# Australia Privacy Act privacy policy: APP 1 requirements > What an Australian APP privacy policy must contain under APP 1, who the Privacy Act 1988 covers, and which library clauses apply. Australian Privacy Principle 1 requires an APP entity to have a clearly expressed and up-to-date privacy policy about how it manages personal information. Under APP 1.4, the policy must state the kinds of personal information collected and held, how it is collected and held, the purposes, how people can access and correct their information, how to complain and how complaints are handled, and whether information is likely to be disclosed to overseas recipients and, where practicable, in which countries. Canonical URL: https://legalpolicygenerator.com/laws/australia-privacy-act-policy ## Who this law applies to The Privacy Act 1988 applies to APP entities: Australian Government agencies and organisations with an annual turnover of more than $3 million. Smaller businesses are exempt unless an exception applies, for example health service providers, businesses that trade in personal information, contracted service providers to the Commonwealth, credit reporting bodies, and related bodies of a covered entity. The exemption has not been removed, although reform proposals continue to be discussed. The Act can reach organisations outside Australia that have an Australian link, which includes organisations that carry on business in Australia and collect or hold personal information there. The Privacy and Other Legislation Amendment Act 2024 introduced a statutory tort for serious invasions of privacy, which commenced on June 10, 2025, and new privacy-policy content about automated decisions, which applies from December 10, 2026. The Office of the Australian Information Commissioner regulates the Act. ## What your privacy policy must include APP 1.4 lists the minimum contents: the kinds of personal information the entity collects and holds; how it collects and holds that information; the purposes for which it collects, holds, uses, and discloses it; how an individual may access and seek correction of their information; how an individual may complain about a breach of the principles and how the entity will deal with the complaint; whether the entity is likely to disclose information to overseas recipients; and, if so, the countries where those recipients are likely to be located, if it is practicable to specify them. APP 1.5 requires the policy to be available free of charge and in an appropriate form, usually on the entity's website. From December 10, 2026, an entity whose computer programs use personal information to make decisions that could reasonably be expected to significantly affect an individual's rights or interests must also describe those decisions and the kinds of personal information used in its policy. The APP privacy policy is different from the APP 5 collection notice, which must be given at or before collection and covers matters such as the purpose of collection and the consequences of not providing information. ## How Legal Policy Generator handles it Selecting Australia Privacy Act adds a regional clause stating that the policy covers the APP 1.4 matters, whether overseas disclosure is likely and the countries you name, the request methods you support for access, correction, and complaints, and how complaints are considered, while declining to promise a shorter complaint period than the law provides and pointing to the OAIC. When you confirm that computer programs make, or do things substantially and directly related to making, decisions that could significantly affect individuals, a second clause states the kinds of personal information used, the kinds of decisions made solely by those programs, and the kinds of decisions they substantially and directly support, as APP 1.7 to 1.9 require from December 10, 2026. The list below is read from the clause library each time this page is rendered. ## Questionnaire answers that switch it on The Australia clause activates only when the jurisdiction answer includes Australia Privacy Act. It requires the privacy request methods you actually support. The international processing answer and the description of locations and safeguards feed the transfers section, which is where likely overseas recipient countries should be named. A separate Australian question asks whether computer programs make or substantially support significant decisions; a yes requires the kinds of personal information used and at least one kind of decision. Answers about AI use feed the general AI section. In the separate Terms generator, selecting Australia adds a clause preserving mandatory Australian consumer rights. ## Common mistakes Relying on the small business exemption without checking the exceptions, such as trading in personal information or providing a health service, is the most common error. Stating that data may be sent overseas without naming likely countries where it is practicable to do so misses an APP 1.4 item. Leaving out how complaints are handled, not just where to send them, is another gap. Treating the privacy policy as the APP 5 collection notice, or the reverse, can leave people without the notice they should receive at collection. Promising a fixed complaint response time the business cannot meet creates a public commitment. Finally, the automated-decision content required from December 10, 2026 is easy to overlook in a policy written earlier. ## Common questions ### Are small businesses exempt from the Privacy Act? Generally yes, when annual turnover is $3 million or less, but several exceptions bring small businesses back in, including health service providers and businesses that trade in personal information. ### Do I have to list the countries where data is sent? APP 1.4 requires the policy to say whether overseas disclosure is likely and, where practicable, to specify the countries. ### What is the difference between an APP privacy policy and an APP 5 notice? The policy describes overall information handling. An APP 5 notice is given at or before a specific collection and covers that collection. ### What changes on December 10, 2026? Privacy policies must describe certain automated decisions that could significantly affect individuals and the kinds of personal information used in them. ### Is the generated Australian wording legal advice? No. It reflects supplied facts and does not guarantee compliance with the Privacy Act. Generated wording reflects supplied facts. It is not legal advice or a guarantee of compliance or enforceability.