Loading
Australia's Privacy Act 1988 and the 13 Australian Privacy Principles govern how personal information is collected, used, and disclosed, including by AI systems.
The Privacy Act 1988 is Australia's primary legislation governing personal information. It applies to Australian Government agencies and private sector organisations with annual turnover above $3 million, plus specific smaller organisations in health, credit, and other regulated contexts.
The 13 Australian Privacy Principles (APPs) in Schedule 1 govern the entire lifecycle of personal information, from collection through to access, correction, and disposal. For AI, the most significant APPs concern collection limits, notification, secondary use, security, and access rights.
Biometric data, facial images used for recognition, voice patterns, fingerprints, is sensitive information under the Privacy Act and attracts higher obligations. Collection of sensitive information generally requires consent, and use is more narrowly constrained. Facial recognition, voice analysis, and emotion detection AI must address this higher standard.
The Office of the Australian Information Commissioner (OAIC) enforces the Privacy Act. It can accept complaints, conduct investigations, make determinations, and apply to the Federal Court for civil penalties. The OAIC's 2021 determination against Clearview AI, with the Privacy Act's extraterritorial jurisdiction over overseas companies collecting data about Australians subsequently confirmed by the Administrative Appeals Tribunal on appeal in 2023, established this precedent.
The Privacy and Other Legislation Amendment Act 2024 strengthened OAIC enforcement powers, introduced a statutory tort for serious invasions of privacy (in force since 10 June 2025), and created new automated decision-making transparency obligations commencing 10 December 2026. A further reform tranche, potentially removing the small business exemption and adding more APP changes, remains under government consideration as of mid-2026.
This page is general information about Australia's Privacy Act and the Australian Privacy Principles, not legal advice, and does not capture every nuance or exception. Requirements change and can be fact-specific. Always verify against the OAIC's own guidance and your own qualified legal counsel before relying on it.