The Australian Privacy Principles (APPs) are 13 principles in the Privacy Act 1988 that set out how covered organisations must collect, use, disclose, secure and correct personal information. They are overseen by the OAIC.
The Act generally covers government agencies and businesses with annual turnover above $3 million, plus some smaller businesses such as those that trade in personal information or provide health services. The principles cover open and transparent management, collection notices, direct marketing, overseas disclosure, data security, and access and correction rights.
For AI, the APPs apply when personal information goes into or comes out of a tool. A retailer should be clear with customers why data is collected, avoid using it for unrelated purposes, take care when a vendor sends data overseas, protect it with sensible security, and delete it when no longer needed. The OAIC has said the Act applies to AI use.
Pitfalls include assuming a small business is exempt without checking, relying on a vendor's promises without reading terms, and an out-of-date privacy policy. The Act has been amended in recent years and further changes, including transparency around automated decisions, are phasing in; check current rules with the OAIC or a lawyer.
It matters because breaches can bring investigations, penalties and loss of customer trust.