PrivacyTerrainStructured privacy law intelligence

apac

Australia

Australia's Privacy Act and APP framework cover federal privacy obligations with active reform proposals.

Primary lawPrivacy Act 1988 and Australian Privacy Principles
Statusin-force
Last reviewed17/04/2026
Coverage qualityreviewed-core
Confidencehigh
Primary sources1
Secondary sources1
Last checked19/04/2026
Freshnessstale
Review prioritylow

Editorial caveat

Structured values summarize official materials for research and planning. They are reviewed by humans before publication and should not be treated as legal advice.

high confidence, Strong current baseline with reform watch needed.

At a glance

Key presentation points

A compact summary of high-signal fields before the full structured record.

Effective statusin-force1 primary + 1 secondary • Reviewed 15/04/2026
Territorial scopeApplies to APP entities and certain overseas organizations carrying on business in Australia.1 primary + 1 secondary • Reviewed 15/04/2026
Regulator or enforcement authority summaryOAIC1 primary • Reviewed 17/04/2026
Requires legal basisNo1 primary + 1 secondary • Reviewed 15/04/2026

Structured record

Regulation details grouped by topic

Each value keeps its field context, linked sources, notes, and review date together to avoid detached or ambiguous statements.

Identity

Effective status
in-forceSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: Federal Register of Legislation (primary); OAIC privacy guidance (secondary)Note: Starter MVP editorial summary based on official source set.
Law status
activeSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: Federal Register of Legislation (primary); OAIC privacy guidance (secondary)Note: Starter MVP editorial summary based on official source set.
Effective date
2014-03-12Support: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: Federal Register of Legislation (primary); OAIC privacy guidance (secondary)Note: Starter MVP editorial summary based on official source set.
Last amended
2024-11-29Support: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: Federal Register of Legislation (primary); OAIC privacy guidance (secondary)Note: Starter MVP editorial summary based on official source set.

Scope

Extraterritorial application
YesSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: Federal Register of Legislation (primary); OAIC privacy guidance (secondary)Note: Starter MVP editorial summary based on official source set.
Territorial scope
Applies to APP entities and certain overseas organizations carrying on business in Australia.Support: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: Federal Register of Legislation (primary); OAIC privacy guidance (secondary)Note: Starter MVP editorial summary based on official source set.
Private sector coverage
YesSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: Federal Register of Legislation (primary); OAIC privacy guidance (secondary)Note: Starter MVP editorial summary based on official source set.
Public sector coverage
YesSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: Federal Register of Legislation (primary); OAIC privacy guidance (secondary)Note: Starter MVP editorial summary based on official source set.

Definitions

Personal data definition
Information or an opinion about an identified individual, or an individual who is reasonably identifiable.Support: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: Federal Register of Legislation (primary); OAIC privacy guidance (secondary)Note: Starter MVP editorial summary based on official source set.
Sensitive data recognized
YesSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: Federal Register of Legislation (primary); OAIC privacy guidance (secondary)Note: Starter MVP editorial summary based on official source set.
Legal bases
Support: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: Federal Register of Legislation (primary); OAIC privacy guidance (secondary)Note: Starter MVP editorial summary based on official source set.
Requires legal basis
NoSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: Federal Register of Legislation (primary); OAIC privacy guidance (secondary)Note: Starter MVP editorial summary based on official source set.

Rights

Right of access
YesSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: Federal Register of Legislation (primary); OAIC privacy guidance (secondary)Note: Starter MVP editorial summary based on official source set.
Right to deletion
NoSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: Federal Register of Legislation (primary); OAIC privacy guidance (secondary)Note: Starter MVP editorial summary based on official source set.
Right to object
NoSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: Federal Register of Legislation (primary); OAIC privacy guidance (secondary)Note: Starter MVP editorial summary based on official source set.
Right to portability
NoSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: Federal Register of Legislation (primary); OAIC privacy guidance (secondary)Note: Starter MVP editorial summary based on official source set.
Right to appeal
YesSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: Federal Register of Legislation (primary); OAIC privacy guidance (secondary)Note: Starter MVP editorial summary based on official source set.
Right to erasure or delete summary
Limited deletion / de-identification pathwaysSupport: 1 primary • Reviewed 17/04/2026Sources: Federal Register of Legislation (primary)Note: Australia is better described through narrower deletion and de-identification pathways than a single omnibus erasure right.
Right to rectification or correction summary
Correction rightSupport: 1 primary • Reviewed 17/04/2026Sources: Federal Register of Legislation (primary)Note: Australia uses correction language rather than GDPR-style rectification phrasing alone.

Breach

Breach deadline (hours)
720Support: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: Federal Register of Legislation (primary); OAIC privacy guidance (secondary)Note: Starter MVP editorial summary based on official source set.
Breach notification required
YesSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: Federal Register of Legislation (primary); OAIC privacy guidance (secondary)Note: Starter MVP editorial summary based on official source set.

Governance

DPO required
NoSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: Federal Register of Legislation (primary); OAIC privacy guidance (secondary)Note: Starter MVP editorial summary based on official source set.
Impact assessment required
NoSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: Federal Register of Legislation (primary); OAIC privacy guidance (secondary)Note: Starter MVP editorial summary based on official source set.
Records of processing required
NoSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: Federal Register of Legislation (primary); OAIC privacy guidance (secondary)Note: Starter MVP editorial summary based on official source set.

Enforcement

Maximum fine
Serious or repeated interferences can trigger penalties exceeding AUD 50 million under recent reforms.Support: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: Federal Register of Legislation (primary); OAIC privacy guidance (secondary)Note: Starter MVP editorial summary based on official source set.
Private right of action
NoSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: Federal Register of Legislation (primary); OAIC privacy guidance (secondary)Note: Starter MVP editorial summary based on official source set.
Regulator or enforcement authority summary
OAICSupport: 1 primary • Reviewed 17/04/2026Sources: Federal Register of Legislation (primary)Note: Australian privacy enforcement centers on the OAIC.

Transfers

Cross-border transfer restricted
YesSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: Federal Register of Legislation (primary); OAIC privacy guidance (secondary)Note: Starter MVP editorial summary based on official source set.
Data localization required
NoSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: Federal Register of Legislation (primary); OAIC privacy guidance (secondary)Note: Starter MVP editorial summary based on official source set.

Marketing

Cookie consent rule
No single cookie law, but consent expectations arise under privacy and marketing guidance.Support: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: Federal Register of Legislation (primary); OAIC privacy guidance (secondary)Note: Starter MVP editorial summary based on official source set.

Official sources

Recent change workflow