Privacy Act 1988 / NDB

Who it applies to

Australian Government agencies and organisations with annual turnover above AUD 3 million, plus some smaller businesses such as health service providers and credit reporting bodies.

Key requirements

• Comply with the 13 Australian Privacy Principles, covering open handling, collection, use, disclosure, quality, security, access and correction.
• Take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access (APP 11).
• Assess suspected eligible data breaches promptly.
• Notify the OAIC and affected individuals of eligible data breaches.
• Take care with cross-border disclosure (APP 8).

Breach and incident notification

An eligible data breach (one likely to result in serious harm) is notified to the OAIC and affected individuals as soon as practicable. A suspected breach must be assessed within 30 days.

Penalties

For serious or repeated interferences with privacy, a body corporate can face the greater of AUD 50 million, three times the benefit obtained, or 30% of adjusted turnover for the relevant period.

Go deeper