Data & Privacy

No, it is not allowed. Australian law requires businesses to clearly explain why they collect your personal information before or at the time of collection.

You can complain to the Office of the Australian Information Commissioner (OAIC), seek correction or deletion of your information, and in some cases apply for compensation. The Privacy Act 1988 (Cth) prohibits unauthorised disclosure of health information.

Yes, collecting your facial recognition data without consent is likely a privacy breach under Australia’s Privacy Act, which requires notice and consent for handling sensitive biometric information.

Yes, it is likely a breach of the Privacy Act 1988 (Cth) if a company uses your personal information for a purpose different from the one they disclosed at collection, unless an exception applies.

Yes, if the breach is likely to result in serious harm to you, the company must notify you and the OAIC within 30 days under Australia’s Notifiable Data Breaches (NDB) scheme.

You can complain to the OAIC, seek compensation from the business, and report the breach to your financial institution — businesses must notify you and the OAIC if your credit card data is compromised under the Privacy Act.

The company may face a civil penalty of up to $2.1 million for failing to notify the OAIC of an eligible data breach under the Privacy Act.

You may complain to the Office of the Australian Information Commissioner (OAIC) and seek compensation if the leak breached the Privacy Act 1988 (Cth), as your former employer likely mishandled your personal information without consent.

Yes, in most cases Australian companies must comply with a valid request to delete your personal data under the Privacy Act 1988, unless an exception applies.

Yes, you have a legal right to access your personal information held by most Australian companies under the Privacy Act 1988.

In most cases, it is illegal for your employer to record your phone calls without your knowledge or consent in Australia.

Your stored text messages are protected under the Telecommunications Act 1997 (Cth), which prohibits unauthorised access to stored communications, including SMS.

It may be unlawful for your company to read personal emails on work devices without consent, as it could breach privacy laws and workplace surveillance rules.

Yes, in many cases Australian police can access phone metadata without a warrant under the Telecommunications Act and related laws.

No, it is illegal for a private investigator to intercept your phone conversations in Australia without your consent, as this breaches the Telecommunications (Interception and Access) Act 1979.

You have the right to stop unsolicited marketing emails under Australia’s Spam Act, and the sender must honour your unsubscribe request within 5 business days.

Yes, it is against the law in Australia for a company to send a commercial text message without including clear sender identification.

You can report spam emails with no unsubscribe option to the Australian Communications and Media Authority (ACMA) via their online complaint form.

Yes, you can complain to the Office of the Australian Information Commissioner (OAIC) if a social media platform collects more personal information than necessary for its functions.

Yes, but only if the company takes reasonable steps to ensure your personal information is protected to a standard comparable to the Australian Privacy Principles (APPs), or you consent after being informed of the privacy risks.

You can request a correction in writing to the government agency holding your information under the Privacy Act 1988. They must respond within 30 days and correct it if the information is inaccurate, out-of-date, incomplete, irrelevant or misleading.

A government department in Australia may share your tax records with another agency only if permitted by law — for example, under the Taxation Administration Act 1953 for debt recovery, or under specific authorisations in the Privacy Act 1988 or other legislation.

You may be protected under Australia’s whistleblower laws, which prohibit dismissal or victimisation for making a protected disclosure about misconduct at work.

Yes, the Privacy Act applies to your small business even with under $3 million turnover — because it handles personal information in connection with providing a service or product to you.

Yes, you may be protected under the Corporations Act 2001 (Cth) if you made a 'protected disclosure' to an eligible recipient and met all legal requirements.