privacy-act-apps

Privacy Act 1988 and the Australian Privacy Principles

The Privacy Act 1988 (Cth) is the Australian Commonwealth's general privacy statute. It contains 13 Australian Privacy Principles (APPs) in Schedule 1, which bind APP entities (most Commonwealth agencies and most private-sector organisations with annual turnover above AUD 3 million, plus specific categories such as health service providers and credit-related entities). The Office of the Australian Information Commissioner (OAIC) is the regulator.

The Notifiable Data Breaches (NDB) scheme in Part IIIC of the Act applies where an eligible data breach occurs.

This skill helps an agent reason about APP obligations, draft privacy artefacts, and respond to suspected breaches.

When to use this skill

• The user is reviewing whether a system or feature complies with one or more APPs.
• The user is writing a Privacy Impact Assessment, a collection notice, a privacy policy, or an NDB notification.
• The user is designing data flows that handle personal information and wants the privacy controls baked in early.
• The user is responding to a suspected breach and needs the NDB scheme criteria.
• The user is integrating a third-party SaaS or cloud service that will receive personal information.
• The codebase contains signals that engage personal information handling: user registration / authentication, contact-form processing, customer support exports, marketing list management, analytics that captures user identifiers.

What this skill knows

• The 13 Australian Privacy Principles, one per file under apps/.
• The Notifiable Data Breaches scheme, in ndb-scheme.md.
• How APP obligations are usually evidenced in software (data flow diagrams, retention policies, access controls, third-party agreements).
• The relationship between Privacy Act obligations and ISM controls (the same encryption, access-control and logging evidence often satisfies both).

In scope: APP entities under the Privacy Act 1988, OAIC guidance, NDB scheme.