The Privacy Act in Australia: 2026 Guide for Retailers
Find out who the Privacy Act 1988 applies to, what counts as sensitive information and which privacy law changes in Australia may affect your store.
The Privacy Act 1988 sets rules for how covered Australian businesses handle personal information, including customer names, delivery addresses and identifiable chat records. Most retailers with annual turnover above $3 million are covered. Some smaller stores are covered too, including businesses that provide health services or trade in personal information. The OAIC’s small business checklist explains those exceptions.
This page gives general information. Get legal advice about your own store’s obligations before deciding that an exemption applies or changing how you handle customer data.
What the Privacy Act 1988 Covers and Where to Get Help
The Privacy Act protects personal information about identified people, or people who can reasonably be identified. Its 13 Australian Privacy Principles (APPs) govern collection, use and disclosure, along with security and customers’ access and correction rights. The Office of the Australian Information Commissioner (OAIC) regulates these obligations. Its summary of the Australian Privacy Principles is a useful starting point.
Information privacy is only part of privacy law. The Act’s APP rules don’t resolve every intrusion into someone’s private life. A separate statutory tort, explained below, gives people a court remedy for certain serious invasions of privacy. The OAIC’s explanation of the tort describes its wider reach.
State and territory privacy rules mostly cover public agencies. Some health privacy laws also cover private providers, as the OAIC’s state-law guide explains. Western Australia’s Privacy and Responsible Information Sharing Act 2024 covers public entities and certain contractors. A private retailer doesn’t come under it simply by operating in WA. Government contracts can change that position, so consult WA’s contractor guidance if your store supplies public services.
APP Entities and the Small Business Exemption
An APP entity is an agency or organisation bound by the Australian Privacy Principles. For a retailer, coverage usually depends on turnover and any exception to the small business exemption. The OAIC’s definition of an APP entity includes sole traders and companies.
A business with annual turnover of $3 million or less is generally exempt, but turnover alone doesn’t settle the question. The OAIC’s checklist also asks about previous turnover and other circumstances. The following exceptions can affect retailers:
- Providing a health service and holding health information, such as a pharmacy’s patient records.
- Trading in personal information, subject to the statutory consent and legal-authority exceptions.
- Being related to a larger body corporate covered by the Act.
- Providing services under a Commonwealth contract or subcontract.
- Being a reporting entity under anti-money-laundering rules, for the covered activities.
- Choosing to opt into Privacy Act coverage.
Trading can include exchanging personal information for a benefit or service, not only selling a mailing list. Get legal advice if your advertising or data-sharing arrangements make your coverage uncertain. Merely using an AI chat tool doesn’t automatically remove the exemption.
What the Principles and Sensitive Information Rules Mean for an Online Store
The APPs turn privacy into specific store tasks, from asking for a delivery address to correcting an order record. The OAIC’s APP summary connects each task to its rule.
| Store task | Principle and practical action |
|---|---|
| Publish a privacy policy | APP 1: explain what you collect, why and how customers can contact you about privacy. |
| Answer a product question | APP 2: allow anonymity or a pseudonym where practical. |
| Collect checkout details | APP 3: collect only information reasonably necessary for your business activities. |
| Receive unexpected health details in chat | APP 4: assess whether you could lawfully collect them and whether destruction or de-identification is required. |
| Explain collection at checkout or in chat | APP 5: give the relevant collection information when collecting it, or as soon as practical afterwards. |
| Send data to another provider | APP 6 governs use and disclosure. APP 8 also applies to overseas disclosure. |
| Keep accurate, protected records | APP 10 covers quality. APP 11 covers security and disposal. |
| Receive a customer request | APP 12 covers access. APP 13 covers correction. |
Your privacy policy must describe the kinds of information you handle and its purposes. It must explain access, correction and complaints, plus likely overseas disclosures and countries where practical. The OAIC’s APP 1 guidance sets out the required content. Use the Australian privacy policy template for clause-by-clause help.
Email platforms, analytics tools and AI assistants can receive customer data. Account for each flow and decide whether it is a use within your control or a disclosure. APP 6 generally permits the primary purpose of collection, with conditions for secondary purposes. The OAIC’s use and disclosure guidance explains those conditions.
Ask whether an AI vendor uses transcripts to train its models, including through a separate model provider. A setting that allows training can change the purpose and recipients of customer data. Explain actual AI use in your policy and collection notices. The OAIC’s AI guidance covers these risks.
Sensitive information includes health information, racial or ethnic origin, religious beliefs and certain biometric information. A pharmacy chat about a prescription or a supplement question revealing an identifiable customer’s medical condition can contain health information. Collection generally needs consent and must be reasonably necessary, unless a legal exception applies. Consent alone doesn’t justify unnecessary collection. See the OAIC’s sensitive-information collection rules.
Consent Management and Cookie Consent for Chat
Consent management records what a customer has agreed to and makes withdrawal workable. Consent must be informed, voluntary, current and specific. A collection notice tells someone what happens to their information. It doesn’t automatically supply consent where consent is required. The OAIC’s consent guidance explains the distinction.
Before a customer types personal details, show a short notice identifying the AI assistant and explaining the chat’s purpose and usual recipients. Link to the privacy policy and explain overseas handling where relevant. Give any required consent a separate, understandable choice. APP 5 requires reasonable steps to provide relevant collection information, as the OAIC’s collection-notice guidance describes. For broader collection practices, read the first-party customer data guide.
Australia has no general rule requiring every website to display a cookie consent banner. The Privacy Act applies when cookie data is personal information and the store is covered. A chat identifier linked to a customer account can qualify even if the cookie contains no name. The OAIC’s cookie guidance explains identification and data aggregation. Overseas visitors can create separate legal obligations.
A consent management platform stores choices by purpose, the notice version and when choices change. It can control optional trackers and keep cookie choices separate from marketing preferences. For one chat tool with simple settings, a notice and a working preference control can be enough operationally. Consider a platform when several vendors or regional rules make manual records unreliable. A banner that records a click but leaves rejected trackers running doesn’t carry out the customer’s choice.
Security and Retention of Chat Transcripts
APP 11 requires reasonable steps to protect personal information from misuse, loss and unauthorised access or disclosure. For chat records, assess staff access, encryption, authentication and provider controls. Limit transcript access to people who need it, review permissions and train staff to handle exports safely. The OAIC’s security guidance explains how risk affects reasonable steps.
A data retention policy states what you keep, the reason, the retention trigger and the disposal method. APP 11 generally requires destruction or de-identification when information is no longer needed for a permitted purpose, subject to record-keeping exceptions. Include provider copies and backup expiry in your procedure.
Use this short policy structure as a hypothetical starting point. The periods below need checking against your store’s tax, consumer-law and dispute obligations before adoption.
| Record | Illustrative retention rule | Check before adopting |
|---|---|---|
| Routine chat transcripts | Delete or de-identify 90 days after the conversation closes, unless a documented support issue needs them longer. | Confirm any complaint, warranty or legal hold before deletion. This is an example period, not a legal requirement. |
| Order and tax records | Apply the relevant statutory period. Most business tax records need five years, with exceptions. | Confirm the start event and any longer tax or consumer-law requirement. Don’t apply this period to every chat by default. |
| Marketing lists and preference records | Review every 12 months. Remove data no longer needed and retain minimal suppression records where needed to honour opt-outs. | Check applicable marketing and evidence obligations. The review interval is an example, not a prescribed period. |
Assign a person to approve exceptions and record why each exception exists. The ATO’s record-keeping explanation explains the usual five-year rule and why its start point matters.
Data Sovereignty: Where Chat Data is Stored
Data residency means where data is stored. Data sovereignty concerns the laws and jurisdiction governing it. Sovereign AI usually describes local control over AI infrastructure and data, but the label alone doesn’t establish privacy compliance.
APP 8 generally requires reasonable steps before overseas disclosure to ensure the recipient follows the APPs, other than APP 1. The store can remain accountable for the recipient’s conduct. Limited exceptions apply. Some tightly controlled overseas storage arrangements are a use instead of a disclosure, with other APP obligations continuing. The OAIC’s overseas-disclosure guidance explains this distinction.
Ask your AI vendor for written answers covering:
- Countries used for transcript storage, backups and model processing.
- Model providers and subprocessors that can receive personal information.
- Whether offshore staff can access records for support.
- Contract restrictions on training, onward disclosure and other uses.
- Export and deletion controls, including what happens when the contract ends.
In a hypothetical setup, a chat vendor stores transcripts in an Australian cloud region, such as AWS Sydney or Melbourne. It sends each message to an offshore model provider to generate an answer. The Australian database location settles only one part of the data flow. Assess the offshore processing and its contractual controls under APP 8 too. Neither an Australian address nor a local server removes that step.
Privacy Impact Assessment Before Launching an AI Agent
A privacy impact assessment (PIA) identifies how a project affects people’s privacy and how you will reduce those risks. Start with a threshold assessment before adding a chat agent. A tool handling health details or linking transcripts to customer accounts needs more scrutiny than anonymous product questions. The OAIC’s PIA guide recommends assessing projects early enough to change their design.
Map each data item to its purpose and every recipient. Then document collection notices, access controls and retention. Record who owns the remaining risks and what must change before launch. Use the OAIC’s privacy impact assessment tool to capture the assessment and recommendations.
| Shopping-agent data | Questions to answer | Relevant principles |
|---|---|---|
| First name | Is greeting by name necessary, and can the customer ask anonymously? | APP 2, APP 3 and APP 5 |
| Loyalty tier | Why does the agent need it, and does it disclose it to a provider? | APP 3, APP 6 and APP 8 |
| Order details | How is identity checked before order information appears? | APP 6, APP 10 and APP 11 |
| Full transcripts | What unexpected details arrive, who reads them and when are they disposed of? | APP 4, APP 11, APP 12 and APP 13 |
For a hypothetical clothing store, the assessment finds that product advice needs no name or order history. The store keeps anonymous browsing available and requests verified identity only for order support. It disables model training on transcripts and restricts staff exports. Before launch, the manager checks that notices match the vendor contract and that access requests can retrieve the customer’s records. These are example controls, not a finding about a named vendor.
Access Requests and Privacy Complaints About Chat Records
APP 12 gives customers access to personal information you hold about them, subject to exceptions. Accept requests without insisting on a special form. Verify identity proportionately and search chat records as well as account and order data, including records you control through vendors. Reply within a reasonable period. The OAIC’s access-request guide says this usually won’t exceed 30 calendar days.
Provide the personal information in a usable form and protect other people’s information. If refusing access, explain the applicable reason and available complaint process in writing. Keep a record of the request and response.
For a privacy complaint, acknowledge receipt, assign an investigator and examine the relevant chat and vendor records. Reply in writing with your findings and proposed remedy. Explain that the customer can take the complaint to the OAIC. Its privacy complaint guidance allows escalation after an unsatisfactory response or no response within 30 days.
Australia doesn’t have a general Privacy Act right to be forgotten. APP 12 provides access, while APP 13 requires reasonable steps to correct information that is inaccurate or otherwise deficient for its purpose. The OAIC’s correction guidance explains correction requests. APP 11’s disposal duties still apply when data is no longer needed. The proposed erasure right described below is a separate reform, not an existing right to delete every retail record.
Notifiable Data Breaches and Breach Response
The Notifiable Data Breaches (NDB) scheme requires covered entities to notify the OAIC and affected people about eligible breaches. Eligibility involves unauthorised access, disclosure or loss likely to cause serious harm, where remedial action hasn’t prevented that risk. A leaked transcript containing identity details and health information can create that risk. The OAIC’s NDB guidance explains the assessment.
For a suspected eligible breach, take all reasonable steps to complete assessment within 30 calendar days of becoming aware of grounds for suspicion. The OAIC expects faster action where possible. This is an assessment period, not permission to delay notification of a breach already known to be eligible.
Write your breach response plan around four steps:
- Contain the breach. Restrict affected access and preserve evidence while stopping further exposure.
- Assess the information involved, who can access it and the likelihood of serious harm. Record remedial action and the assessment decision.
- Notify the OAIC and affected customers promptly when the breach is eligible. Explain what happened, the information involved and steps customers can take.
- Review the cause and update controls, staff procedures and vendor arrangements.
Follow the OAIC’s breach response resources and obtain advice for the actual incident. Your plan must name the person authorised to coordinate the response and contact providers.
Privacy Reform and the Children’s Online Privacy Code
Privacy reform includes changes already passed and proposals that still need legislation. The Attorney-General’s Department’s reform overview explains the 2024 amendment Act. Its commencement schedule separates the provisions that operate now from those with a later start.
The statutory tort for serious invasions of privacy is in force. It gives individuals a court action for qualifying serious privacy invasions and can reach entities outside APP coverage. It doesn’t mean every privacy mistake creates a successful claim. Read the OAIC’s explanation of the court remedy and get legal advice about its conditions.
Automated-decision disclosure duties have passed, with commencement scheduled later in 2026. They cover certain computer-assisted decisions using personal information that could significantly affect someone’s rights or interests. A covered privacy policy must describe the information used and the relevant kinds of decisions. The OAIC’s automated-decision guidance gives the commencement boundary and scope.
A product recommendation doesn’t automatically meet that test. Assess the decision’s effect, especially for eligibility or fraud decisions.
The Children’s Online Privacy Code remains a draft. It is intended for covered online services likely to be accessed by children, including specified social media, electronic and internet services. Stores serving minors must assess whether their service falls within the final scope and prepare to meet any binding requirements. Serving minors alone doesn’t establish that every store is covered. The OAIC’s draft-code page explains its status and registration deadline.
The 2026 exposure draft proposes a fair and reasonable handling test, stronger consent standards and restrictions on trading personal information. Its proposed right to erasure concerns large digital platforms, such as social media and search services. Those proposals aren’t a settled general deletion right for retailers. The Attorney-General’s reform announcement describes the proposals, and the exposure-draft consultation identifies the draft legislation.
The Department of Industry’s Guidance for AI Adoption addresses data governance and human oversight. It doesn’t replace Privacy Act obligations. For the wider rules affecting AI, read the guide to AI regulation in Australia. Before launching a chat agent, document your store’s coverage, its data flows and the changes needed to meet each applicable rule.