Organisations may not collect personal information unless the information is reasonably necessary for one or more of its business functions or activities.

Under the Privacy Act, organisations must take reasonable steps to ensure that personal information collected is accurate, up-to-date, complete and relevant.

At or before the time organisations collect personal information, or as soon as practicable afterwards, they must take reasonable steps to provide individuals with notice of:

• The organisation’s identity and contact information;
• Why it is collecting (or how it will use the) information about the individual;
• The entities or types of entities to which it might give the personal information;
• Any law requiring the collection of personal information;
• The main consequences (if any) for the individual if all or part of the information is not provided;
• The fact that the organisation’s privacy policy contains information about how the individual may access and seek correction of their personal information, how they may make a complaint about a breach of the APPs and how the organisation will deal with such complaint; and
• Whether the organisation is likely to disclose their personal information to overseas recipients and, if so, the countries in which such recipients are likely to be located (if it is practicable to specify those countries in the notification or to otherwise make the individual aware of them).

Organisations should comply with these notification requirements by preparing a “collection statement” or “privacy notice” for each significant collection of personal information, and providing this to individuals prior to collecting their personal information.

This notification requirement applies in addition to the requirement for organisations to maintain a broader privacy policy, which details the general personal information handling processes of the organisation. APP 1 lists the information which is required to be included in a privacy policy.

In practice, a major Privacy Act compliance issue often arises because organisations fail to recognise that the mandatory notice requirements outlined above also apply to any personal information collected from a third party. Organisations must provide individuals with required notice on receipt of personal information from a third party, even though they did not collect personal information directly from the individual. Unlike Europe, Australian privacy law does not distinguish between "data processors" and "data controllers".

Organisations must not use or disclose personal information about an individual unless an appropriate legal basis applies, which includes where:

• The personal information was collected for that purpose (the primary purpose) or a different (secondary) purpose which is related to (and, in the case of sensitive information, directly related to) the primary purpose of collection, and the individual would reasonably expect the organisation to use or disclose the information for that secondary purpose;
• The individual consents;
• A "permitted general situation" or "permitted health situation" exists; for example, the entity has reason to suspect that unlawful activity relating to the entity's functions has been engaged in, or there is a serious threat to the health and safety of an individual or the public; or
• It is required or authorised by law or on behalf of an enforcement agency.

In the case of use and disclosure for the purpose of direct marketing, organisations are required to ensure that:

• The information used is not sensitive information;
• Either the individual has consented or would reasonably expect the organisation to use or disclose the information for direct marketing, or it is impracticable to seek the individual’s consent, and (among other things) the individual is told that they can opt out of receiving marketing from the organisation;
• Each direct marketing communication includes a simple means by which the individual can opt out; and
• The individual has not previously requested to opt out of receiving direct marketing communications.

The above direct marketing requirements apply to direct marketing other than electronic marketing (which includes marketing content delivered via email and SMS). The requirements for commercial electronic messaging are outlined in Electronic Marketing.

If an organisation plans to use personal information in wholly or substantially automated decision making that could reasonably be expected to significantly affect the rights or interests of an individual, from 10 December 2026 onwards, the organisation must include details of the use of automated decision making in its privacy policy.

The Privacy Act affords additional protections when processing involves sensitive information. Organisations are prohibited from collecting sensitive information from an individual unless certain limited requirements are met, including one or more of the following:

• The individual has consented to the collection, and the collection of the sensitive information is reasonably necessary for one or more of the entity's functions or activities;
• Collection is required or authorised by Australian law or a court / tribunal order;
• A "permitted general situation" or "permitted health situation" exists; for example, the entity has reason to suspect that unlawful activity relating to the entity's functions has been engaged in, or there is a serious threat to the health and safety of an individual or the public;
• The entity is an enforcement body and the collection is reasonably necessary for that entity's functions or activities; and
• The entity is a nonprofit organisation and the information relates to the activities of the organisation and solely to the members of the organisation (or to individuals who have regular contact with the organisation relating to its activities).

Organisations must provide individuals with access to their personal information held by the organisation upon an individual’s request. Additionally, individuals have a right to correct inaccurate, out-of-date, and irrelevant personal information held by an organisation.

Organisations may refuse to comply with access or correction request from individuals in certain prescribed circumstances, which differ depending upon the type of request in question.

Further, organisations must provide individuals with the option to not identify themselves, or use a pseudonym, when dealing with the organisation, unless it is impractical to do so or the organisation is required or authorised by law to deal with identified individuals.