In an age where data is currency, the collection and handling of personal information is heavily regulated. Whether you’re a sole trader, a growing SME, or an established company, failing to comply with Australian privacy law can result in substantial penalties, lawsuits, and loss of trust.
Privacy compliance is no longer just an IT or legal issue—it is a core business risk.
The Legal Framework
The Privacy Act 1988 (Cth) is Australia’s primary privacy legislation. It regulates how personal information is collected, stored, used, and disclosed by:
- Commonwealth government agencies,
- Private organisations with an annual turnover of more than $3 million,
- Some small businesses, including health providers, credit reporting bodies, and businesses that buy/sell personal information.
The Australian Privacy Principles (APPs) are central to the Act and apply to all regulated entities. Other applicable laws include:
- Spam Act 2003 (Cth) – regulates unsolicited marketing emails and SMS.
- Notifiable Data Breaches (NDB) scheme – requires notification of certain data breaches.
- State and territory-specific laws – apply to public sector entities and health records (e.g. Information Privacy Act 2009 (Qld)).
The Australian Privacy Principles (APPs): A Brief Overview
The APPs establish minimum standards for handling personal information. There are 13 principles, which include the following (which are summarised):
- Open and Transparent Management – Entities must manage personal information in a clear and open way and have a compliant privacy policy.
- Anonymity and Pseudonymity – Individuals must have the option to not identify themselves where practicable.
- Collection of Solicited Information – Only collect personal information necessary for your business functions, and by lawful and fair means.
- Dealing with Unsolicited Information – Take reasonable steps to destroy or de-identify unsolicited personal information if not required.
- Notification of Collection – Inform individuals when their personal information is collected, including why it is being collected.
- Use or Disclosure – Use or disclose information only for the purpose it was collected (or a directly related secondary purpose).
- Direct Marketing – Must have consent or a clear opt-out, and comply with other relevant laws such as the Spam Act.
- Cross-border Disclosure – Before disclosing to overseas entities, you must ensure they will handle it in accordance with the APPs.
- Adoption, Use or Disclosure of Government Identifiers – Limits use of TFNs and similar identifiers.
- Quality of Personal Information – Ensure the data collected is accurate, complete and up to date.
- Security of Personal Information – Take reasonable steps to protect information from misuse, interference, and loss.
- Access to Personal Information – Individuals have the right to access their information upon request.
- Correction of Personal Information – Entities must correct inaccurate or outdated information on request.
Why this matters: These principles are legally enforceable. A breach of any one of them can trigger regulatory investigations, financial penalties, or lawsuits.
What Are the Penalties for Non-Compliance?
1. Regulatory Penalties by the OAIC
The Office of the Australian Information Commissioner (OAIC) enforces the Privacy Act and has broad powers to:
- Investigate complaints and conduct own-motion investigations,
- Issue enforceable determinations,
- Require an entity to apologise or take corrective action,
- Accept enforceable undertakings,
- Seek civil penalties from the Federal Court.
Current Maximum Penalties (as of 2024):
- For serious or repeated interferences with privacy:
- Up to $2.5 million for individuals;
- Up to $50 million, or three times the benefit gained, or 30% of adjusted turnover (whichever is greater) for corporations.
These maximums were significantly increased under reforms passed in late 2022 and are likely to be strengthened further in the upcoming 2025 Privacy Act overhaul.
2. Mandatory Breach Notification Failures
Failing to comply with the Notifiable Data Breaches (NDB) scheme – by not reporting eligible data breaches – can result in additional enforcement action and significant reputational damage. Eligible breaches are those likely to result in serious harm to individuals (e.g. identity theft, financial loss, unauthorised access).
Civil Liability: Can You Be Sued?
Yes. Privacy breaches can expose businesses to civil litigation, including:
- Representative actions (class actions) following large-scale data breaches (e.g. recent actions against Optus and Medibank).
- Negligence or breach of contract claims – particularly if a business has failed to implement adequate security measures or breached its own privacy policy.
- Claims under the Australian Consumer Law, especially where businesses mislead customers about how their data is handled.
The courts are increasingly willing to recognise loss of control over personal data or emotional distress as compensable harm in privacy-related cases.
Common Privacy Compliance Failures
- No or outdated privacy policy
- Collecting more personal data than is necessary
- Failing to obtain valid consent for data collection or marketing
- Insecure data storage and poor access controls
- Not having a data breach response plan
- Using third-party providers (e.g. overseas cloud services) without proper safeguards
Third-Party Contractors and IT Providers
Many businesses engage external contractors, IT consultants, or cloud software providers who access or manage personal information. It’s critical to ensure that these third parties are bound by contractual obligations that reflect the Australian Privacy Principles and broader legal requirements. This includes clauses requiring compliance, confidentiality, data security measures, and clear liability for any breaches they cause (with no liability cap clauses). If a contractor mishandles personal data, your business may still be held responsible, making due diligence and enforceable agreements essential. Contact us to review key agreements and arrangements where you are passing your data to a contractor.
Why this matters: One oversight can become a serious liability. Privacy compliance must be active and ongoing – not a set-and-forget task.
Key Recommendations for Businesses for Privacy Matters
- Audit Your Data Practices
Know what personal information you collect, why, how it’s stored, who can access it, and where it’s disclosed. Seeking advice about how to do this in an effective way from a lawyer and IT experts is a good idea. - Update Your Privacy Policy
Ensure your policy is APP-compliant, publicly available, and reflects current practices. - Implement Robust Security Measures
This includes encryption, access controls, staff training, and regular penetration testing. - Train Your Staff
Everyone handling personal information should understand your obligations and how to identify a potential breach. - Establish a Breach Response Plan
Have a documented strategy for assessing, responding to, and notifying data breaches under the NDB scheme. - Prepare for Legislative Reform
The Privacy Act is under active review. Reforms in 2025 are expected to increase obligations around consent, data minimisation, and individual rights.
Contact Swanwick Murray Roche Lawyers for Queensland Privacy Advice
If your business collects or stores personal information, you have legal obligations—regardless of your size or industry.
At Swanwick Murray Roche, we help Queensland businesses stay ahead of privacy law obligations. Whether you need a full compliance review, a breach response plan, contract updates, or legal advice following a data incident, we can assist.
Don’t wait for a breach to find out where your risks lie. Contact us today to protect your business, your clients, and your reputation.
Disclaimer
This article is for general information only and does not constitute legal advice. It reflects Australian law as at the date of publication. For advice specific to your business or industry, please contact our office to arrange a confidential consultation.
