The Privacy Act 1988 and its 13 Australian Privacy Principles (APPs) set how a covered business collects, uses, discloses and protects personal information, and APP 7 sets the conditions under which that business uses personal information for direct marketing. The Office of the Australian Information Commissioner (OAIC) regulates privacy under the Act. The Act covers organisations with an annual turnover of more than A$3 million and several kinds of smaller business. In marketing, the principles reach enquiry forms, privacy policies, email lists, audience targeting and tracking pixels. From 10 December 2026, APP 1.7 adds a new disclosure to the privacy policy of a business that uses computer programs to make significant decisions about individuals.
What the Privacy Act and the Australian Privacy Principles Cover, and Who They Apply To
The Privacy Act covers the personal information held by Australian Government agencies, by organisations with an annual turnover of more than A$3 million and by specific smaller businesses, and the 13 APPs are the obligations those entities follow. The OAIC calls the APPs the cornerstone of the privacy protection framework in the Privacy Act. They are principles-based and technology neutral, and they cover four areas: the collection, use and disclosure of personal information; governance and accountability; the integrity and correction of personal information; and individuals' access to their information. The OAIC's rights and responsibilities page lists the rights the Act gives individuals, among them access to their personal information, correction of incorrect information and an end to unwanted direct marketing.
Which businesses does the Privacy Act cover?
An organisation with an annual turnover of more than A$3 million is covered, and a smaller business is covered too when it falls into one of the categories the OAIC lists. In the Act, an organisation includes individuals and sole traders, bodies corporate, partnerships, unincorporated associations and trusts. A business with a turnover of A$3 million or less is still covered when it is, among other categories:
- a private sector health service provider, which includes private hospitals, medical practitioners, pharmacists, allied health professionals, complementary therapists, gyms and weight loss clinics
- a business that sells or purchases personal information
- a contracted service provider for an Australian Government contract
- a business related to a business the Privacy Act covers
- a business that has opted in to the Privacy Act.
What counts as personal information?
Personal information is information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information or opinion is true or not and whether it is recorded in a material form or not. That is the section 6(1) definition, and the OAIC's examples include a person's name, home address, email address, telephone number, date of birth and medical records. Sensitive information is a narrower category with its own consent rule in APP 7: it includes information or an opinion about an individual's racial or ethnic origin, political opinion, religious beliefs, sexual orientation or criminal record.
What are the 13 Australian Privacy Principles?
The 13 APPs run from open and transparent management of personal information (APP 1) to correction of personal information (APP 13). The OAIC publishes the full text of the principles. In order, they cover open and transparent management (APP 1), anonymity and pseudonymity (APP 2), collection of solicited information (APP 3), unsolicited information (APP 4), notification of collection (APP 5), use or disclosure (APP 6), direct marketing (APP 7), cross-border disclosure (APP 8), government related identifiers (APP 9), quality (APP 10), security (APP 11), access (APP 12) and correction (APP 13).
What does the Notifiable Data Breaches scheme require?
Under the Notifiable Data Breaches scheme, a covered business notifies the affected individuals and the OAIC when a data breach is likely to result in serious harm. The OAIC describes an eligible data breach as unauthorised access to, or unauthorised disclosure or loss of, personal information the business holds, likely to result in serious harm to one or more individuals, where the business has not been able to prevent the likely risk of serious harm with remedial action. The notice to individuals includes recommendations about the steps they take in response. The Privacy Amendment (Notifiable Data Breaches) Act 2017 set up the scheme. A marketing database, a CRM export and an enquiry inbox all hold personal information, so an incident in any of them goes through the same assessment.
What penalties has a court ordered under the Privacy Act?
The Federal Court ordered the first civil penalties under the Privacy Act 1988 in October 2025: A$5.8 million against Australian Clinical Labs over the Medlab Pathology data breach. The OAIC's media release of 9 October 2025 attributes A$4.2 million to failing to take reasonable steps to protect personal information (APP 11) and A$1.6 million to failures in assessing the breach and in giving the Australian Information Commissioner a statement about it as soon as practicable.
General guidance, not legal advice.
What the Australian Privacy Principles Mean for Your Marketing and SEO Copy
Every page that collects, describes or acts on personal information carries the APPs: the privacy policy, the notice beside an enquiry form, the list behind a newsletter and the pixels behind a retargeting audience. For SEO and content teams, the privacy policy and collection notices are published pages, and every statement on them is a fact your business keeps true. The table maps common marketing touchpoints to the principle behind each one.
| Claim type | What the rule says | What to check | Source |
|---|---|---|---|
| Privacy policy | A covered business keeps a clearly expressed and up-to-date APP Privacy Policy, and APP 1.4 lists what it includes | The policy matches what you collect, why, who receives it and how people access, correct or complain | OAIC, APP guidelines chapter 1 |
| Enquiry and sign-up forms | The business tells the individual its identity and contact details, the purposes of collection, who it usually discloses the information to and whether the information is likely to go overseas | A collection notice beside each form, linked to the privacy policy | OAIC, APP 5 |
| Marketing to people who gave you their details | Direct marketing is permitted when the individual reasonably expects it and a simple way to opt out exists | Each contact's source and an opt-out in every message | OAIC, APP guidelines chapter 7 (APP 7.2) |
| Bought lists and third-party data | The individual's consent is needed, unless obtaining it is impracticable, and every communication carries a prominent opt-out statement | Consent records per source and the opt-out statement | OAIC, APP guidelines chapter 7 (APP 7.3) |
| Sensitive information | Direct marketing with sensitive information needs the individual's consent | Audience segments built on health, religion or similar attributes | OAIC, APP guidelines chapter 7 (APP 7.4) |
| Opt-out requests | Free of charge and honoured within a reasonable period, which the OAIC generally puts at no more than 30 days; it notes that a shorter timeframe is possible, particularly on digital channels | How fast an opt-out reaches every list and platform | OAIC, APP guidelines chapter 7 (APP 7.7) |
| "Where did you get my details?" | The organisation names its source on request, unless that is impracticable or unreasonable, generally within 30 days | A source record for each contact | OAIC, APP guidelines chapter 7 (APP 7.7) |
| Tracking pixels | Pixels are disclosed in the privacy policy, individuals are notified, pixels collect the minimum data, and sensitive information goes through a pixel only with express consent | Pixel settings, the privacy policy and the cookie notice | OAIC, Tracking pixels and privacy obligations |
Sources: OAIC, Chapter 1: APP 1 Open and transparent management of personal information, version 2.0, updated 30 September 2026; OAIC, Read the Australian Privacy Principles; OAIC, Chapter 7: APP 7 Direct marketing; OAIC, Tracking pixels and privacy obligations, 4 November 2024. All checked 24 October 2026.
Does APP 7 apply to marketing emails and SMS?
APP 7 does not apply to the extent the Spam Act 2003 or the Do Not Call Register Act 2006 applies, so the consent and unsubscribe rules for marketing emails and SMS come from the Spam Act. The OAIC's APP 7 guidelines state that carve-out (APP 7.8), and add that APP 7 still applies to an organisation's acts and practices to the extent the organisation is exempt or partially exempt from those Acts. The Spam Act email marketing guide covers consent, sender identification and the unsubscribe rules for email and SMS.
What do tracking pixels on a landing page require?
The business that places a third-party tracking pixel on its website is responsible for that pixel, and the OAIC asks it to configure the pixel to collect and share the minimum amount of data. The OAIC's tracking pixel guidance recognises that it is not always clear whether pixel data is personal information, and that an individual becomes reasonably identifiable through the information a third-party pixel collects in some cases. It expects due diligence before a pixel goes live, disclosure of the pixels in the privacy policy (APP 1) and notice to individuals (APP 5). Sensitive information goes through a pixel only with the individual's express consent, and a business that uses pixels to target individuals with online advertising complies with APP 7.
What does the automated-decision rule add to a privacy policy?
From 10 December 2026, APP 1.7 requires extra information in the privacy policy of a covered business that arranges for a computer program to use personal information to make, or do a thing substantially and directly related to making, a decision reasonably expected to significantly affect an individual's rights or interests. The OAIC's APP 1 guidelines, version 2.0 of 30 September 2026, set out the extra information: the kinds of personal information those programs use, and the kinds of decisions the programs make on their own or support. Review each automated marketing decision your business runs, such as lead scoring or eligibility checks, against that test.
General guidance, not legal advice.
What the Australian Privacy Principles Mean for AI Answers and AI-Generated Content
Privacy obligations apply to personal information entered into an AI system and to AI output that contains personal information, inaccurate output included. The OAIC's guidance on privacy and the use of commercially available AI products, published 21 October 2024 and updated 17 January 2025, applies the APPs to the AI products a business buys or subscribes to. It asks businesses to update their privacy policies and notifications with clear information about their AI use, and to clearly identify public-facing AI tools such as chatbots.
Is customer data entered into an AI tool covered by the APPs?
Yes: the OAIC states that privacy obligations apply to any personal information input into an AI system, and as best practice it recommends that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools. APP 6 limits use and disclosure to the primary purpose of collection unless an exception applies, consent among them. APP 10 asks for reasonable steps to keep the personal information collected, used and disclosed accurate, and the OAIC ties that duty to the tendency of AI tools to produce inaccurate output.
What do AI assistants repeat about your business?
In Aemorph's working model, ChatGPT, Claude, Gemini and Perplexity describe a business from the public sources they find, its own website among them, so a privacy promise on your site that no longer matches your practice becomes material for their answers. Privacy lines in marketing copy, such as "we never share your details", are statements of fact about your business, and your privacy policy is the record they match. The free Hallucination Report compares what the AI engines say about your business with what your website currently says, and flags where they conflict.
General guidance, not legal advice.
How Aemorph Checks Privacy Claims Before Publication
Your nominated point of contact signs off every regulated claim in the content Aemorph writes before Aemorph publishes it, and Aemorph is not a law firm. Aemorph does not review your privacy policy, collection notices, lists or pixels against the Privacy Act or the APPs, and it does not confirm that your practices comply: as the covered business, yours holds those obligations. Aemorph runs SEO, SEM, content and AI visibility; it does not run or coordinate social media or email marketing for clients. For the personal data its own website collects, Aemorph states the Australian Privacy Principles as its own commitment and does not claim to be covered by the Privacy Act 1988; the privacy policy sets out the detail.
| Check | Applies to | Standard | Checked against | When |
|---|---|---|---|---|
| Regulated claims in content Aemorph writes | Every client | Approved by the person your business nominates | Your point of contact's sign-off | Before Aemorph publishes |
| Business facts in your verified record | Every client | The facts your business supplies and approves, used as supplied | Your point of contact's sign-off | Before publication |
| Access to your accounts | Every client | Client-owned assets, named accounts with only the access the work needs, ISO 27001-aligned practice | You hold ownership of each account | From kick-off |
| Personal data from Aemorph's own website | Enquiries and analytics | Aemorph's commitment to the Australian Privacy Principles | Two-step login on the Google accounts that hold enquiry and analytics data; no copy kept on local devices | Ongoing |
Source: Aemorph compliance practice and privacy policy, October 2026.
Who signs off the claims on your pages?
You choose the person who signs off: the business owner, the chief marketing officer or the risk team. Aemorph publishes a regulated claim only after that person approves it. Aemorph takes the business facts you supply as true and correct and does not check them independently, so your verified record is the set of facts your business supplies and approves.
General guidance, not legal advice.
Australian Businesses: Plan Privacy-Ready Digital Marketing With a Free Strategic Conversation
Australian businesses that want search, ads, content and AI visibility built on claims their own reviewers approve start with a free strategic conversation with Aemorph. Aemorph is headquartered in Singapore, has no office in Australia, serves Australian clients remotely in Australian business hours and replies to every message within 24 hours. The digital marketing page sets out how Aemorph coordinates SEO, SEM, content and AI visibility for Australian businesses, with BizCover, Remarkable Furniture and Smile Team as Australian references.
Disclaimer: This article reflects Aemorph's reading and understanding of the laws, regulations and official guidance cited, based on the sources and review dates stated. It provides general information, not legal advice, and does not assess compliance for your specific circumstances.