Mandatory scheme
Privacy Act 1988 — Australian Privacy Principles
Privacy Act 1988 — Australian Privacy Principles — mandatory scheme, Commonwealth (federal). It binds australian and Norfolk Island government agencies, and organisations covered by the Act. Businesses with annual turnover of A$3 million or less are generally exempt — but not always: businesses that trade in personal information, provide health services and hold health information, or are Tax File Number recipients (among other listed exceptions) are covered regardless of turnover.
- Jurisdiction
- Commonwealth (federal)
- Record class
- Mandatory scheme
- Instrument
- Reporting
- Last verified
Where this applies
This record is scoped to Commonwealth (federal). Scope is part of the claim: a rule that binds one part of a country does not bind the whole of it, and this library states the scope its sources state.
Instrument
Privacy Act 1988 (Cth), 13 Australian Privacy Principles (APPs)
Who it binds
Australian and Norfolk Island government agencies, and organisations covered by the Act. Businesses with annual turnover of A$3 million or less are generally exempt — but not always: businesses that trade in personal information, provide health services and hold health information, or are Tax File Number recipients (among other listed exceptions) are covered regardless of turnover.
What it requires
The Privacy Act 1988 sets 13 Australian Privacy Principles that covered entities must follow, overseen by the Office of the Australian Information Commissioner (OAIC). Its Notifiable Data Breaches scheme requires a covered entity to notify affected individuals and the OAIC of a data breach likely to cause serious harm. The small-business turnover exemption has documented exceptions — turnover alone does not settle whether a business is covered.
Route to the authority
Last verified:
Related records and requirements
- Personal Information Protection and Electronic Documents Act (PIPEDA) (Canada) — PIPEDA is Canada's federal general-compliance data-protection law, binding organisations that collect, use or disclose personal information in the course of commercial activity.
- Act Respecting the Protection of Personal Information in the Private Sector (Québec) (Canada) — Québec's own private-sector privacy law is the general-compliance regime for private-sector businesses handling personal information within Québec — it takes the place of PIPEDA for that in-province activity.
- Act on the Protection of Personal Information (APPI) compliance (Japan) — APPI's general obligations (Art. 21(1) purpose notification, Art. 23 security-management measures) bind business operators handling personal information in Japan.
- Personal Data (Privacy) Ordinance compliance (Hong Kong SAR China) — Hong Kong's Cap. 486 sets six Data Protection Principles binding data users in Hong Kong, overseen by the PCPD.
- Personal data protection compliance (Vietnam) — Vietnam's Decree 13/2023 and, from 1 January 2026, Law 91/2025 bind organisations processing personal data in Vietnam to a general data-protection compliance regime.
- Federal personal data protection compliance (Mexico) — Mexico's federal private-sector data-protection law, replaced in full on 20 March 2025, binds private-sector personal-data processing nationwide.
- Personal Data Protection Law (PDPL) compliance (Saudi Arabia) — Saudi Arabia's PDPL (Royal Decree M/19) binds entities processing personal data in Saudi Arabia to a general data-protection compliance law.
- Federal personal data protection compliance (United Arab Emirates) — The UAE's federal PDPL (Federal Decree-Law No. 45 of 2021) binds organisations processing personal data inside or outside the UAE where the processing relates to the UAE — separate from DIFC's and ADGM's own free-zone regimes.
- Privacy Act 2020 — notifiable privacy breach (New Zealand) — New Zealand's Privacy Act 2020 requires notifying the Privacy Commissioner and affected individuals of a breach causing, or likely to cause, serious harm, using the Commissioner's NotifyUs tool.
- Act on the Protection of Personal Information (APPI) compliance (Japan) — APPI Art. 26 requires reporting a data breach to the Personal Information Protection Commission (PPC) and notifying the affected individual, subject to narrow statutory exceptions.
This page is for information only; it is not legal advice, and it does not establish whether this record applies to your business. Verify current status through the official source above.