Privacy Act 1988 and the Australian Privacy Principles
The Australian Privacy Principles bind APP entities, including private organisations with annual turnover over $3 million, and some smaller firms. A firm under that threshold is not automatically covered.
The Australian Privacy Principles govern how an APP entity handles personal information, including security under APP 11.
MaintainedLast reviewed
Key facts
- Issued by
- Commonwealth of Australia; guidance by the OAIC
- Sources listed
- 3
This is a reading aid for an Australian law firm. It is not legal advice, not a certification, and not a finding that a tool or a firm complies. The sentences paraphrase the sources listed, checked on the date shown. Where a standard is sold by ISO or the AICPA, the page uses the publisher’s public description and does not reproduce the standard.
What it is
The Privacy Act 1988 (Cth) and the Australian Privacy Principles in Schedule 1 regulate the handling of personal information by APP entities. APP 11 is the security principle. The OAIC’s APP Guidelines, Chapter 11 (version 1.3, October 2025), say an APP entity must take such steps as are reasonable in the circumstances to protect the personal information it holds from misuse, interference and loss, and from unauthorised access, modification or disclosure.
APP 11.2 requires reasonable steps to destroy the information or de-identify it once the entity no longer needs it for a purpose permitted under the APPs, unless it is a Commonwealth record or an Australian law or a court or tribunal order requires it to be kept. APP 11.3, added by the Privacy and Other Legislation Amendment Act 2024, says the reasonable steps for security and for destruction or de-identification include technical and organisational measures. The OAIC says APP 11.3 applies to personal information held from 11 December 2024, whether or not it was collected before that date, and that it does not limit APP 11.1 or 11.2.
Who it applies to
APP entities include Australian Government agencies and private sector and not-for-profit organisations with annual turnover of more than $3 million. The OAIC’s Notifiable Data Breaches guidance says the definition generally does not include small business operators, and that some businesses of any size are APP entities, including businesses that trade in personal information and organisations that provide a health service and hold health information.
A law firm under the turnover threshold is not automatically an APP entity. The Law Society of NSW and Lawcover’s November 2025 cyber security note says that, whether or not the practice is an APP entity, a practice that holds tax file numbers must comply with the Privacy Act’s rules for tax file number information. Professional confidentiality applies either way. State and territory privacy laws can also apply to particular information. This page does not restate them.
What it asks of a law firm using AI
- If the firm is an APP entity, APP 11.1 requires active steps to protect personal information it holds. The OAIC says “holds” includes a record the entity has the right or power to deal with, including information a cloud provider stores where the entity can still access and amend it.
- What is reasonable depends on the circumstances the OAIC lists: the entity’s size, resources and complexity; the amount and sensitivity of the information; the harm a breach could cause; the time and cost of a measure; and whether the measure is itself privacy-invasive. Cost and inconvenience do not, by themselves, excuse a step. The OAIC says the question is whether the burden is excessive in all the circumstances.
- The OAIC’s examples of technical measures include securing access to premises, encrypting data, anti-virus software and strong passwords. Organisational measures sit with them. The guidelines also point to governance, training, internal practices, ICT security and access security.
- APP 8 is the cross-border disclosure principle. The OAIC’s NDB guidance says that if an APP entity discloses personal information overseas under APP 8.1, it is taken to hold that information for the NDB scheme. Before a prompt or a file leaves Australia, read APP 8 and the current OAIC chapter. This page does not list “adequate” countries. The Act allows the Minister to prescribe a country or a binding scheme. Confirm whether any prescription is in force.
- The 2024 Act’s new APP 1.7 and 1.8, on privacy policies and automated decisions, commence on 10 December 2026. From that date, an APP privacy policy must include specified information if the entity has arranged for a computer program to make, or to do a thing substantially and directly related to making, a decision that could reasonably be expected to significantly affect an individual’s rights or interests, and personal information is used in that operation. That obligation does not apply before 10 December 2026.
How it maps to this framework
The rows are this site’s questions. Where the cell says “Not set here”, the instrument does not set that requirement. The gap is still recorded, so it is not treated as answered.
| This site’s question | What the instrument says that bears on it |
|---|---|
| Efficiency Whether the tool saves total human work at the quality the task needs. | Not set here. |
| Effectiveness Whether the output is good enough for the task. The catalogue does not score this. | APP 10 requires reasonable steps to ensure personal information the entity collects, uses or discloses is accurate, up to date and complete. The OAIC’s commercial-AI guidance treats that as applying to AI output that is personal information. It is an accuracy duty for personal information, not a score of legal quality. |
| Due diligence What the firm has actually read about hosting, training and assurance before it relies on the tool. | The OAIC’s commercial-AI guidance says selecting a product should include security risks and who will have access to personal information. APP 11 is the reason that question is asked when the information is personal information the firm holds. |
| Confidentiality Whether client and other confidential information can go into the tool. | Personal information and client confidential information overlap, and they are not the same set. A client’s commercial strategy may be confidential without being personal information. APP 11 protects personal information the entity holds. The conduct rules protect confidential information whether or not the Privacy Act applies. |
| Disclosure When the firm tells the client, and where required the court or another party, that AI was used. | APP 1 requires an APP privacy policy, and APP 5 is about notice at collection. The 2024 automated-decision additions to the privacy policy are dated above. Telling a client that a lawyer used AI on their matter is a professional question, dealt with on the law-society pages. It is not the same sentence as an APP privacy policy. |
| Certifications ISO, SOC 2 and IRAP names recorded against the tool. A listed name is not a finding that the certificate covers the firm’s plan. | The OAIC’s APP 11 chapter discusses standards as one of the security considerations. A certificate is not, by itself, the reasonable steps APP 11 requires. The firm still has to look at the information, the product, and what the certificate covers. |
| Data residency Where the tool holds data, including whether that place is recorded as Australia. | APP 8 is the principle that matters when personal information is disclosed overseas, including to a tool whose servers are outside Australia. Hosting in Australia does not, by itself, satisfy APP 11. Hosting overseas does not, by itself, breach APP 8. Read the disclosure and the exceptions. |
Sources
- OAIC, APP Guidelines Chapter 11: APP 11 — Security of personal information (v1.3, October 2025)
- Privacy Act 1988
- Privacy and Other Legislation Amendment Act 2024
Checked 2026-10-10. Issued by Commonwealth of Australia; guidance by the OAIC.