Australian Privacy Act + APPs

What it is

The Privacy Act 1988 (Cth) and its 13 Australian Privacy Principles (APPs), administered by the OAIC. Applies to most Australian government agencies and to private-sector organisations with annual turnover above A$3M (plus all health-service providers regardless of size). The Privacy and Other Legislation Amendment Act 2024 (effective June 2025) added a statutory tort, infringement notices, and stronger transparency duties.

Why it matters

Maximum civil penalty is now A$50M, three times the benefit, or 30% of adjusted turnover — whichever is greatest. OAIC has been more active post-Optus and Medibank breaches. A clear privacy policy that addresses each APP is the baseline visible signal.

Who it applies to

Australian residents — applies to APP entities (most organisations with >A$3M turnover) and to overseas businesses with an Australian link.

• Jurisdictions: Australia

How WQI scores it

Web Quality Index considers this standard satisfied when all of the 3 supporting factors pass.

0 of 3 supporting factors are currently collected. Sites where the remaining 3 haven't been measured will show as partial or unknown on this standard until the data lands.

Related standards

See also

GDPR

Standards that share factors with this one

Auto-computed from overlapping factor tickets in satisfiedBy, excluding standards already listed under "See also" above. Strong overlap suggests these standards rise and fall together when sites are scored.

• Colorado Privacy Act 3 shared factors Privacy Colorado's CCPA-shaped privacy law, with a hard requirement to honour Universal Opt-Out Mechanisms like Global Privacy Control as of July 2024.
• Connecticut Data Privacy Act 3 shared factors Privacy Connecticut's CCPA-shaped privacy law. Like Colorado, recognises Global Privacy Control as a valid opt-out signal — and the AG has been actively issuing cure notices since 2023.
• COPPA 3 shared factors Privacy If your site is directed at U.S. children under 13 — or you knowingly collect from them — you need verifiable parental consent before any data collection. The 2025 amendments tightened this further around third-party advertising.
• HIPAA 3 shared factors Privacy If your site collects, displays, or transmits protected health information, HIPAA applies. A privacy policy plus an explicit Notice of Privacy Practices and a clear consent flow are the minimum visible signals.
• LGPD 3 shared factors Privacy Brazil's GDPR analogue. If you serve Brazilian residents, treat it like GDPR-lite: lawful basis, consent for cookies, a real privacy policy, and ANPD-shaped data subject rights.

Other references

• guidance OAIC — Australian Privacy Principles guidelines
• regulation Privacy and Other Legislation Amendment Act 2024