Who does the Privacy Act cover?
Last updated: October 2026. Last checked: 18 October 2026. Every rule on this page was read on the official source on that date, and each source is linked in the sentence that relies on it.
The Privacy Act 1988 covers Australian Government agencies and organisations with an annual turnover of more than A$3 million, plus some smaller organisations, according to the OAIC's overview of the Privacy Act (opens in a new tab). A small business, with turnover of A$3 million or less, is generally outside it.
The exceptions matter for marketers. The OAIC's small business guidance (opens in a new tab) lists businesses covered regardless of turnover, including:
- a health service provider, so clinics, dental practices and allied health businesses are covered whatever their size;
- a business that trades in personal information, for example by buying or selling contact data;
- a contractor providing services under a Commonwealth contract;
- a business related to a business the Privacy Act covers;
- a business that has opted in to coverage, and others prescribed by regulation or listed by the OAIC.
When can you use personal information for direct marketing under APP 7?
Under Australian Privacy Principle 7, an organisation can use or disclose non-sensitive personal information for direct marketing if it collected the information from the person and they would reasonably expect that use, if the person consented, or if getting consent is impractical. That is the summary in the OAIC's direct marketing guidance (opens in a new tab).
In every case the organisation must give a simple way to opt out and stop marketing within a reasonable period after a request. Where the information came from someone else, or the person would not expect the use, each message must also point out the opt-out.
If a person asks where their information came from, the organisation must say, unless that is not reasonable or practical, and the OAIC says to answer generally within 30 days.
Sensitive and health information
Sensitive information, which includes health information, political opinions and racial or ethnic origin, can only be used for direct marketing with the person's consent. The reasonable-expectation route does not apply. For a clinic or health brand, a list built from patient records needs that consent before it becomes a marketing audience.
APP 7 generally does not apply to email, SMS or instant messages, which fall under the Spam Act, or to calls to numbers on the Do Not Call Register. The OAIC still suggests meeting APP 7 standards across every channel, because people rarely know which rule applies to which message.
What changed under the Privacy and Other Legislation Amendment Act 2024?
The Privacy and Other Legislation Amendment Act 2024 (opens in a new tab) received Royal Assent on 10 December 2024 and commences in stages. Three changes matter most to marketing teams: new penalty tiers and infringement notices, a statutory tort for serious invasions of privacy, and privacy-policy disclosure of automated decisions.
| Change | What it means for marketers | Commences |
|---|---|---|
| OAIC infringement notices and new civil penalty tiers (Schedule 1, Part 8) | Breaches of listed APPs, including the APP 7 opt-out and source-disclosure duties and privacy policy content, can draw an infringement notice without court action | 11 December 2024 |
| Statutory tort for serious invasions of privacy (Schedule 2) | Individuals can sue in court over intrusion upon seclusion or misuse of information about them | 10 June 2025 |
| Automated decision-making transparency in APP 1 (Schedule 1, Part 15) | Privacy policies must describe computer programs that use personal information to make decisions significantly affecting people | 10 December 2026 |
| Children's Online Privacy Code (Schedule 1, Part 4) | The OAIC must develop a code for online services likely to be accessed by children | OAIC to develop; check the OAIC for status |
Infringement notices and penalty tiers
The Act adds section 13K, under which breaching APP 7.2(c) or 7.3(c) (a simple way to opt out), APP 7.3(d) (drawing attention to the opt-out), APP 7.7(a) (acting on a request within a reasonable period) or APP 7.7(b) (naming the source) is a civil penalty provision.
The maximum is 200 penalty units, and the OAIC can issue an infringement notice instead of going to court.
For a listed corporation, an infringement notice is 200 penalty units per alleged contravention. A new mid-tier, section 13H, covers interference with privacy that is not serious, with a maximum of 2,000 penalty units. Serious interference stays under section 13G.
The statutory tort
The OAIC confirms the statutory tort commenced (opens in a new tab) on 10 June 2025. Claims go to the courts, not the OAIC, and generally must be started within one year of the person becoming aware of the invasion or three years after it, whichever is earlier.
Automated decisions from 10 December 2026
More detail on What changed under the Privacy and Other Legislation Amendment Act 2024?
From 10 December 2026, an organisation that uses a computer program, with personal information, to make or substantially help make a decision that could reasonably be expected to significantly affect a person must say so in its privacy policy. It must list the kinds of personal information and the kinds of decisions involved, according to the OAIC's May 2026 issues paper (opens in a new tab) on the ADM obligation.
For marketers, the same OAIC paper says targeting people with content and ads may have a significant effect if it results in differential pricing for significant goods or services, or limits access to employment opportunities. Teams running automated pricing, eligibility or job-ad targeting should review their privacy policy before that date.
What does the Spam Act 2003 require for email, SMS and messaging?
The Spam Act 2003 (opens in a new tab) requires every commercial electronic message with an Australian link to be sent with consent, to identify who authorised it, and to carry a functional unsubscribe facility. The Australian Communications and Media Authority (ACMA) enforces it.
What counts as a commercial electronic message
An electronic message is one sent to an email, instant messaging, telephone or similar account, so email, SMS and instant messages are all covered.
A message is commercial if one of its purposes is to offer, advertise or promote goods, services, land or a business or investment opportunity, judged on its content, presentation and linked material. Voice calls over a standard telephone service are excluded and fall under telemarketing rules instead.
Consent, identification and unsubscribe
- Consent (section 16, Schedule 2). Consent is either express, or reasonably inferred from the person's conduct and business or other relationships. Consent cannot be inferred merely because an address was published, apart from a narrow exception for conspicuously published work addresses where the message relates to that person's role.
- Identify the sender (section 17). The message must clearly and accurately identify who authorised it and include accurate contact details that remain valid for at least 30 days after sending.
- Functional unsubscribe (section 18). The message must clearly and conspicuously state that the recipient can unsubscribe, using an address that can receive unsubscribe messages for at least 30 days after sending.
- Act within 5 business days (Schedule 2, clause 6). A withdrawal of consent takes effect at the end of 5 business days from the day an electronic unsubscribe message is sent, so it must be processed within that window.
Some messages are designated commercial electronic messages under Schedule 1, which exempts them from the consent and unsubscribe rules but not from sender identification. The Act also lets the ACMA issue infringement notices as an alternative to Federal Court proceedings (Schedule 3).
What are the rules for telemarketing calls?
Under section 11 of the Do Not Call Register Act 2006 (opens in a new tab), a business must not make a telemarketing call to an Australian number on the Do Not Call Register unless the account-holder or their nominee consented. The ACMA administers the register.
Consent can be express or reasonably inferred. Express consent that does not state a period is taken to be withdrawn after 3 months (Schedule 2, clause 3). Schedule 1 exempts designated calls, such as calls authorised by government bodies, registered charities, registered political parties for fundraising, and educational institutions calling current or former students' households.
Calling hours
The Telecommunications (Telemarketing and Research Calls) Industry Standard 2017 (opens in a new tab) bans telemarketing calls on weekdays before 9 am or after 8 pm, on Saturdays before 9 am or after 5 pm, and on Sundays.
Calls are also banned on New Year's Day, Australia Day, Good Friday, Easter Monday, Anzac Day, Christmas Day and Boxing Day, measured at the recipient's usual address.
Which Australian marketing rule applies to which channel?
The table maps each rule to the channels and businesses it covers. Where two rules overlap, as with health information in an email campaign, meet both.
| Rule | Applies to | What marketers must do | Source |
|---|---|---|---|
| Privacy Act coverage | Organisations over A$3m turnover; health service providers and businesses trading in personal information at any size | Confirm whether the business is an APP entity before relying on any exemption | OAIC small business guidance |
| APP 7 direct marketing | Direct marketing by APP entities, other than channels covered by the Spam Act or DNCR Act | Have a lawful basis, give a simple opt-out, act on requests, disclose the source when asked | OAIC direct marketing guidance |
| APP 7 sensitive information | Health and other sensitive information used for direct marketing | Get consent before any marketing use | OAIC direct marketing guidance |
| APP 1 automated decisions | APP entities using computer programs and personal information for decisions with significant effects | Disclose kinds of information and decisions in the privacy policy from 10 December 2026 | Privacy and Other Legislation Amendment Act 2024; OAIC issues paper |
| Spam Act consent | Commercial email, SMS, MMS and instant messages with an Australian link | Hold express or inferred consent; never use harvested or bought lists | Spam Act 2003 s16, Sch 2 |
| Spam Act sender identification | Same messages, including designated messages | Name the authorising business and give contact details valid for 30 days | Spam Act 2003 s17 |
| Spam Act unsubscribe | Same messages, except designated messages | Include a clear unsubscribe and process it within 5 business days | Spam Act 2003 s18, Sch 2 cl 6 |
| Do Not Call Register | Telemarketing calls to Australian numbers on the register | Wash call lists against the register unless you hold consent or are exempt | Do Not Call Register Act 2006 s11 |
| Calling hours | Telemarketing calls | Call only weekdays 9 am to 8 pm and Saturdays 9 am to 5 pm, never Sundays or listed national holidays | Telemarketing and Research Calls Industry Standard 2017 s8 |
If the campaign is for a clinic or health brand, health advertising rules apply on top of these privacy rules. Our AHPRA advertising guide for Australian clinics covers testimonials, before-and-after images and penalties.
What should you check before an Australian campaign launches?
Run these checks before any email, SMS, telemarketing or audience-matched ad campaign goes live. Each one maps to a rule in the table above.
- Confirm whether the business is covered by the Privacy Act, remembering health service providers are covered at any turnover.
- Record the consent basis for every contact list: express, inferred from an existing relationship, or reasonable expectation under APP 7.
- Remove any purchased, scraped or harvested addresses from email and SMS lists.
- Check that health or other sensitive information is used only where the person consented to marketing use.
- Put the business name and working contact details in every commercial message.
- Test the unsubscribe link or STOP reply and confirm removals are processed within 5 business days.
- Wash telemarketing lists against the Do Not Call Register and schedule calls inside the permitted hours.
- Make sure the privacy policy explains how to opt out and how to ask where contact details came from.
- If you use automated pricing, eligibility or ad-targeting decisions, update the privacy policy before 10 December 2026.
To test a draft message against these rules, paste it into our free Australian privacy and spam checker.
If you want the checks built into a live programme, see performance marketing in Australia and our Meta Ads service for Australia, where audience uploads and lead forms are set up against these rules.
This page is general information, not legal advice. Laws and regulator guidance change, so check the linked official sources or take legal advice before relying on it for a specific campaign.