Who Must Comply · Privacy Act stream
Any APP entity
Updated 2 Sept 2026
An 'APP entity' is any organisation bound by the Australian Privacy Principles — essentially most medium and large businesses, plus all Commonwealth agencies and certain small businesses caught by sector-specific rules. The small business exemption (s 6D, roughly A$3M annual turnover) was still in place as at September 2026, though removing it remains under consideration in the next tranche of reform.
Key obligations
- Comply with all 13 Australian Privacy Principles.
- Maintain an APP 1 privacy policy and keep it current with the new ADM disclosures.
- Respond to access and correction requests.
- Notify eligible data breaches.
Key dates
- 10 Dec 2026ADM transparency obligations apply to all APP entities.
- 18 Sep 2026Consultation closes on the exposure draft Privacy Amendment (Personal Data Protection) Bill 2026 — not yet law.
Who is affected
- Businesses with annual turnover > A$3M.
- Health service providers, credit reporters, contracted Commonwealth service providers — regardless of size.
- All Commonwealth agencies.