Laws and data licensing
Australia: privacy laws and AI data licensing
Short answer
If your records include people in Australia, the main rules are: Privacy Act 1988 and the Australian Privacy Principles.
In short
- Country
- Australia
- Main privacy laws
- Privacy Act 1988 and the Australian Privacy Principles.
- Note
- De-identified information generally falls outside the Act.
- Last reviewed
- 2026-10-09
- 01Your work records
- 02Personal details removed
- 03You approve the release
- 04Licensed to AI developers
What to know#
De-identified information generally falls outside the Act.
For suppliers#
- SourceX works with businesses based in Australia when at least 90% of their records are in English
- Records tied to other countries are reviewed against their rules or excluded
- Personal details are removed before anything is shared
Does the Privacy Act cover a business whose records might be licensed?#
Usually yes for larger businesses, and sometimes for small ones too. The Act applies to organisations with annual turnover above A$3 million, counting all income from all sources. A business at or under that line is generally exempt, but the exemption falls away for some activities.
The exception that matters most for licensing is trading in personal information: a small business that discloses personal information for a benefit, service or advantage is covered by the Act. Selling a customer list is the OAIC's own example. A small business can also opt in to the Act voluntarily.
- Turnover above A$3 million: the Australian Privacy Principles (APPs) apply
- Turnover at or below A$3 million but disclosing personal information for a benefit: covered as trading in personal information
- Health service providers and residential tenancy database operators: covered regardless of turnover
- Otherwise exempt small business: may still opt in to the Act
When can Australian records be reused or de-identified for a new purpose?#
Under APP 6, personal information may be used or disclosed for the purpose it was collected for; a different purpose needs consent or an exception. The most common exception is that the person would reasonably expect the secondary use and it is related to the original purpose, or directly related for sensitive information such as health records.
The OAIC treats reasonable expectation as an objective test the business must be able to justify, and it lists de-identifying information as a normal internal practice that people may expect. Disclosing identifiable records to another company for AI work is a separate question and rarely passes this test without consent or clear notice at collection.
De-identified information falls outside the Act only while no one in the records is reasonably identifiable. The OAIC asks for the risk to be very low, judged in the context of who receives the data and what else they hold, so the same data can be personal information in one setting and de-identified in another. Information re-identified from a de-identified set is personal information again, and doubtful cases should be treated as personal.
What does APP 8 require before records go to a recipient outside Australia?#
Before disclosing personal information to an overseas recipient, a business must take reasonable steps to ensure the recipient does not breach the APPs, usually through an enforceable contract. Under section 16C the Australian business stays accountable for the recipient's breaches, even after taking reasonable steps, unless an exception applies.
The routes below are the ones most often considered. Properly de-identified data is not personal information, so APP 8 does not apply to it.
| Route | What it requires | Effect on APP 8.1 and section 16C |
|---|---|---|
| Reasonable steps (APP 8.1) | Steps suited to the risk, normally a contract binding the recipient to APP-level handling; more rigorous for sensitive information | Applies; the Australian business stays accountable under section 16C |
| Substantially similar law (APP 8.2(a)) | A reasonable belief the recipient is bound by a law or scheme substantially similar overall to the APPs, with enforcement mechanisms open to the individual | APP 8.1 does not apply |
| Informed consent (APP 8.2(b)) | The person is expressly told APP 8.1 will not apply and then consents | APP 8.1 does not apply |
| Required or authorised by law | An Australian law or court order requires or authorises the disclosure | APP 8.1 does not apply |
What changed with the 2024 amendments, and what is still coming?#
The Privacy and Other Legislation Amendment Act 2024 was the first tranche of reform; most of its changes within the OAIC's remit took effect on 11 December 2024, with later dates for some measures. It did not change the small business exemption or the definition of de-identified information.
SourceX can consider companies in Australia when the data they offer is at least 90% English, confirmed on the actual dataset; every dataset still goes through rights, privacy, quality and buyer-fit review.
| Change | Status | Why it matters for records |
|---|---|---|
| APP 11.3: reasonable security steps include technical and organisational measures | In force; applies to information held after 11 December 2024 | Technical and organisational measures count toward reasonable security steps |
| Infringement notices for administrative APP breaches | In force for conduct after 11 December 2024; up to 60 penalty units per contravention for a company | The OAIC states the maximum in penalty units, not dollars |
| Statutory tort for serious invasions of privacy | Commenced 10 June 2025 | Individuals can sue directly for serious invasions of privacy |
| Automated decision transparency in privacy policies | Starts 10 December 2026 | Policies must describe personal information used in automated decisions that affect people |
| Children's Online Privacy Code | Must be registered by 10 December 2026; commencement date not yet set | Records from apps, games or sites likely used by children face added rules |
Sources for this section
- The small business exemption covers annual turnover of A$3 million or less, but businesses trading in personal information, health service providers and residential tenancy database operators are covered, and small businesses can opt in. Source
- APP 6 allows secondary use or disclosure on a reasonable-expectation exception that requires a related purpose, or a directly related purpose for sensitive information; de-identifying is listed as a normal internal practice. Source
- De-identified information is not about a reasonably identifiable individual, re-identification risk should be very low in context, re-identified information is personal information, and doubtful cases should be treated as personal. Source
- APP 8.1 requires reasonable steps, usually an enforceable contract, before overseas disclosure; section 16C keeps the Australian entity accountable; APP 8.2 exceptions include a substantially similar law, express informed consent and disclosures required or authorised by law. Source
- The Privacy and Other Legislation Amendment Act 2024 commenced in December 2024, with most amendments in the Commissioner's remit commencing on 11 December 2024. Source
- APP 11.3 states that reasonable security steps include technical and organisational measures and applies to information held after 11 December 2024. Source
- Infringement notices apply to conduct after 11 December 2024, with up to 60 penalty units per contravention for a body corporate. Source
- The statutory tort for serious invasions of privacy commenced on 10 June 2025. Source
- From 10 December 2026, privacy policies must describe the personal information used in automated decisions that may affect individuals' rights or interests. Source
- The Children's Online Privacy Code must be registered by 10 December 2026 and covers online services likely to be accessed by children. Source
Frequently asked questions
Which privacy laws apply to records about people in Australia?
Privacy Act 1988 and the Australian Privacy Principles. De-identified information generally falls outside the Act.
Can a company based in Australia license its data through SourceX?
Yes, when at least 90% of the company's records are in English. U.S. companies are SourceX's priority, records are reviewed against the rules that apply, and personal details are removed before anything is shared.
Can a U.S. business license records that include customers in Australia?
Records tied to Australia are reviewed against its rules or excluded from the license, and personal details are removed before anything is shared.
What happens to records that cannot be cleared?
Records that can't be cleared under the rules that apply are excluded, and the company approves every release before data moves.
General information, not legal advice. Laws change and their application depends on your facts. SourceX assesses which rules apply deal by deal with your counsel. Last reviewed 2026-10-09.