The Australian Privacy Principles (APPs) are the 13 rules in the Privacy Act 1988 for how organisations collect, use, disclose, store and correct personal information. They apply to every organisation the Privacy Act covers. Most small businesses are exempt, but not all: health service providers, businesses that trade in personal information and several other types are covered whatever their size.
If you run a small business, the first question isn't what the APPs say. It's whether they apply to you, and the answer depends on what you do with customer data as much as on how big you are.
The 13 Australian Privacy Principles
| APP | What it's about |
|---|---|
| APP 1 | Managing personal information openly, including an up-to-date privacy policy |
| APP 2 | Letting people stay anonymous or use a pseudonym, with limited exceptions |
| APP 3 | When you can collect personal information you ask for, with higher standards for sensitive information |
| APP 4 | What to do with personal information you didn't ask for |
| APP 5 | Telling people certain things when you collect their information |
| APP 6 | When you can use or disclose the information you hold |
| APP 7 | Direct marketing, allowed only if certain conditions are met |
| APP 8 | Protecting information before it's sent overseas |
| APP 9 | Using government identifiers, like a tax file number, as your own |
| APP 10 | Keeping information accurate, up to date and complete |
| APP 11 | Keeping information secure, and destroying or de-identifying it when required |
| APP 12 | Giving people access to the information you hold about them |
| APP 13 | Correcting the information you hold |
The OAIC describes them as principles-based and technology neutral. They don't tell you which software to use; they set the standard and leave you to meet it in a way that fits your business. A breach of an APP is an interference with privacy and can lead to regulatory action and penalties.
Does the Privacy Act cover your small business?
Most small businesses aren't covered. The Privacy Act defines a small business by annual turnover, which for this purpose includes all income from all sources (not assets or capital gains). If your turnover has gone over the threshold in any financial year since 2002, you need to comply. The OAIC's small business page sets out the current threshold.
Regardless of turnover, the Privacy Act covers a business that is:
- a health service provider
- a contractor providing services under a Commonwealth contract
- an operator of a residential tenancy database
- a credit reporting body
- a reporting entity under the AML/CTF Act 2006
- accredited under the Consumer Data Right system
- related to a business the Privacy Act covers
- trading in personal information (see below)
- a business that has chosen to opt in
The marketing catch most small businesses miss
Trading in personal information brings you under the APPs even if you're tiny. The OAIC says a business trades in personal information when it gives a benefit, service or advantage to collect personal information, or discloses it for one. Its own example is a small business that hands its customer list to a marketing company, or swaps its list for another list.
So list swaps, co-registration deals and passing leads to a partner without consent all need a hard look. The OAIC's checklist asks whether you do it without the person's consent and without being required or authorised by law. If yes, you're covered. Consent can be express or implied, but you'll want to be able to show it.
Who counts as a health service provider
This catches more businesses than people expect. The OAIC's checklist says health services relate to physical, emotional, psychological and mental health, and lists private hospitals, day surgeries, medical practitioners, pharmacists and allied health professionals, plus complementary therapists, child care centres and private schools and tertiary institutions. If you're a therapist or coach working in that space, check this one carefully.
What being covered means in practice
If the Privacy Act covers you, you have to comply with the APPs. The OAIC is clear that this doesn't stop you handling personal information for your business needs. In practice, for most small businesses it means:
- A clear, current privacy policy on your website (APP 1). Our guide on whether you need a privacy policy on a small business website goes through what to include.
- Telling people what you collect and why, at the point you collect it (APP 5).
- Marketing only within the APP 7 conditions, with an easy way to opt out.
- Checking where your tools store data, because sending it overseas brings in APP 8.
- Securing what you hold and deleting what you no longer need (APP 11).
Some covered businesses also have extra rules on credit information and on tax file numbers, under Part IIIA of the Act and the Privacy (Tax File Number) Rule 2015.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
If someone complains
An individual can complain if they think a covered business hasn't complied. The OAIC can investigate, conciliate and, if needed, make determinations about the complaint, and it can also open an investigation on its own initiative.
AI tools are a growing blind spot here. Meeting recorders and note takers collect personal information about everyone on a call, so read our piece on AI meeting notes and privacy risk before you switch one on for client calls.
My advice
Run the OAIC's small business privacy checklist once and keep a note of the answer. Even if you're exempt, act as if APP 1, 5, 7 and 11 apply: a clear privacy policy, honest sign-up forms, easy opt-outs and secure storage take very little effort and they're exactly what customers and bigger clients look for.
Frequently asked questions
How many Australian Privacy Principles are there?
There are 13 Australian Privacy Principles. They cover collection, use and disclosure of personal information, governance and accountability, the quality and correction of information, and people's right to access it.
Do the Australian Privacy Principles apply to small businesses?
Most small businesses aren't covered by the Privacy Act, but some are regardless of turnover, including health service providers, businesses that trade in personal information, Commonwealth contractors and businesses that opt in.
What is APP 7?
APP 7 covers direct marketing. An organisation may only use or disclose personal information for direct marketing purposes if certain conditions are met.
Does swapping customer lists bring a small business under the Privacy Act?
It can. The OAIC treats giving or swapping a customer list for a benefit as trading in personal information, and a small business that does this without consent and without legal authority must comply with the APPs.
Can a small business choose to follow the Privacy Act?
Yes. A small business can opt in to be covered by the Privacy Act, and it then has to comply with the Australian Privacy Principles.
