Guide
Glossary
Australian Privacy Principles (APPs)
The Australian Privacy Principles (APPs) are the 13 legally binding rules in the Privacy Act 1988 that govern how covered organisations collect, use, disclose, secure and correct personal information. They apply to Australian Government agencies, to businesses and not-for-profits with annual turnover above $3 million, and to some smaller businesses, such as health service providers. The APPs are technology-neutral, so they apply to AI tools just as they do to email or a document system: the OAIC says privacy obligations cover personal information entered into an AI system and any AI output that contains it. From 10 December 2026, APP 1 also requires privacy policies to explain certain automated decisions that use personal information.
Also called APPs
Last updated:
Example
In a law firm
A 30-person family law firm wants staff to summarise affidavits with an AI tool. Before rollout, the practice manager checks the vendor against the APPs: whether sending client details to it fits the purpose they were collected for (APP 6), where the data is stored (APP 8) and what security applies (APP 11). The firm then updates its privacy policy to mention the tool (APP 1).
Does the Privacy Act cover smaller firms?
Usually not if annual turnover is $3 million or less, but some exceptions matter to professional firms. A small firm that is a reporting entity under the AML/CTF Act must follow the Privacy Act for its AML/CTF activities, and since 1 July 2026 that includes lawyers, accountants and conveyancers who provide certain designated services. Any business that holds tax file numbers must also protect them under the Privacy (Tax File Number) Rule 2015. Removing the small business exemption has been agreed in principle but, as at September 2026, not legislated. The OAIC publishes the full text of the APPs and its guidance on using commercially available AI products.
Guides that explain it in context
Secure by design. Set up correctly. Fully managed.
Talk to us before you commit to anything
Start with a free 45-minute discovery call. We look at your systems and priorities, then recommend a first step with a fixed scope, or tell you if we are not the right fit.