Framework guide

FEHA and the Privacy Act 1988

What it takes, and how FEHA handles it

The Privacy Act 1988 is Australia's main privacy law. It sets 13 Australian Privacy Principles (APPs) that govern how personal information is collected, used, disclosed, stored, and accessed, and is enforced by the Office of the Australian Information Commissioner (OAIC). It also regulates consumer credit reporting, tax file numbers, and health and medical research.

It applies to most Australian Government agencies and to organizations with annual turnover above A$3 million, plus some smaller organizations such as health service providers. Together these are known as APP entities. Under the Notifiable Data Breaches scheme, an eligible data breach must be reported to the OAIC and to affected individuals. Recent reforms added higher penalties and a statutory tort for serious invasions of privacy.