GDPR and Privacy Act Comparison: What Australian Businesses Need to Know

Two Privacy Frameworks

Australian businesses may need to comply with both the Privacy Act 1988 (Australia) and the General Data Protection Regulation (GDPR - European Union). Understanding both is essential for businesses operating internationally.

The Australian Privacy Act

Who It Covers

The Privacy Act applies to:

• Australian Government agencies
• Businesses with annual turnover over $3 million
• Health service providers
• Businesses that trade in personal information
• Credit reporting bodies and credit providers
• Certain other specified organisations

Small businesses under $3 million are generally exempt, though some activities bring them into scope.

Key Requirements

The Australian Privacy Principles (APPs) require:

Enforcement

The Office of the Australian Information Commissioner (OAIC) enforces the Privacy Act:

• Investigation powers
• Enforceable undertakings
• Civil penalties up to $50 million for serious breaches

The GDPR

Who It Covers

GDPR applies to:

• Organisations established in the EU
• Organisations outside the EU that offer goods/services to EU residents
• Organisations that monitor behaviour of EU residents

Australian businesses with EU customers may fall within scope.

Key Requirements

GDPR requirements include:

Enforcement

EU data protection authorities enforce GDPR:

• Investigations and audits
• Corrective measures
• Fines up to €20 million or 4% of global annual turnover

Comparing the Frameworks

Scope and Application

GDPR has extraterritorial reach that can capture Australian businesses dealing with EU residents.

Consent Requirements

Both require consideration of consent, but GDPR is more prescriptive.

Individual Rights

GDPR provides more extensive individual rights.

Breach Notification

GDPR has stricter timing requirements.

Data Protection Officers

Data Transfer

GDPR is more restrictive on international transfers.

Penalties

Both can impose significant penalties.

Practical Compliance

Determine Applicability

Assess which frameworks apply:

1. Does your business fall under the Privacy Act? 2. Do you offer goods/services to EU residents? 3. Do you monitor behaviour of EU residents? 4. What personal information do you handle?

Implement Common Controls

Many requirements overlap:

• Privacy notices explaining data handling
• Consent mechanisms where required
• Data security measures
• Access and correction procedures
• Breach detection and response
• Staff training
• Data minimisation and retention practices

Address GDPR-Specific Requirements

If GDPR applies:

• Document lawful basis for processing
• Implement additional individual rights
• Prepare for 72-hour breach notification
• Consider data protection officer requirement
• Address international transfer requirements
• Conduct data protection impact assessments where required

Documentation

Both frameworks expect documentation:

• Privacy policies
• Processing records
• Consent records
• Breach response procedures
• Training records
• Security measures documentation

For Small Businesses

Even If Exempt from Privacy Act

Good practice regardless:

• Basic privacy practices build trust
• Prepares for growth or scope changes
• May be required by customers or partners
• Reduces risk of problems

If Dealing with EU Customers

Consider GDPR implications:

• May need to comply regardless of size
• Risk assessment for EU activities
• Proportionate compliance measures
• Consider whether EU market is worth the compliance burden

Proportionate Approach

Scale to your situation:

• Larger operations need more formal programs
• Small operations can implement basics
• Focus on high-risk areas first
• Improve over time

Common Mistakes

Assuming Exemption

Assuming rules do not apply:

• Small business exemption has exceptions
• GDPR applies based on customers, not size
• Even exempt organisations should follow good practice

Consent as Default

Relying on consent for everything:

• Other lawful bases may be more appropriate
• Consent must be genuine and withdrawable
• Over-reliance on consent creates problems

Ignoring International Aspects

Not considering cross-border implications:

• Where are customers located?
• Where does data flow?
• What laws apply in each jurisdiction?

Treating Compliance as One-Time

Set and forget:

• Both frameworks require ongoing compliance
• Regular review and updates needed
• New processing activities need assessment

Getting Help

When to seek professional advice:

Both privacy frameworks protect individuals while enabling legitimate data use. Understanding and complying with applicable requirements protects your business and builds trust with customers.