Laws

Australia's Privacy Act: access, correct and opt out of direct marketing

Quick answer

Australia's Privacy Act lets you ask a business or government agency for access to the personal information it holds about you, have it corrected for free, and opt out of its direct marketing. Agencies must reply within 30 days and businesses within a reasonable period, which the OAIC considers to be 30 days. Most businesses with an annual turnover of $3 million or less aren't covered.

“If an APP entity holds personal information about an individual, the entity must, on request by the individual, give the individual access to the information.”

All privacy laws
Applies in
Australia
In force since
Companies must answer within
Agencies: within 30 days of your request. Organisations: within a reasonable period, which the OAIC says it considers to be 30 days. Direct-marketing opt-outs must also be actioned within a reasonable period (APP 12, APP 13 and APP 7).
Regulator
Office of the Australian Information Commissioner (OAIC)
Last updated

By Anthon Wansland

Head of Product & Co-Founder

Reviewed by Ludwig Sandgren

Head of Legal

Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.

Sources checked: legislation.gov.au, oaic.gov.au

Last verified against the official page:

How we research this Report an error

Australian Government agencies and organisations with an annual turnover of more than $3 million, plus some other organisations. A business with a turnover of $3,000,000 or less is a small business, and most small business operators are exempt. Most states and territories have separate laws for their own public sector.

Your rights

  • Access to your personal information

    A business or agency that holds your personal information must give you access when you ask, unless an exception applies, such as a serious threat to safety, an unreasonable impact on someone else's privacy, a frivolous or vexatious request, legal proceedings or unlawfulness. A refusal must be in writing, with reasons and how to complain (APP 12).

  • Correction

    Ask for information that's inaccurate, out of date, incomplete, irrelevant or misleading to be corrected. If it refuses, you get written reasons and can ask for a statement to be attached to the information. The request, the correction and the statement are all free (APP 13).

  • Opting out of direct marketing

    Ask an organisation to stop sending you direct marketing, to stop using or disclosing your information so others can market to you, and to tell you where it got your information. It can't charge and must act within a reasonable period (APP 7).

  • Complaining to the OAIC

    Lodge a written complaint with the Information Commissioner. The Commissioner generally won't investigate unless you've complained to the organisation first (Privacy Act s. 40).

  • Suing for a serious invasion of privacy

    Since 10 June 2025 you can go to court over a serious intrusion upon seclusion or misuse of information. You generally have the earlier of 1 year from when you became aware, or 3 years from when it happened. The OAIC doesn't administer this and says to get independent legal advice (Privacy Act Schedule 2).

General information, not legal advice.

How to use it

  1. 1

    Contact the business or agency

    Ask the organisation or agency that holds your information. Only you, or someone you've authorised, can request access, and the entity has to be satisfied the request came from you.

  2. 2

    Put it in writing if asked, and say how you want it

    You may be asked to make the request in writing and to give identifying information. Say how you want access (a copy by email or post, or to view it) and whether you're authorising someone else to deal with it.

  3. 3

    Expect an answer in about 30 days

    Agencies must respond within 30 days. Organisations must respond within a reasonable period, which the OAIC considers to be 30 days. An organisation can charge for giving you access, but not for making the request, and the charge can't be excessive. Agencies can't charge at all.

  4. 4

    Ask for corrections or opt out of marketing

    Ask for wrong information to be corrected, which is free. To stop marketing, use the unsubscribe link or tell the caller, and ask the organisation where it got your details. Telemarketing calls are covered separately by the Do Not Call Register.

  5. 5

    Complain to the organisation first

    If something goes wrong, complain to the organisation or agency. If it doesn't respond within 30 days, or you're not happy with the response, you can go to the OAIC. Some complaints have to go to an approved external dispute resolution scheme first, such as AFCA for banks.

  6. 6

    Lodge a written complaint with the OAIC

    On the OAIC's lodge a privacy complaint page, choose Submit a privacy complaint via our online form, or download the form and email or post it. Complaints can't be made by phone. Include the organisation's name, what happened and when, your complaint to the organisation and its reply, any reference numbers and the outcome you want.

No answer in time? Complain to Office of the Australian Information Commissioner (OAIC) .

The $3 million question

Before you write to anyone, check whether the Act covers them. It applies to Australian Government agencies and to organisations with an annual turnover above $3 million, plus some others. Most businesses under that line are exempt. The latest compilation of the Act (No. 104, in effect from 4 June 2026) still has the $3 million test.

So a request to a large retailer or bank has the law behind it. A request to a small local business may not, and it can simply decline.

Why an organisation can refuse access

APP 12 lists exceptions. The common ones: giving access would pose a serious threat to someone's safety, would unreasonably affect another person's privacy, relates to legal proceedings, or would be unlawful. A request can also be refused as frivolous or vexatious. Whatever the reason, the refusal has to be in writing, with reasons and your complaint options.

There's no general right to have your data deleted. The closest you get is a correction request, where deleting out-of-date or irrelevant information can be the fix.

Marketing: two other laws to know

The Privacy Act doesn't apply to direct marketing covered by the Spam Act 2003 or the Do Not Call Register Act 2006, and both of those are managed by ACMA, not the OAIC. For you the fix is usually simple anyway. Click unsubscribe, reply STOP to a text, or add your number to the Do Not Call Register.

Recent and coming changes

A statutory tort for serious invasions of privacy started on 10 June 2025. It reaches further than the Privacy Act (it isn't limited to APP entities), but it runs through the courts, not the OAIC.

From 10 December 2026, according to the OAIC, privacy policies must explain substantially automated decisions that significantly affect people. The OAIC also says the Children's Online Privacy Code must be registered by that date.

Where Serus fits

The Privacy Act works one organisation at a time, and it doesn't reach small businesses at all. Serus finds the data brokers and people-search sites that list you where you live and sends the removal requests. It follows up when they go quiet and checks for relistings. If there are only one or two organisations you care about, the steps above are free. Run a free scan to see where you're listed.

Data brokers that list people in Australia

Each guide shows how to opt out of that site, step by step.

All data broker guides
Serus

Let Serus send the requests for you

Serus finds the data brokers that list you where you live and removes you from them.

Run a free scan

Related

Frequently asked

Does the Privacy Act apply to small businesses?

Generally not. It covers organisations with an annual turnover of more than $3 million and some others. A business with a turnover of $3,000,000 or less counts as a small business, and most are exempt.

Can a company charge me for my personal information?

An organisation can charge for giving you access, but not for making the request, and the charge can't be excessive. Government agencies can't charge.

How long does an organisation have to respond?

A reasonable period, which the OAIC says it considers to be 30 days. Agencies must respond within 30 days.

Is there a right to have my data deleted in Australia?

Not as a standalone right like the GDPR's. When you ask for a correction, the reasonable steps an organisation takes can include deleting information. The OAIC describes correction as adding, changing or deleting your personal information.

Can I complain to the OAIC straight away?

Generally no. You first need to complain to the organisation. If it doesn't respond within 30 days or you're unhappy with the answer, you can complain to the OAIC in writing.

What changed in Australian privacy law recently?

A statutory tort for serious invasions of privacy started on 10 June 2025. From 10 December 2026, according to the OAIC, privacy policies must describe substantially automated decisions that significantly affect people.

Sources

Something wrong or out of date? Tell us and we'll re-check it.

Cookie preferences

Choose which categories we may use. Full details for every cookie are in our Cookie Policy.

Strictly necessary

Authentication, session management, security and fraud prevention, and saving your consent choice. Always active. The site cannot function without them.

Functional

Remember preferences such as language and settings that improve your experience.

Analytics

Help us understand how the site is used, like pages visited, interactions, and performance, so we can improve it.

Marketing & advertising

Measure our marketing and deliver more relevant ads through partners such as Google, Meta, TikTok, X, and Reddit. Used only with your consent.

Your choice is saved for 12 months and applies across serus.ai, including the app. You can change it anytime from the cookie widget or the "Cookie settings" link in the footer. Withdrawing consent does not affect processing that happened before withdrawal.