Legislation › Privacy Act 1988 (Cth) Privacy Act 1988 (Cth) Sections (312) s 1 — Short title s 2 — Commencement s 2A — Objects of this Act s 3 — Saving of certain State and Territory laws s 3A — Application of the Criminal Code s 4 — Act to bind the Crown s 5A — Extension to external Territories s 5B — Extra‑territorial operation of Act s 6 — Interpretation s 6AA — Meaning of responsible person s 6A — Breach of an Australian Privacy Principle s 6B — Breach of a registered APP code s 6BA — Breach of the registered CR code s 6C — Organisations s 6D — Small business and small business operators s 6DA — What is the annual turnover of a business? s 6E — Small business operator treated as organisation s 6EA — Small business operators choosing to be treated as organisations s 6F — State instrumentalities etc. treated as organisations s 6FA — Meaning of health information s 6FB — Meaning of health service s 6G — Meaning of credit provider s 6H — Agents of credit providers s 6J — Securitisation arrangements etc. s 6K — Acquisition of the rights of a credit provider s 6L — Meaning of access seeker s 6M — Meaning of credit and amount of credit s 6N — Meaning of credit information s 6P — Meaning of credit reporting business s 6Q — Meaning of default information s 6QA — Meanings of financial hardship arrangement and financial hardship information s 6R — Meaning of information request s 6S — Meaning of new arrangement information s 6T — Meaning of payment information s 6U — Meaning of personal insolvency information s 6V — Meaning of repayment history information s 7 — Acts and practices of agencies, organisations etc. s 7A — Acts of certain agencies treated as acts of organisation s 7B — Exempt acts and exempt practices of organisations s 7C — Political acts and practices are exempt s 8 — Acts and practices of, and disclosure of information to, staff of agency, organisation etc. s 10 — Agencies that are taken to hold a record s 11 — File number recipients s 12A — Act not to apply in relation to State banking or insurance within that State s 12B — Severability—additional effect of this Act s 13 — Interferences with privacy s 13B — Related bodies corporate s 13C — Change in partnership because of change in partners s 13D — Overseas act required by foreign law s 13E — Effect of sections 13B, 13C and 13D s 13F — Act or practice not covered by section 13 is not an interference with privacy s 13G — Civil penalty provision for serious interference with privacy of an individual s 13H — Civil penalty provision for interference with privacy of individuals s 13J — Alternative orders s 13K — Civil penalty provision for which infringement notices or compliance notices can be issued s 14 — Australian Privacy Principles s 15 — APP entities must comply with Australian Privacy Principles s 16 — Personal, family or household affairs s 16A — Permitted general situations in relation to the collection, use or disclosure of personal information s 16B — Permitted health situations in relation to the collection, use or disclosure of health information s 16C — Acts and practices of overseas recipients of personal information s 17 — Rules relating to tax file number information s 18 — File number recipients to comply with rules s 19 — Guide to this Part s 20 — Guide to this Division s 20A — Application of this Division and the Australian Privacy Principles to credit reporting bodies s 20B — Open and transparent management of credit reporting information s 20C — Collection of solicited credit information s 20D — Dealing with unsolicited credit information s 20E — Use or disclosure of credit reporting information s 20F — Permitted CRB disclosures in relation to individuals s 20G — Use or disclosure of credit reporting information for the purposes of direct marketing s 20H — Use or disclosure of pre‑screening assessments s 20J — Destruction of pre‑screening assessment s 20K — No use or disclosure of credit reporting information during a ban period s 20L — Adoption of government related identifiers s 20M — Use or disclosure of credit reporting information that is de‑identified s 20N — Quality of credit reporting information s 20P — False or misleading credit reporting information s 20Q — Security of credit reporting information s 20R — Access to credit reporting information s 20S — Correction of credit reporting information s 20T — Individual may request the correction of credit information etc. s 20U — Notice of correction etc. must be given s 20V — Destruction etc. of credit reporting information after the retention period ends s 20W — Retention period for credit information—general s 20X — Retention period for credit information—personal insolvency information s 20Y — Destruction of credit reporting information in cases of fraud s 20Z — Dealing with information if there is a pending correction request etc. s 20ZA — Dealing with information if an Australian law etc. requires it to be retained s 21 — Guide to this Division s 21A — Application of this Division to credit providers s 21B — Open and transparent management of credit information etc. s 21C — Additional notification requirements for the collection of personal information etc. s 21D — Disclosure of credit information to a credit reporting body s 21E — Payment information must be disclosed to a credit reporting body s 21EA — Financial hardship information must be disclosed s 21F — Limitation on the disclosure of credit information during a ban period s 21G — Use or disclosure of credit eligibility information s 21H — Permitted CP uses in relation to individuals s 21J — Permitted CP disclosures between credit providers s 21K — Permitted CP disclosures relating to guarantees etc. s 21L — Permitted CP disclosures to mortgage insurers s 21M — Permitted CP disclosures to debt collectors s 21N — Permitted CP disclosures to other recipients s 21NA — Disclosures to certain persons and bodies that do not have an Australian link s 21P — Notification of a refusal of an application for consumer credit s 21Q — Quality of credit eligibility information s 21R — False or misleading credit information or credit eligibility information s 21S — Security of credit eligibility information s 21T — Access to credit eligibility information s 21U — Correction of credit information or credit eligibility information s 21V — Individual may request the correction of credit information etc. s 21W — Notice of correction etc. must be given s 22 — Guide to this Division s 22A — Open and transparent management of regulated information s 22B — Additional notification requirements for affected information recipients s 22C — Use or disclosure of information by mortgage insurers or trade insurers s 22D — Use or disclosure of information by a related body corporate s 22E — Use or disclosure of information by credit managers etc. s 22F — Use or disclosure of information by advisers etc. s 23 — Guide to this Division s 23A — Individual may complain about a breach of a provision of this Part etc. s 23B — Dealing with complaints s 23C — Notification requirements relating to correction complaints s 24 — Obtaining credit reporting information from a credit reporting body s 24A — Obtaining credit eligibility information from a credit provider s 25 — Compensation orders s 25A — Other orders to compensate loss or damage s 25B — Review of operation of this Part s 26 — Guide to this Part s 26A — APP entities to comply with binding registered APP codes s 26B — What is a registered APP code s 26C — What is an APP code s 26D — Extension of Act to exempt acts or practices covered by registered APP codes s 26E — Development of APP codes by APP code developers s 26F — Application for registration of APP codes s 26G — Development of APP codes by the Commissioner—following a request s 26GA — Development of APP codes by the Commissioner—at the direction of the Minister s 26GB — Development of APP codes by the Commissioner—temporary APP codes s 26GC — Development of APP codes by the Commissioner—Children’s Online Privacy Code s 26H — Commissioner may register APP codes s 26J — Variation of registered APP codes s 26K — Removal of registered APP codes s 26L — Entities to comply with the registered CR code if bound by the code s 26M — What is the registered CR code s 26N — What is a CR code s 26P — Development of CR code by CR code developers s 26Q — Application for registration of CR code s 26R — Development of CR code by the Commissioner s 26S — Commissioner may register CR code s 26T — Variation of the registered CR code s 26U — Codes Register s 26V — Guidelines relating to codes s 26W — Review of operation of registered codes s 26WA — Guide to this Part s 26WB — Entity s 26WC — Deemed holding of information s 26WD — Exception—notification under the My Health Records Act 2012 s 26WE — Eligible data breach s 26WF — Exception—remedial action s 26WG — Whether access or disclosure would be likely, or would not be likely, to result in serious harm—relevant matters s 26WH — Assessment of suspected eligible data breach s 26WJ — Exception—eligible data breaches of other entities s 26WK — Statement about eligible data breach s 26WL — Entity must notify eligible data breach s 26WM — Exception—eligible data breaches of other entities s 26WN — Exception—enforcement related activities s 26WP — Exception—inconsistency with secrecy provisions s 26WQ — Exception—declaration by Commissioner s 26WR — Commissioner may direct entity to notify eligible data breach s 26WS — Exception—enforcement related activities s 26WT — Exception—inconsistency with secrecy provisions s 26WU — Power to obtain information and documents relating to eligible data breaches s 26X — Eligible data breach declaration s 26XA — When declarations cease to be in force s 26XB — Authorisation of collection, use and disclosure of personal information s 26XC — Disclosure of information—offence s 26XD — Division not limited by secrecy provisions s 26XE — Constitutional basis of this Division s 26XF — Additional operation of this Division s 26XG — Interaction with section 12B s 26XH — Compensation for acquisition of property s 27 — Functions of the Commissioner s 28 — Guidance related functions of the Commissioner s 28A — Monitoring related functions of the Commissioner s 28B — Advice related functions of the Commissioner s 29 — Commissioner must have due regard to the objects of the Act s 30 — Reports following investigation of act or practice s 31 — Report following examination of proposed law s 32 — Commissioner may report to the Minister if the Commissioner has monitored certain activities etc. s 33 — Exclusion of certain matters from reports s 33A — Commissioner may share information with other authorities s 33B — Commissioner may disclose certain information if in the public interest etc. s 33C — Commissioner may conduct an assessment relating to the Australian Privacy Principles etc. s 33D — Commissioner may direct an agency to give a privacy impact assessment s 33E — Inquiries by Commissioner s 33F — Commissioner may invite submissions s 33G — Commissioner not bound by the rules of evidence s 33H — Commissioner’s powers s 33J — Reporting on public inquiries s 34 — Provisions relating to documents exempt under the Freedom of Information Act 1982 s 35 — Direction where refusal or failure to amend exempt document s 35A — Commissioner may recognise external dispute resolution schemes s 36A — Guide to this Part s 36 — Complaints s 36B — Complaints relating to the data sharing scheme s 37 — Principal executive of agency s 38 — Conditions for making a representative complaint s 38A — Commissioner may determine that a complaint is not to continue as a representative complaint s 38B — Additional rules applying to the determination of representative complaints s 38C — Amendment of representative complaints s 39 — Class member for representative complaint not entitled to lodge individual complaint s 40 — Investigations s 40A — Conciliation of complaints s 41 — Commissioner may or must decide not to investigate etc. in certain circumstances s 42 — Preliminary inquiries s 43 — Conduct of investigations s 43A — Interested party may request a hearing s 44 — Power to obtain information and documents s 45 — Power to examine witnesses s 46 — Directions to persons to attend compulsory conference s 47 — Conduct of compulsory conference s 48 — Complainant and certain other persons to be informed of various matters s 49 — Investigation under section 40 to cease if certain offences may have been committed s 49A — Investigation under section 40 to cease if civil penalty provision under Personal Property Securities Act 2009 may have been contravened s 49B — Transfer of complaints from the Inspector‑General of Intelligence and Security s 50 — Reference of matters to other authorities s 50A — Substitution of respondent to complaint s 51 — Effect of investigation by Auditor‑General s 52 — Determination of the Commissioner s 52A — Determination—requirement to notify conduct constituting interference with privacy of individual s 53 — Determination must identify the class members who are to be affected by the determination s 53A — Notice to be given to outsourcing agency s 53B — Substituting an agency for a contracted service provider s 54 — Application of Division s 55 — Obligations of organisations and small business operators s 55A — Proceedings in the Federal Court or Federal Circuit and Family Court of Australia (Division 2) to enforce a determination s 55B — Evidentiary certificate s 57 — Application of Division s 58 — Obligations of agencies s 59 — Obligations of principal executive of agency s 60 — Compensation and expenses s 62 — Enforcement of determination against an agency s 63 — Legal assistance s 64 — Commissioner etc. not to be sued s 65 — Failure to attend etc. before Commissioner s 66 — Failure to give information etc. s 67 — Protection from civil actions s 70 — Certain documents and information not required to be disclosed s 70B — Application of this Part to former organisations s 71 — Interpretation s 72 — Power to make, and effect of, determinations s 73 — Application by APP entity s 74 — Publication of application etc. s 75 — Draft determination s 76 — Conference s 77 — Conduct of conference s 78 — Determination of application s 79 — Making of determination s 80A — Temporary public interest determinations s 80B — Effect of temporary public interest determination s 80D — Commissioner may continue to consider application s 80E — Register of determinations s 80F — Object s 80G — Interpretation s 80J — Declaration of emergency—events of national significance s 80K — Declaration of emergency—events outside Australia s 80KA — Matters covered by declarations s 80N — When declarations cease to be in force s 80P — Authorisation of collection, use and disclosure of personal information s 80Q — Disclosure of information—offence s 80R — Operation of Part s 80S — Severability—additional effect of Part s 80T — Compensation for acquisition of property—constitutional safety net s 80TA — Simplified outline of this Part s 80TB — Monitoring powers s 80TC — Modifications of Part 2 of the Regulatory Powers Act s 80TD — Investigation powers s 80TE — Modifications of Part 3 of the Regulatory Powers Act s 80U — Civil penalty provisions s 80UA — Powers of court to make other orders s 80UB — Infringement notices s 80UC — Compliance notices s 80UD — Review of compliance notices s 80V — Enforceable undertakings s 80W — Injunctions s 81 — Interpretation s 82 — Establishment and membership s 83 — Functions s 84 — Leave of absence s 85 — Removal and resignation of members s 86 — Disclosure of interests of members s 87 — Meetings of Advisory Committee s 88 — Travel allowance s 89 — Obligations of confidence to which Part applies s 90 — Application of Part s 91 — Effect of Part on other laws s 92 — Extension of certain obligations of confidence s 93 — Relief for breach etc. of certain obligations of confidence s 94 — Jurisdiction of courts s 95 — Medical research guidelines s 95A — Guidelines for Australian Privacy Principles about health information s 95AA — Guidelines for Australian Privacy Principles about genetic information s 95B — Requirements for Commonwealth contracts s 95C — Disclosure of certain provisions of Commonwealth contracts s 96 — Review by the Administrative Review Tribunal s 98A — Treatment of partnerships s 98B — Treatment of unincorporated associations s 98C — Treatment of trusts s 99A — Conduct of directors, employees and agents s 100 — Regulations Sourced from the Federal Register of Legislation at 17 May 2026. For the latest information on Australian Government law please go to https://www.legislation.gov.au.