What Is Privacy Act 1988 (Cth) + Australian Privacy Principles?
The Privacy Act 1988 (Cth) is Australia's federal data protection law, governing how Commonwealth agencies and private-sector organizations handle personal information. The law is built around 13 Australian Privacy Principles (APPs), which set baseline standards for collection, use, disclosure, security, access, and correction. The Privacy Legislation Amendment (Enforcement and Other Measures) Act 2022 increased the maximum civil penalties for serious or repeated privacy interferences. The Privacy and Other Legislation Amendment Act 2024 made further changes, including a statutory tort for serious invasions of privacy; the OAIC states that the tort commenced on 10 June 2025. Other reforms and commencement dates are provision-specific, so check the current legislation and OAIC guidance for the issue being assessed. The Office of the Australian Information Commissioner (OAIC) supervises compliance, with powers to investigate, issue determinations, apply to the Federal Court for civil penalties, and enter enforceable undertakings. The 2022 Optus and Medibank breaches influenced the reform debate, but the legal effect of any current proceeding or amendment should be checked against the latest official source.
At a glance
- Full name
- Privacy Act 1988 (Cth) + Australian Privacy Principles
- Short code
- Privacy Act 1988
- Jurisdiction
- Australia
- Enacted
- 1988
- Last major update
- Privacy Legislation Amendment (Enforcement and Other Measures) Act 2022; statutory tort commenced 10 June 2025 under the Privacy and Other Legislation Amendment Act 2024
- Regulator
- Office of the Australian Information Commissioner (OAIC)
- Private right of action
- Limited
- Statutory citation
- Privacy Act 1988 (Cth)
International privacy-law explainer timeline
Enacted years are counted by decade from the published explainer dataset; the table lists the laws in each decade.
- Decade containing a highlighted explainer
- Other decades
195
Planning jurisdictions
167
Published law explainers
92
Partial official reviews
The ledger coverage split is 195 planning jurisdictions, 167 published law explainers, and 92 partial official reviews. 4 of 167 explainers lack an enacted year, so they are omitted from the decade counts.
Show the data as a table
| Decade | Explainers with an enacted year | Laws (short codes) |
|---|---|---|
| 1970s | 1 | Loi Informatique et Libertés |
| 1980s | 2 | Privacy Act 1988 (highlighted), Privacy Law 5741-1981 |
| 1990s | 2 | DSG, Constitution Article 28 |
| 2000s | 15 | PIPEDA, APPI, Law 25.326, Law on Personal Data Protection, Law 09-08, 152-FZ, Law No. 2008-12, Organic Law No. 2004-63, PDPA, DPA 2003, Art. 21(2), 25, 130–131 + Law 254, Lei n.º 133/V/2001, Uruguay Ley 18.331, Iran Electronic Commerce Act 2003, Saint Vincent and the Grenadines Privacy Act No. 18 of 2003 |
| 2010s | 81 | UK GDPR, LGPD, BDSG, RA 10173, POPIA, Malaysia PDPA, Korea PIPA, UAVG, PECA + Art. 14, Law 29733, Thai PDPA, KVKK, Poland GDPR + UODO Act, Portugal GDPR + Lei 58/2019, Romania GDPR + Law 190/2018, Law 1581, Law No. 94-V, HO-49-N, Law 998-IIIQ, Info tv. + GDPR, Act No. 90/2018 + GDPR, Data Protection Act 2019, PDL, Law of 1 August 2018, Chapter 586, IKS, Act 843, Law 4624/2019, Law 87/2018, Act No. 18/2018 Coll., Law No. 2297-VI, Act on the Implementation of the GDPR, Law 125(I)/2018, Act No. 110/2019 Coll., Belgian Data Protection Act, Databeskyttelsesloven, Data Protection Act 1050/2018, Personal Data Act, Sectoral Privacy Protections, Law No. 18-07 + Law No. 25-11, Law No. 22/11, Data Protection Act 2013, Law No. 30 of 2018, Data Protection Act 2019-29, Code du numérique, Book V, ICM Act 2018 + NDGF 2025, Fragmented privacy framework, Ley 8968, Ley 172-13, GDPR + Data Protection Act, Mali Law 2013-015, Mauritania Law 2017-020, Mauritius DPA 2017, Nepal Privacy Act 2075, Panama Ley 81/2019, Qatar Law No. 13 of 2016, Saint Lucia DPA 2011, Togo Law 2019-014, Turkmenistan Law 519-V, Chad Law 007/PR/2015, Congo Law 29-2019, Côte d'Ivoire Law 2013-450, Equatorial Guinea Law 1/2016, Fiji Privacy Framework, Guinea Law L/2016/037/AN, Haiti 2018 Data Privacy Order, Lao Law 25/NA, Lebanon Law 81/2018, Lesotho Data Protection Act 2011, Madagascar Law 2014-038, Myanmar Privacy and Security Law, Nicaragua Law No. 787, Saint Kitts and Nevis DPA No. 5 of 2018, San Marino Law No. 171/2018, Lei n.º 03/2016, Law No. 1537, Trinidad and Tobago DPA 2011, Uganda DPA 2019, U.S. Privacy Law, Law No. O‘RQ-547, Law No. 13 of 2012 |
| 2020s | 62 | DPDP Act, PIPL, UAE PDPL, NDPA, PDPL, Law No. 91/2025, Act No. 63 of 2026, Law 21.719, Law No. 151 of 2020, UU PDP, LFPDPPP (2025), Law 124/2024, Law 12/25, Data Protection Act 2020, Digital Code, Law no. 195/2024, Law on Personal Data Protection, Law No. 3144, Law 42/2020, ZVOP-2, PDPA, LQPD, Law No. 99-Z, Data Protection Act 2021, Data Protection Act 2024, PDPO 2025, Loi n°001-2021/AN, Law No. 1/03 of 2026, Law No. 2024/017, Law No. 24.001, LOPDP, LPDP, Malawi DPA 2024, Monaco Law 1.565, Oman PDPL, Paraguay Law 7593/2025, Rwanda Law 058/2021, Tanzania PDPA 2022, Vanuatu DPPA 2024, Zimbabwe Cyber and Data Protection Act, Cuba Law 149/2022, DPRK Information Law materials, DRC Digital Code 2023, Djibouti Digital Code 2025, Eswatini Data Protection Act 2022, Ethiopia Proclamation No. 1321/2024, Gabon Law 025/2023, Grenada Data Protection Act 2023, Guyana Data Protection Act 2023, Jordan Personal Data Protection Law No. 24 of 2023, Kiribati Data Protection Act 2025, Kuwait CITRA Decision 2024/26, Libya Law No. 6 of 2022, Liechtenstein DSG 2026, Marshall Islands PDPA 2025, Niger Law No. 2022-59, Seychelles Data Protection Act 2023, Somalia Data Protection Act 2023, Law No. 12 of 2024, Privacy Act 2025, Zambia Data Protection Act 2021, Decree DCLVII |
Sources: Privacy Act 1988 statutory citation · OfflistMe jurisdiction research ledger · Checked international explainers 2026-10-12; coverage ledger 2026-10-12
Scope, who Privacy Act 1988 covers
Continue with related privacy resources
Follow the route that matches your next question. Each link stays within a documented topic cluster and points to a canonical content page.
Protected data
Data subject rights
Right to know what personal information is collected and how it will be used (APP 1, 5. Privacy Notice)
Right to access personal information held (APP 12)
Right to correct personal information (APP 13)
Right to anonymity and pseudonymity where practicable (APP 2)
Right to opt out of direct marketing (APP 7)
Right to complain to the OAIC
Right to sue under the statutory tort for serious invasions of privacy (2024 amendment; in force since 2025)
Notable features
The 2022 Optus and Medibank breaches influenced the Privacy Act reform debate. The 2024 amendments added a statutory tort for serious invasions of privacy, and Australia also has a Notifiable Data Breaches scheme that has applied since February 2018 with harm thresholds and timing requirements.
Enforcement & penalties
Regulator: Office of the Australian Information Commissioner (OAIC)
Penalties: Maximum civil penalties (2022 amendments) for serious or repeated interferences with privacy: the greatest of AUD 50 million; three times the value of the benefit obtained; or 30% of the entity's adjusted turnover in the relevant period. The OAIC can also issue infringement notices (administrative fines) for less serious contraventions and enter enforceable undertakings.
Private right of action: Historically, Privacy Act complaints went through OAIC determinations with limited individual damages. The Privacy and Other Legislation Amendment Act 2024 introduced a statutory tort for serious invasions of privacy, which commenced on 10 June 2025. It creates a direct cause of action for an individual against a defendant for an intentional or reckless serious invasion, subject to the statutory elements and public-interest balancing. The tort is distinct from an OAIC complaint, so review the current legislation and obtain legal advice for a proposed claim.
Relevance to data brokers
The Privacy Act may apply to data brokers that are APP entities, including organizations covered because they trade in personal information or fall within another statutory category. A broker should assess turnover, activities, exemptions, and the current Act rather than rely on a single threshold. The statutory tort is a separate court route and is not an OAIC complaint or a conclusion that a particular broker is liable.
Generate requests in under 60 seconds
Explore 1,034 US/global data brokers
FAQ
What are the 13 Australian Privacy Principles (APPs)?+
The 13 APPs under Schedule 1 of the Privacy Act 1988 govern open and transparent management (APP 1), anonymity (APP 2), collection of solicited data (APP 3), unsolicited data (APP 4), notification of collection (APP 5), use and disclosure (APP 6), direct marketing (APP 7), cross-border disclosure (APP 8), government identifiers (APP 9), quality (APP 10), security (APP 11), access (APP 12), and correction (APP 13).
Do small businesses need to comply with the Privacy Act?+
Most small businesses (annual turnover under AUD 3M) are exempt from the Privacy Act, a significant gap criticized by consumer groups. However, certain small businesses are still covered: health service providers, organizations that trade in personal information (including many data brokers), credit reporting bodies, and contracted service providers to the Commonwealth.
What is the Notifiable Data Breaches scheme?+
Since February 2018, APP entities must notify affected individuals and the OAIC when a data breach is likely to result in serious harm. Notification must happen as soon as practicable after the entity becomes aware of the eligible breach; there is no universal 30-day notification deadline.
How do I file an OAIC complaint?+
Submit online at oaic.gov.au/privacy/privacy-complaints. The OAIC expects you to first complain directly to the APP entity and give them 30 days to respond. If unresolved, you can escalate to the OAIC, which can investigate, issue determinations, and apply to court for civil penalties.
What is the 'right to privacy' tort in the 2024 amendment?+
The Privacy and Other Legislation Amendment Act 2024 created a statutory tort for serious invasions of privacy. The OAIC states that it commenced on 10 June 2025. The tort has statutory elements, including seriousness, intent or recklessness, and public-interest balancing; it is separate from the OAIC complaint process, so check the current Act and obtain legal advice before relying on it.
Official sources & citations
Other international privacy regimes
Privacy Act 1988 sits in a global ecosystem of data-protection laws. Start with these comparative frameworks, or visit the privacy research hub for the complete jurisdiction index: