Privacy Act 1988 (Cth), incorporating the Australian Privacy Principles

Australia does not use the established-presence/offering/monitoring model — forcing it into that shape would be imprecise, so it's flagged here. The Act applies only to an 'APP entity' with an 'Australian link' (s5B): Australian citizens/residents, entities formed in Australia, or — for foreign entities — one that 'carries on business in Australia' (real, repeated, profit-directed activity; a mere accessible website is not enough). Modeled here as an established-presence trigger only. Small business operators (annual turnover up to AUD 3 million) remain generally exempt under s6D, unless an exception applies (health-service providers holding health information, entities trading in personal information, or Commonwealth-contracted providers) — removing this exemption has been recommended and remains government policy, but as of this writing it has not been legislated, so do not plan on it having lapsed. Three changes from the Privacy and Other Legislation Amendment Act 2024 do bite now or shortly: a statutory tort for serious invasions of privacy applies to conduct on or after June 10, 2025 and is available against any defendant, including entities the Privacy Act itself exempts; APP 1 transparency obligations for substantially automated decision-making that significantly affects individuals must be reflected in privacy policies by December 10, 2026; and 'tranche 2' AML/CTF reporting entities (real estate agents, dealers in precious metals and stones, lawyers, conveyancers, accountants, trust and company service providers) come within the Privacy Act for their AML/CTF activities from July 1, 2026.