The 13 Australian Privacy Principles. From APP 1 to APP 13. Plain English.

Rule — Have a clearly-expressed and up-to-date privacy policy. Make it easily accessible. Link to it from every collection point.

In practice — Publish /privacy-policy on the public site. Reference it in every signup form, every contact form, every customer onboarding email.

Rule — Where lawful and practicable, give individuals the option to deal with you anonymously or under a pseudonym.

In practice — Support email signup without requiring legal name. Allow customer service contact without account creation. Document where APP 2 is unavailable and why.

Rule — Only collect what is reasonably necessary for your functions. Sensitive information requires consent under APP 3.3 (with limited exceptions).

In practice — No collecting fields you do not actually use. For health, biometric, or other sensitive information — capture explicit consent at the point of collection.

Rule — If you receive personal information you did not solicit, decide whether you could have lawfully collected it. If not, destroy or de-identify it.

In practice — Resume sent to a job-board automation that scrapes wider than the role? Decide whether keeping it is APP 3-compliant. If no — destroy within reasonable time.

Rule — At or before collection, tell the individual: who you are, why you are collecting, who you might disclose it to, and where they can read your privacy policy.

In practice — Every signup form, lead form, support form must show a collection notice with: name + ABN + reason + disclosure list + privacy policy link. Auto-rendered by XIntelliSync.

Rule — Only use or disclose personal information for the primary purpose you collected it. Secondary uses require consent OR a related-purpose test.

In practice — Customer email collected for invoicing cannot be used for unrelated marketing without consent. Marketing-list use requires APP 5 collection notice that flagged it.

Rule — Direct marketing using personal information requires either explicit consent OR a reasonable-expectation test plus an opt-out mechanism on every message.

In practice — Every email campaign carries a one-click unsubscribe (also a Spam Act 2003 requirement). Every SMS campaign accepts STOP replies. Honour opt-outs within 2 business days.

Rule — Before disclosing personal information overseas, ensure the foreign recipient is bound by substantially-similar privacy protection OR you have express consent.

In practice — When using overseas SaaS processors, contract them to APP-equivalent terms. Document the destination country. Disclose cross-border flows in the privacy policy.

Rule — Do not adopt a government identifier (TFN, Medicare number, driver licence) as your own customer ID. Restricted use and disclosure regime applies.

In practice — Never use TFN as a primary key in your database. Issue your own customer ID. TFN handler regime adds explicit-consent + secondary-use restrictions on top of APP 9.

Rule — Take reasonable steps to ensure personal information is accurate, up-to-date, complete, and (for use or disclosure) relevant.

In practice — Self-service profile editing for customers. Periodic data-quality prompts. Mark records as stale after defined inactivity. Document the steps taken to maintain quality.

Rule — Take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification, and disclosure.

In practice — Encryption at rest + in transit. Multi-factor authentication on admin access. Audit logs on every sensitive query. Automated incident response. Quarterly penetration testing.

Rule — On request, give an individual access to the personal information you hold about them within 30 days (with limited exceptions for legal-privilege or third-party rights).

In practice — Self-service data download in the customer portal. For non-customer access requests — documented intake process, identity verification, response within 30 days.

Rule — On request — or where you become aware of inaccuracy — correct personal information you hold. Notify any prior recipients of the correction where reasonable.

In practice — Self-service profile correction. Audit-log-backed correction trail. If a correction was disclosed to a third party — notify that third party of the corrected value.