Processes personal data, in Australia
Each law's tag says when it binds: since in force proposed proposed
Australian Consumer Law ss. 18, 29 and 34, Misleading Conduct and Representations as Applied to Data Practices and Rankingssince 3 lines
Competition and Consumer Act 2010 (Cth), Schedule 2 (Australian Consumer Law), ss 18, 29 and 34 · Read the law's page
- Do not, in trade or commerce, engage in conduct that is misleading or deceptive or is likely to mislead or deceive (section 18(1)).
- Do not, in trade or commerce and in connection with supplying or promoting goods or services, make a false or misleading representation that they have particular performance characteristics, uses or benefits (section 29(1)(g)).
- Do not, in trade or commerce, engage in conduct that is liable to mislead the public as to the nature, the characteristics, the suitability for their purpose or the quantity of any services (section 34).
My Health Records Act 2012 (Cth), Unauthorized Collection, Use and Disclosure of My Health Record Informationsince 1 line
My Health Records Act 2012 (Cth), No. 63, 2012, ss. 59 and 73 · Read the law's page
- Do not collect health information from the My Health Record system, or use or disclose health information obtained through it, where the act is not authorised under Division 2 of Part 4 and you know or are reckless as to that fact (section 59).
Privacy Act 1988 (Cth), Australian Privacy Principlessince 2 lines
Privacy Act 1988 (Cth), No. 119, 1988, ss. 5B, 6, 6D, 13, 14, 15 and Schedule 1 · Read the law's page
- Comply with the Australian Privacy Principles in Schedule 1 to the Privacy Act 1988 for any personal information about an individual, if the entity is an Australian Government agency or an organisation with an annual turnover over $3,000,000.
- Comply with the Australian Privacy Principles for an act done, or a practice engaged in, outside Australia if the entity has an Australian link.
Privacy Act 1988 (Cth), Schedule 1, sensitive information categoriessince 1 line
Privacy Act 1988 (Cth), Schedule 1, Australian Privacy Principle 3, read with s. 6 · Read the law's page
- Do not collect sensitive information about an individual, including biometric information used for automated biometric verification or identification, or a biometric template, unless the individual consents and the collection is reasonably necessary for the entity's functions, or a listed exception in Australian Privacy Principle 3.4 applies.
Privacy Act 1988 (Cth), Notifiable Data Breaches Schemesince 2 lines
Privacy Act 1988 (Cth), Part IIIC, ss. 26WE, 26WK, 26WL · Read the law's page
- Prepare a statement about an eligible data breach and give a copy to the Information Commissioner as soon as practicable after becoming aware of reasonable grounds to believe the breach happened.
- Notify the contents of that statement to each individual to whom the relevant information relates, or to each individual at risk, or, if neither is practicable, publish the statement on the entity's website and take reasonable steps to publicise it.
Competition and Consumer Act 2010 (Cth), Consumer Data Right: Disclosure, Deletion and Correction of CDR Datasince 3 lines
Competition and Consumer Act 2010 (Cth), Part IVD, ss. 56BAA, 56BC, 56EP and 56EV, Consumer Data Right · Read the law's page
- Disclose CDR data to a CDR consumer, or to an accredited person, in response to the consumer's valid request, where the consumer data rules require the disclosure (section 56BC(1)).
- As an accredited data recipient, delete CDR data when a CDR consumer validly requests it, as the consumer data rules must require, unless an Australian law or a court or tribunal order requires the data to be kept (section 56BAA).
- Respond to a CDR consumer's request to correct CDR data by taking the steps the consumer data rules specify, which cover correcting the data or including a statement with it, and giving notice (section 56EP).
Privacy Act 1988 (Cth), Civil Penalties for Serious Interference with Privacysince 1 line
Privacy Act 1988 (Cth), No. 119, 1988, s. 13G, as amended by the Privacy Legislation Amendment (Enforcement and Other Measures) Act 2022, No. 83, 2022 · Read the law's page
- Do not do an act, or engage in a practice, that is a serious interference with the privacy of an individual.
Privacy Act 1988 (Cth), Civil Penalty for Interference with Privacysince 1 line
Privacy Act 1988 (Cth), No. 119, 1988, s. 13H, inserted by the Privacy and Other Legislation Amendment Act 2024, No. 128, 2024 · Read the law's page
- Do not do an act, or engage in a practice, that is an interference with the privacy of an individual.
Privacy Act 1988 (Cth), Schedule 2, Statutory Tort for Serious Invasions of Privacysince 1 line
Privacy and Other Legislation Amendment Act 2024 (Cth), No. 128, 2024, Schedule 2, inserting Schedule 2 to the Privacy Act 1988 · Read the law's page
- An individual may sue for damages or an injunction for a serious invasion of privacy by intrusion upon seclusion or misuse of information, subject to the exemptions in Part 3 of Schedule 2 (including for journalism).
Privacy Amendment (Personal Data Protection) Bill 2026 (exposure draft)proposed4 lines
Exposure Draft, Privacy Amendment (Personal Data Protection) Bill 2026 (Cth), amending the Privacy Act 1988, released for consultation by the Attorney-General's Department on · Read the law's page
- Collect, use or disclose personal information only where doing so is fair and reasonable in the circumstances and lawful (draft Australian Privacy Principle 3).
- If you become aware of reasonable grounds to believe that an eligible data breach of your entity has occurred, give the Commissioner a statement within 72 hours (draft section 26WK).
- Provide a simple means of requesting not to receive direct marketing communications before making one, and give effect to such a request (draft Australian Privacy Principle 7).
- If you are an organisation that is a large digital platform, destroy an individual's personal information on request, subject to listed exceptions (draft Australian Privacy Principle 14).