Australia · Compliance
Privacy Act 1988 compliance in Australia
Achieve Privacy Act 1988 compliance in Australia with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- Compliance, end to end
- Sydney office team
- Effivity software included
- Academy training included
Who asks for Privacy Act 1988 in Australia
Clients include
Privacy Act 1988 compliance in Australia at a glance
Privacy Act 1988 is the instrument itself: it applies to the organisations within its scope, and buyers and partners in Australia ask for evidence that you meet it.
Two parts of the Privacy Act 1988 decide most privacy engagements: APP 11 and the Notifiable Data Breaches scheme. The Act binds APP entities: Australian Government agencies, businesses and not-for-profits above the small-business turnover threshold, and some organisations whatever their size, including private health service providers, credit providers and entities that trade in personal information. APP 11 requires reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. When an eligible data breach occurs, affected individuals and the Office of the Australian Information Commissioner must be notified. There is no certificate under the Act; compliance is shown through accurate privacy policies, records of holdings, breach procedures and working security controls. Sterling's Sydney office maps personal information, closes the gaps against the principles and rehearses breach response with the people who will run it.
Who needs Privacy Act 1988 in Australia, and what happens without it
These are the organisations in Australia that most often need to show Privacy Act 1988.
- Businesses and not-for-profits above the small-business turnover thresholdThey are APP entities bound by the Australian Privacy Principles.
- Private sector health service providers, credit providers and entities trading in personal informationCovered by the Privacy Act regardless of size.
- Any APP entity holding personal informationThe NDB scheme requires assessment and notification of eligible data breaches.
- Overseas companies with Australian customersPrivacy questions arise in Australian customer due diligence.
Not sure which of these applies to you?Answer a short set of questions and your readiness report arrives by e-mail.
Take the free readiness checkPrivacy Act 1988 requirements in Australia
Strip away the vocabulary and the Privacy Act 1988 requires an APP entity to comply in six areas of the Australian Privacy Principles.
In Australia these six sit alongside the local laws and regulations listed under drivers below; one system can evidence both. The detail is on the global hub: Privacy Act 1988 explained →
How to achieve Privacy Act 1988 compliance in Australia
One team from the Sydney office carries the work from scoping to sign-off. All states and territories, delivered from the Sydney office; remote delivery for distributed teams.
- Discovery call and scopeEntities, locations, regulators and target date, agreed before any proposal.
- Gap assessment against Privacy Act 1988 and the Australian requirements that apply to youControls you already run for your regulators and customers are reused, not rebuilt.
- Your system built with your team in EffivityRisks, controls, evidence, incidents and reviews in one live system the auditor can see.
- Internal audit, management review and corrective actionsYour internal auditors trained by Sterling; the evidence proven before any external review.
- Reviews by regulators, customers and auditorsSterling supports the reviews your regulators, customers and auditors run.
- End to end, from one team
- Effivity ISO & GRC software
- Preferential Sterling Academy access, with complimentary awareness training for your people
- Internal auditor training for your audit team, as applicable to your standard
- Vulnerability assessment on ISMS engagements
The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements.Sterling does not certify. Certification decisions stay with independent bodies.
How long does Privacy Act 1988 compliance take in Australia?
There is no standard duration: it depends on your scope and on how much of the system already runs. In Australia these are the factors that set the timeline.
- Number of systems and processing activities to map
- Data breach response plan maturity
- Number of entities and third-party processors in scope
Sterling agrees a dated plan with you on the discovery call, once the scope is known.
How much does Privacy Act 1988 compliance cost in Australia?
The cost has two parts: the consulting work to build and prove the system, and any external assessor’s fees, which are quoted separately. In Australia these factors move both.
- Volume and sensitivity of personal information held
- Number of systems, vendors and overseas disclosures
- Security remediation needed under APP 11
Sterling gives one customised, all-inclusive proposal after the discovery call, never before the scope is agreed.
Privacy Act 1988 consultants and assessors in Australia
Two different organisations are involved. A consultant helps you build the system and prove it works; your regulators, customers and auditors then audits or assesses it and decides. Keeping the two separate is what makes the result credible to buyers and regulators.
- Check that the body’s accreditation or approval covers Privacy Act 1988 and your sector, and that its certificates can be verified online.
- Ask the consultant how the local requirements in Australia are mapped into the same system, so nothing runs twice.
- Ask for client references in your sector; Sterling’s client letters are available on request.
- Agree who owns the evidence and the tool after the engagement; with Sterling the system stays yours, in Effivity.
Laws and regulations that drive Privacy Act 1988 in Australia (2)
| Instrument | How it treats the standard |
|---|---|
| Privacy Act 1988 — Australian Privacy Principles | The instrument itself APP entities must comply with the APPs; overseen by the OAIC. |
| Notifiable Data Breaches scheme (Privacy Act 1988, Part IIIC) | Expected in practice Eligible data breaches must be notified to affected individuals and the Commissioner; no standard named. |
"Expected in practice" means the instrument asks for the outcomes Privacy Act 1988 covers without naming a standard, and Privacy Act 1988 is what buyers and regulators commonly accept as evidence of them.
Accreditation, audit language and remote audits in Australia
Compliance, not certification: the Privacy Act provides no certificate. Evidence is the entity's privacy policy and notices, records of personal information holdings, procedures and the security steps it takes under APP 11. ISO/IEC 27701 certification by an accredited body is optional. Edition and transition details: Privacy Act 1988 hub →
Audit language
Privacy policies and notices are written in English for Australian audiences.
Remote and on-site
Data mapping workshops can be on-site or remote; the Act prescribes no external assessment.
Privacy Act 1988 in Australia: questions clients ask
Does the Privacy Act apply to a small business?
Generally small business operators fall outside the Australian Privacy Principles, but not always. Health service providers, credit providers, entities that trade in personal information and others are covered whatever their size. Check which category you are in against the OAIC's definition of an APP entity, and confirm with your counsel if you are close to the line.
What must happen after a data breach?
Suspected breaches must be assessed. Where there are reasonable grounds to believe an eligible data breach has occurred, notify the affected individuals and give the Commissioner a statement as soon as practicable. This applies to entities with APP 11 duties. Whether a particular incident is eligible is a legal judgement, so confirm with counsel or the OAIC.
Is there a Privacy Act certification?
No. The Privacy Act provides no certificate, so be wary of anyone selling one. Compliance is evidenced by your privacy policy and notices, records of personal information holdings, procedures and the security steps you take under APP 11. ISO/IEC 27701 certification from an accredited body is optional and adds to that evidence.
Who regulates the Privacy Act?
The Office of the Australian Information Commissioner, known as the OAIC, oversees the Privacy Act 1988 and the Australian Privacy Principles. It is also the body to which eligible data breaches are reported. For a view on how the Act applies to your organisation, ask your counsel or approach the OAIC.
More on Privacy Act 1988 for Australian organisations
Other standards Australian businesses ask Sterling for
Organisations in Australia often combine Privacy Act 1988 with one of these, under one management system where the scopes allow.
Start with a free discovery call from the Sydney office
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Privacy Act 1988 — Australian Privacy Principles — oaic.gov.au (accessed 5 Oct 2026)
- Notifiable Data Breaches scheme (Privacy Act 1988, Part IIIC) — oaic.gov.au (accessed 5 Oct 2026)
- Quality management guidelines for construction (NSW Government) — info.buy.nsw.gov.au (accessed 5 Oct 2026)
- Work Health & Safety management guidelines for construction procurement (Edition 6, December 2019) — info.buy.nsw.gov.au (accessed 5 Oct 2026)
- Environmental management guidelines for construction (edition 4) — info.buy.nsw.gov.au (accessed 5 Oct 2026)
Talk to a consultant
Plan your certification with the Sydney team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
australia@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice