- The law
- Privacy Act 1988, Australian Privacy Principles 11, 12 and 13
- Who enforces it
- Office of the Australian Information Commissioner (OAIC)
- Penalties
- Civil penalties for serious interferences with privacy of up to A$50 million for a company, or 3 times the benefit gained, or 30% of turnover if the benefit can't be worked out. Lesser breaches can carry up to 2,000 penalty units
What it means for your email
- If the Privacy Act applies to your organisation, a subscriber can ask for access to the personal information you hold about them (APP 12) and for it to be corrected (APP 13).
- The OAIC's guidelines say an organisation must respond "within a reasonable period after the request is made", and that "a reasonable period should not exceed 30 calendar days" as a general guide.
- There's no general right to have information deleted, but APP 11 says you must take reasonable steps to destroy or de-identify personal information you no longer need, unless a law requires you to keep it.
Do
- Log each request with a reference and its deadline when it arrives.
- Find the person's information in your email platform and anywhere else it's kept, and give access or correct it.
- Review old subscriber data regularly and remove what you no longer need.
- Keep a record of what you did.
Don't
- Don't charge for making a request, and don't charge an excessive amount for giving access.
- Don't put the person's details in tools that don't need them.
Good to know
- Unsubscribing from commercial emails is a separate rule under the Spam Act: act on it within 5 working days.
- Whether the Privacy Act applies depends on your organisation (many small businesses are exempt): check with your legal team.
Sources
- Chapter 12: APP 12 Access to personal information (OAIC)
- Privacy Act 1988 (Federal Register of Legislation)
Researched by Mailfois · 2026/27 edition · checked 20 October 2026
Not legal advice. This is a plain-English summary. Check the sources for anything specific, or take professional advice. Spotted something out of date? Email [email protected] and we'll credit you if you'd like.