Organizations may not collect personal information unless the information is reasonably necessary for one or more of its business functions or activities.

Under the Privacy Act, organizations must take reasonable steps to ensure that personal information collected is accurate and up-to-date.

At or before the time organizations collect personal information, or as soon as practicable afterwards, they must take reasonable steps to provide individuals with notice of:

• The organization’s identity and contact information;

• Why it is collecting (or how it will use the) information about the individual;

• The entities or types of entities to which it might give the personal information;

• Any law requiring the collection of personal information;

• The main consequences (if any) for the individual if all or part of the information is not provided;

• The fact that the organization’s privacy policy contains information about how the individual may access and seek correction of their personal information, how they may make a complaint about a breach of the APPs and how the organization will deal with such complaint; and

• Whether the organization is likely to disclose their personal information to overseas recipients and, if so, the countries in which such recipients are likely to be located (if it is practicable to specify those countries in the notification or to otherwise make the individual aware of them).

Organizations should comply with these notification requirements by preparing a “collection statement” or “privacy notice” for each significant collection of personal information, and providing this to individuals  prior to collecting their personal information.

This notification requirement applies in addition to the requirement for organisations to maintain a broader privacy policy, which details the general personal information handling processes of the organisation. APP 1 lists the information which is required to be included in a privacy policy.

In practice, a major Privacy Act compliance issue often arises because organizations fail to recognize that the mandatory notice requirements outlined above also apply to any personal information collected from a third party. Organizations must provide individuals with required notice on receipt of personal information from a third party, even though they did not collect personal information directly from the individual. Unlike Europe, Australian privacy law does not distinguish between "data processors" and "data controllers".

Organizations must not use or disclose personal information about an individual unless one or more of the following applies:

• The personal information was collected for that purpose (the primary purpose) or a different (secondary) purpose which is related to (and, in the case of sensitive information, directly related to) the primary purpose of collection and the individual would reasonably expect the organization to use or disclose the information for that secondary purpose;
• The individual consents;
• A "permitted general situation" or "permitted health situation" exists; for example, the entity has reason to suspect that unlawful activity relating to the entity's functions has been engaged in, or there is a serious threat to the health and safety of an individual or the public; or
• It is required or authorized by law or on behalf of an enforcement agency.

In the case of use and disclosure for the purpose of direct marketing, organizations are required to ensure that:

• The information used is not sensitive information; 
• Either the individual has consented or would reasonably expect the organisation to use or disclose the information for direct marketing, or it is impracticable to seek the individual’s consent, and (among other things) the individual is told that they can opt out of receiving marketing from the organization;
• Each direct marketing communication includes a simple means by which the individual can opt out; and

• The individual has not previously requested to opt out of receiving direct marketing communications.

The above direct marketing requirements apply to all forms of direct marketing. Additionally, specific requirements for commercial electronic messaging are outlined in Electronic Marketing.

If an organization plans to use personal information in wholly or substantially automated decision making that could reasonably be expected to significantly affect the rights or interests of an individual, from late 2026 onwards, the organization must include details of the use of automated decision making in its privacy policy.

The Privacy Act affords additional protections when processing involves sensitive information. Organizations are prohibited from collecting sensitive information from an individual unless certain limited requirements are met, including one or more of the following:

• The individual has consented to the collection and the collection of the sensitive information is reasonably necessary for one or more of the entity's functions or activities;
• Collection is required or authorized by law or a court / tribunal order;
• A "permitted general situation" or "permitted health situation" exists; for example, the entity has reason to suspect that unlawful activity relating to the entity's functions has been engaged in, or there is a serious threat to the health and safety of an individual or the public;
• The entity is an enforcement body and the collection is reasonably necessary for that entity's functions or activities; and
• The entity is a nonprofit organization and the information relates to the activities of the organization and solely to the members of the organization (or to individuals who have regular contact with the organization relating to its activities).

Organizations must provide individuals with access to their personal information held by the organization upon an individual’s request. Additionally, individuals have a right to correct inaccurate, out-of-date, and irrelevant personal information held by an organization. Under certain circumstances, the organization may limit the extent to which it provides an individual with access or correction rights, including in emergency situations, specified business imperatives, and law enforcement or other public interests.

Further, organizations must provide individuals with the option to not identify themselves, or use a pseudonym, when dealing with the organization, unless it is impractical to do so or the organization is required or authorized by law to deal with identified individuals.