Country-specific guidance Current

Privacy Act notices for client information requests

What you need to tell a client, and which principle actually requires it.

It's a common mix-up: the obligation to tell a client what you're collecting and why doesn't actually sit in APP 1. This guide sets out what APP 1 and APP 5 each require. It is general information, not legal or compliance advice.

Action plan

1 Know that APP 5, not APP 1, covers the collection notice APP 1 is about your firm's overall privacy policy; the point-of-collection notice is APP 5.

Australian Privacy Principle 1 requires your firm to have a clearly expressed, up-to-date privacy policy describing how it manages personal information generally. It does not itself require a notice at the point you collect a specific client's information. That obligation sits in Australian Privacy Principle 5, which requires taking reasonable steps to notify the individual, or ensure they're aware, of specific matters at or before collection.

  • Maintain a clearly expressed, up-to-date privacy policy under APP 1, separate from any collection notice
  • Treat the specific, per-collection notice as an APP 5 obligation, not an APP 1 one
  • Don't rely on your general privacy policy alone to satisfy the APP 5 collection-notice requirement

Done when: Your firm's privacy policy (APP 1) and its collection-notice practice (APP 5) are recognised as two distinct obligations

OAIC: APP 1 open and transparent management of personal information
2 Cover what APP 5 actually requires in the notice APP 5's own guidance lists the specific matters a collection notice needs to address.

OAIC's guidance on APP 5 sets out the matters a collection notice should cover: your firm's identity and contact details; the fact and circumstances of collection; whether collection is required or authorised by law; the purposes of collection; the consequences if the information isn't collected; your firm's usual disclosures of that kind of information; how to access the privacy policy for correction and complaint information; and whether the information is likely to be disclosed overseas.

  • Identify your firm and how to contact it
  • State the purpose of collection and the consequences of not providing the information
  • State your firm's usual disclosures and, where relevant, any likely overseas disclosure

Done when: The collection notice used covers the matters APP 5's own guidance describes

OAIC: APP 5 notification of the collection of personal information
3 Give the notice at or before collection Timing matters as much as content -- a late notice doesn't satisfy the obligation the same way.

OAIC's guidance on APP 5 describes the notice as required at or before the time your firm collects the individual's personal information, or as soon as practicable afterwards if that's not practicable. Build the notice into the collection step itself rather than treating it as something to send later.

  • Give the collection notice at or before the point of collection wherever practicable
  • Where that's genuinely not practicable, give it as soon as practicable afterwards
  • Don't treat the notice as optional follow-up correspondence

Done when: The collection notice is given at or before collection, or as soon as practicable afterwards

See requesting individual identity documents