026. Always confirm the current compilation on the Federal Register of Legislation.
Who it is for
Who needs to comply with the Australian Privacy Act?
The Act covers Australian Government agencies and private sector organisations above an annual turnover threshold. Some smaller businesses are covered regardless of turnover, including private sector health service providers, businesses that sell or purchase personal information, credit reporting bodies and contracted service providers under a government contract. Whether you are an APP entity is the first thing to settle, with your legal advisers where the answer is not obvious. Organisations usually come to Sterling for one of four reasons:
- An enterprise customer sends a privacy questionnaire. Banks, insurers, health groups and government buyers ask how you meet the APPs and handle breaches. Answer from a programme that exists.
- A tender or government contract carries privacy obligations. Contracted service providers can be drawn into the Act through the contract itself.
- A regulator, incident or complaint has focused attention. An eligible data breach, an OAIC enquiry or a complaint from an individual shows where handling has drifted.
- Group companies handle Australian personal information. A parent overseas, a shared service centre or an offshore support team receives data from Australia, and cross-border disclosure under APP 8 needs a clear position.
Requirements
What are the main Australian Privacy Act requirements?
The thirteen APPs sit in Schedule 1 of the Act and are grouped into five parts. The Notifiable Data Breaches scheme and the 2024 amendments add duties alongside them. The list below is a plain-language map at title level; your programme is tested against the current text of the Act and the OAIC's APP guidelines, with your legal advisers on points of interpretation.
- Part 1 Consideration of personal information privacy (APP 1 and APP 2): open and transparent management of personal information, including a clear privacy policy, and the option of anonymity or pseudonymity where practicable.
- Part 2 Collection of personal information (APP 3 to APP 5): collecting solicited information only as the principles allow, dealing properly with unsolicited information, and telling people about a collection.
- Part 3 Dealing with personal information (APP 6 to APP 9): use or disclosure, direct marketing, cross-border disclosure, and the adoption, use or disclosure of government related identifiers.
- Part 4 Integrity of personal information (APP 10 and APP 11): quality of personal information and security of personal information.
- Part 5 Access to, and correction of, personal information (APP 12 and APP 13): giving individuals access to their information and correcting it.
- Notifiable Data Breaches scheme: assess a suspected breach quickly and, where it is likely to result in serious harm and remedial action has not removed that risk, notify affected individuals and the OAIC.
- 2024 amendments: privacy policies describe computer-assisted decisions that could significantly affect individuals, from 10 December 2026, alongside the wider changes the amending Act made.
What does useful Privacy Act evidence look like?
An information inventory that matches the systems in use, a privacy policy and collection notices people can actually find, disclosure and direct marketing decisions with their reasoning, a record of overseas recipients, security controls tied to APP 11, an access and correction log with response dates, and a breach register that includes incidents you assessed and chose not to notify, with the reasons. We build them from your real information flows and keep them in Effivity.
Compliance process
How do you achieve Australian Privacy Act compliance?
There is no audit to pass and no certificate at the end. Compliance is demonstrated to the people who ask: customers, individuals and, if it comes to it, the OAIC. Sterling helps you build the programme and its evidence; the OAIC interprets and enforces the Act, and your legal advisers give legal advice.
- 01Confirm coverage and scope.Establish whether each entity is an APP entity, which business lines, systems and overseas recipients are in scope, and who will judge the result.
- 02Gap analysis: test current practice against the APPs.Map information flows, then compare notices, consents, disclosures, security and request handling with each principle, keeping what works.
- 03Implement and record as you go.Update the privacy policy and notices, set disclosure and retention rules, strengthen security, rehearse the breach response and train the people who handle personal information.
- 04Internal audit and management review.An internal audit against the APPs and a review by management show what operates; we raise findings first and close them with evidence.
- 05Answer the review, then sustain.Respond to customer due diligence or an OAIC enquiry from a ready evidence pack, and keep the programme current as systems, suppliers and the law change.
Check the route before you sign. No body issues a Privacy Act certificate, so treat any offer of one with caution and ask what the provider will actually leave behind: the information map, the decisions, trained people and working records. Test what you are told against the OAIC's guidance on oaic.gov.au. The certification buyer's checklist
Cost
How much does Australian Privacy Act compliance cost?
The cost of a Privacy Act programme follows the amount of personal information you handle and how scattered it is. We quote after scoping, and nothing is added later.
| Cost component | What affects it |
|---|---|
| Consulting and implementation | Entities and business lines in scope, systems and suppliers to map, overseas recipients, deliverables and how much your team does itself (Design™ or Drive™) |
| External review | No certification fee applies to the Act; any ISO/IEC 27701 or ISO/IEC 27001 certification body you choose, or a customer's own assessor, is shown separately |
| Internal resources and legal | Time from system and process owners, the privacy officer's capacity, IT changes for access, retention and security, training hours and your legal advisers' review |
| Software and learning | Included in a Sterling engagement: Effivity for the programme and Sterling Academy access for your people, with users, courses and access period confirmed in the proposal |
| Continued support | Internal audits, breach rehearsals, updates as the reforms continue and refresher learning under Sustain™ |
What moves the price
- How many entities, brands and business lines hold personal information
- Sensitive information such as health data, and credit or tax file number handling
- Number of systems, suppliers and overseas recipients
- Whether an ISO/IEC 27001 system or a data inventory already exists
- The deadline set by a customer, contract or incident
What a Sterling proposal always shows
- Scope, deliverables, assumptions and exclusions in writing
- Any third-party certification or assessor fees identified separately
- Effivity, training and Academy access itemised at no additional cost
- Milestones linked to deliverables
- A single all-inclusive proposal, with nothing added later
Timeline
How long does Australian Privacy Act compliance take?
Most programmes take three to six months, as our estimate; it is shorter where an information security system and an inventory already exist, and longer where many systems, overseas recipients and brands must be mapped. The pace is set by decisions on disclosures, retention and overseas transfers, and by controls operating long enough to leave records.
| Phase | What determines the pace |
|---|---|
| Coverage and gap analysis | Access to system owners, contracts and current notices, and how quickly information flows can be mapped |
| Build and implementation | Policy and notice approvals, supplier and overseas-recipient arrangements, security changes and training |
| Evidence and review | Requests, incidents and controls recorded over time, then internal audit and management review |
| External review | The timing of customer questionnaires, audits or any regulator contact |
If a customer deadline or the 10 December 2026 date matters to you, say so at the start and we will plan to it accurately.
Your engagement
What your Privacy Act engagement includes
A Sterling engagement follows the Sterling OS™ phases under one all-inclusive proposal. You choose the level of support that suits your team, and we work alongside your legal advisers rather than in their place.
Coverage check, gap analysis and plan
APP entity status, scope and a plan with owners and dates, agreed before work starts.
Design™: guided support
We design the programme, templates and decisions with you; your people implement with our guidance.
Drive™: managed support
An alternative to Design™: our consultants carry the work with your process owners, from mapping to evidence.
Sustain™: after the programme is in place
Internal audits, breach rehearsals and updates as systems, suppliers and the law change.
Automate™: Effivity
The programme runs in Effivity, included with the engagement at no additional cost.
Training for your people
Internal auditor training, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training as part of the engagement.
Sterling does not certify, and no certificate of compliance with the Privacy Act exists; the OAIC regulates the Act and Sterling does not give legal advice.
Often combined with
Standards organisations pair with Privacy Act 1988 (Australia)
- ADGM Data Protection Regulations 2021ADGM data protection compliance for entities under the 2021 Regulations: lawful bases, DPO, impact assessments, 72-hour breach notice and transfers, all-inclusive proposal.
- APEC CBPRAPEC CBPR certification and requirements explained: Global CBPR and PRP, Accountability Agent review, annual renewal and how Sterling prepares your team.
- APPI (Japan)APPI compliance for Japan's Act on the Protection of Personal Information: the requirements, PPC breach reporting, cross-border rules and an all-inclusive programme.
- Bahrain PDPLBahrain PDPL compliance and requirements explained: consent, notification to the Authority, transfers abroad, 72-hour breach reporting, rights, cost and timing.
- CCPA / CPRACCPA compliance and requirements under the CPRA: notices, consumer rights, opt-outs, risk assessments, cybersecurity audits and ADMT, in an all-inclusive programme.
- Cyber and Data Protection Act (Zimbabwe)Zimbabwe's Cyber and Data Protection Act [Chapter 12:07]: POTRAZ licensing, lawful processing, security and transfers, built into a programme.
Effivity · privacy compliance software, included in every engagement
How Effivity helps you fulfil, automate and simplify the requirements of the Privacy Act 1988.
Every Sterling Privacy Act engagement includes Effivity, the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. Your consultant sets up the privacy workspace within the agreed scope, so the information inventory, notices, overseas recipients, access requests, breaches, risks, audits and training records sit in one place and the programme runs in daily work. Sterling consulting clients get their Effivity subscription included with the engagement, at no additional cost.
Privacy policy and governance
The privacy policy, the privacy officer's role and the programme owners kept current, with each revision and approval on record.
Information inventory and notices
Every collection point listed with its purpose, the notice people see and the systems the information lands in.
Disclosures and direct marketing
Disclosure decisions, marketing preferences and opt-outs recorded, so the reason for each use can be shown.
Overseas recipients
A register of overseas recipients, group companies and cloud providers, with the arrangement in place for each.
Risks and security controls
Privacy risks linked to the controls that treat them, with retention and destruction tracked to completion.
Requests from individuals
Access and correction requests logged, assigned and answered, with dates visible to management.
Incidents and breach assessment
Each incident assessed against the serious-harm test, with the decision, notifications and follow-up on file.
Internal audit, review and training
Audit programmes, findings, management review and training records in one workspace, adapted to your forms without code.
What this means when someone asks
A customer's assessor or the OAIC asks for the privacy policy, the breach register, the request log and the list of overseas recipients. In Effivity each is a screen with owners, dates and evidence attached, rather than a folder assembled in a hurry.
In your engagement
- Subscription included with the engagement, at no additional cost
- Configured by your Sterling consultant within the agreed scope
- Existing registers and records migrated, not retyped
- Admin and user training for your team
- Modules for EMS, OHSMS, ISMS, FSMS and more when you integrate other standards
Sterling Academy · privacy e-learning
Help everyone who handles personal information apply the APPs.
Sterling Academy provides e-learning for the whole workforce and for the people who run the programme: video lessons, practice checkpoints, a final exam and a numbered Certificate of Completion for each learner, verifiable online. Sterling consulting clients benefit from preferential Sterling Academy course access and special pricing through their Sterling consultant, including complimentary awareness training for their people as part of the engagement.
- Privacy awareness for every employee who collects, uses or sees personal information
- Deeper learning for the privacy officer, system owners and customer-facing teams
- Internal auditor training for the people who will audit the programme, as applicable to your standard, as part of the engagement
- Progress by department and a training record you can show a customer
- New starters trained as they join, so records stay current
- A Sterling consultant on hand when a learner has a question
Keep exploring
Explore more about Privacy Act 1988 (Australia)
Privacy Act resources
Services for Privacy Act 1988 (Australia)
Why Sterling
Want successful Privacy Act compliance? Come to Sterling.
Many organisations that handle Australian personal information also answer to the GDPR, other national privacy laws or customer security frameworks. Sterling builds one programme that meets the APPs and serves those other obligations where they overlap, with clear local ownership in each entity.
60+ countries since 2003
Privacy and information security programmes delivered across sectors and regions, with one engagement team accountable wherever you operate.
All-inclusive proposal
Consulting, Effivity, training and Academy access in one proposal, with any third-party fees shown separately.
One programme, several obligations
Controls built once and mapped to the APPs, the GDPR, ISO/IEC 27001 or ISO/IEC 27701 where you need them, as Sterling's mapping, not the law's.
Expert and experienced consultants
Consultants who have put privacy and information security programmes into operation across sectors and countries since 2003, working alongside your legal advisers.
The Sterling Promise
What our Privacy Act compliance success guarantee means
We stay with you until the agreed Privacy Act compliance programme is in place and its evidence is ready, supporting implementation, internal audit and your answers to customer reviews. Included software and employee learning leave lasting capability behind.
The engagement sets out the scope, outcome and responsibilities. Your organisation provides accurate information and operates the agreed controls. No certificate exists for the Privacy Act; the OAIC interprets and enforces it, and your legal advisers advise on it. Our commitment covers the agreed compliance support, not the outcome of any complaint, enquiry or contract award.
FAQs
Frequently asked questions about the Australian Privacy Act
Is there an Australian Privacy Act certification?
No. Nobody certifies compliance with the Privacy Act 1988. You show compliance through your policy, records and practice when a customer, an individual or the OAIC asks. If a certificate is wanted for other reasons, ISO/IEC 27701 or ISO/IEC 27001 certification by an accredited body is a separate route.
Does the Privacy Act apply to small businesses?
Usually not, but there are important exceptions. Organisations below the Act's annual turnover threshold are generally outside it, yet private sector health service providers, businesses that sell or purchase personal information, credit reporting bodies and government contracted service providers are covered. Check the current position on oaic.gov.au and with your legal advisers.
When do you have to report a data breach to the OAIC?
When it is an eligible data breach. That means personal information was lost or accessed or disclosed without authorisation, serious harm to someone is likely, and remedial action has not prevented that risk. You must assess a suspected breach quickly and then notify both the affected individuals and the OAIC.
Does ISO/IEC 27001 make us compliant with the Australian Privacy Principles?
Not on its own. An information security system supports APP 11 on security and helps with breach response, but it does not decide collection, disclosure, direct marketing, overseas transfers or access requests. ISO/IEC 27701 goes further on privacy; we map either to the APPs as Sterling's mapping and close the remaining gaps.
What changed under the Privacy and Other Legislation Amendment Act 2024?
The Act gave individuals a statutory tort for serious invasions of privacy, widened the OAIC's enforcement powers, directed a Children's Online Privacy Code to be registered by 10 December 2026, created a mechanism for recognising countries with adequate protection, and requires privacy policies to cover automated decisions from 10 December 2026. Your legal advisers can confirm how each change affects you.
Keep exploring
More on Privacy Act 1988 (Australia) and related standards
More in Privacy & data protection
Talk to a consultant
Plan your Australian Privacy Act compliance programme with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice