The Privacy Act 1988 is the Commonwealth law governing how many organisations collect, use, store and disclose personal information. At its core are the 13 Australian Privacy Principles (APPs), covering matters such as openness, collection notices, direct marketing, security of information, and access and correction rights.
The Act applies to Australian Government agencies and to many private organisations, including most businesses with annual turnover above $3 million. Some smaller businesses are also covered, for example those that provide health services or trade in personal information. The Office of the Australian Information Commissioner (OAIC) oversees it, and the Notifiable Data Breaches scheme sits within it.
In retail and hospitality it affects loyalty programs, email marketing lists, online accounts, CCTV, staff records and booking systems. Practical steps include collecting only what is needed, telling customers why, keeping data secure, deleting it when no longer needed, and taking care when sending data to overseas software providers.
The privacy framework has been under reform, with some changes made and others proposed in recent years. Check current requirements with the OAIC or a lawyer rather than relying on older summaries, and confirm whether your business is covered at all.
IT security measures such as multi-factor authentication, patching and backups are how the "reasonable steps" to protect personal information are often demonstrated. This entry is general information, not legal advice.