Australian Privacy Principles (APPs)

Responsibly Managing Data to Build Stronger Trust

Eminenture streamlines its services according to Australian Privacy Principles (APPs).

Australian Privacy Principles Compliance

It was 1988 when the Australian Privacy Principles were introduced and later, they were rewritten and enforced since 1 March 2014. Eminenture strictly follows the 13 Australian Privacy Principles (APPs), setting clear requirements to collect, use, disclose, and protect personal information. Recently, it was reformed.

Recent Privacy Reforms

In the present, it is revised on 10 December, 2024, as the Privacy and Other Legislation Amendment Act 2024 (POLA), which shows some significant changes:

Notifiable Data Breaches: Strengthens statutory requirements that report eligible data breaches.
Doxxing offences (Criminal Code ss 474.17C/D): Refer to new criminal offences introduced on 11 December 2024.
Privacy tort: Enforced on 10 June 2025, defining new rights of action against serious invasion of privacy commenced.
First applications: The first published applications under the new privacy tort appeared in June 2026.
OAIC Power: Strengthened OAIC underlines infringement notices of up to AUD66,000 per violation for administrative breaches.
Transparency Obligation: Automated decision-making transparency obligation (new APP 1.7) enforced on 10 December 2026.
Children Online Privacy Code: A mandate for the OAIC is also about to launch to report and register a Children’s Online Privacy Code by 10 December 2026.

Who Is Covered?

The Privacy Act applies to companies, sole traders, partnerships, trusts, and unincorporated bodies that gather or store personal information for corporate purposes. Overseas entities, including their branch or agency, leveraging the personal information for commercial purposes in Australia are also covered under it.

Current exemptions—and their fine print:

SMEs with a turnover of ≤ A$3 million are still exempt. But they shall be removed according to reform direction (second tranche, 2026–2027). Not even small businesses are exempt if they commercialize personal information or use it for commercial purposes (e.g., data brokers/marketers), provide private health services, contract with the Commonwealth, or work like a credit reporting body.
Employee personal records of small businesses, though they are proposed reforms, not yet enacted.
Certain state/territory government agencies (covered by their own laws) and some specific activities

We collect the personal information of Australians or people in Australia, which covers us under the APPs. The Act follows the business relationship, not the server location.

The 13 Australian Privacy Principles

APP	Principle Name	Core Obligation
1	Collection	Allow to collect only reasonable and necessary personal information for a purpose or activity.
2	Anonymity and pseudonymity	Maintain the anonymity of a person where practicable.
3	Sensitive information	Gather information only where it is consented to, permitted by law, or a legitimate expectation.
4	Third-party collection	Reveal the source of the information.
5	Notification at collection	Must-have a privacy policy and a notice stating what, why, where it is used, and how to complain.
6	Use and disclosure	Used only for the primary purpose or a related secondary purpose.
7	Direct marketing	Respect individuals’ requests to stop if they make.
8	Cross-border disclosure	Account to overseas recipients’ data management (mirroring the overseas law where it differs).
9	Quality	Make every possible way to maintain accurate, complete, and fresh details and fix if incorrect.
10	Security	Take reasonable steps to protect against misuse, loss, and unauthorised access, disclosure, or modification.
11	Access	Respond to access data requests, whether to provide or avoid explaining why not.
12	Correction	Fix inaccurate details when requested.
13	Identifiers	The Australian Privacy Number must not be used or disclosed (restricted identifiers).

APP 1.7 mandates organisations to state legal or significant effects when the decision is made solely on automated processing.

How Eminenture Helps

APP applicability & gap assessment: Analyse cross-border and small business exemptions with reform-tranche readiness.
Privacy program build-out: Protect confidentiality via privacy policy, collection notices, APP 6 secondary-purpose analysis, and direct-marketing opt-out management.
Breach readiness: Prepare to inform about the breach via the NDB investigation playbook, 30-day assessment workflow, OAIC and individual notification templates, and tabletop exercises.
Cross-border data flows (APP 8): Analyse recipients, contractual accountability, and overseas-law gap.
Access & correction operations (APP 11/12): Launch cleansing, verification, and respond SLAs, logging.
Automated decision-making (APP 1.7): Showcase the inventory of automated decisions and the 10 December 2026 disclosure design.
Statutory tort & doxxing risk: Assess board-level risks for the new private rights of action.
International clients selling into Australia: Evaluate whether the existing GDPR/DPDP/CCPA programme meets the APPs requirements. If there is any gap, we fill it.