How to Comply with Australian Privacy Principles: A Guide for Businesses

The Privacy Act 1988 sets out 13 Australian Privacy Principles (APPs) that govern how businesses handle personal information. Follow these five steps to ensure your organisation meets its privacy obligations. 

1. Identify Your Coverage & Obligations

Determine whether your business is an “APP entity” (most private sector organisations with an annual turnover >$3 million or handling sensitive data). Map out all personal data flows: collection, storage, use and disclosure.

2. Develop & Publish a Privacy Policy

Draft a clear, accessible Privacy Policy that covers:

• What information you collect and why
• How you use, disclose and store data
• Access, correction and complaints procedures
• Any cross-border data transfers

3. Implement Data Handling Procedures

Establish internal controls for:

• Secure collection (consent mechanisms, minimal data)
• Safe storage (encryption, access controls)
• Proper use & disclosure (only for stated purposes)
• Timely data destruction or de-identification when no longer needed

4. Train Staff & Manage Consent

Educate all employees on APP requirements and your Privacy Policy. Ensure you obtain valid consent for sensitive data and maintain records of consent. Provide easy opt-out mechanisms.

5. Breach Response & Notification

Have a Data Breach Response Plan that includes:

• Incident investigation and containment
• Assessing “eligible data breaches” (serious harm + unauthorised access)
• Notifying affected individuals and OAIC within 30 days
• Reviewing and updating controls to prevent recurrence

Need Expert Privacy Advice?

Contact LawWise Australia for tailored privacy policy drafting, employee training and data breach management services.

---

Post Insights

• Estimated CPC: AUD 1.50–3.00
• Affiliate Opportunities: Iubenda privacy policy tool, Termly compliance platform, SANS privacy & security training