Privacy and Personal Data in Victoria
Reviewed by the Commoner Law Editorial Team. Sourced from Commonwealth Acts of Parliament, federal regulations, and official government guidance. State-level information reflects each state's own Acts and court decisions. Written in plain language for general understanding — this is educational content, not legal advice. Our editorial standards
What is this right?
The Privacy Act 1988 and the 13 Australian Privacy Principles (APPs) govern how organisations handle your personal information:
- Who it covers: Australian Government agencies, private sector organisations with annual turnover over $3 million, and all health service providers, regardless of size. Some small businesses are also covered if they trade in personal information or provide services under a Commonwealth contract.
- Right to know (APP 1 & 5): Organisations must tell you what information they collect, why, and who they share it with through a clear privacy policy.
- Right to access and correct (APP 12 & 13): You can request access to your personal information and ask for corrections if it is wrong.
- Data breach notification: Since February 2018, organisations must notify you and the Office of the Australian Information Commissioner (OAIC) about data breaches that are likely to result in serious harm.
- Penalties: Serious or repeated privacy breaches carry penalties of up to $50 million, three times the benefit obtained, or 30% of adjusted domestic turnover (whichever is greatest).
When does it apply?
- An organisation covered by the Privacy Act collects, uses, or discloses your personal information.
- You want to access or correct personal information an organisation holds about you.
- You believe an organisation has breached your privacy or failed to notify you of a data breach.
- Note: employee records held by a current or former employer are generally exempt from the APPs (except for government agencies).
What to Do If an Australian Organisation Has Misused or Breached Your Personal Data
- Check the organisation’s privacy policy to understand how they handle your data.
- To access or correct your data, make a written request to the organisation. They must respond within 30 days.
- If you believe your privacy has been breached, complain to the organisation first. If unresolved after 30 days, lodge a complaint with the OAIC at oaic.gov.au.
- If you receive a data breach notification, follow the recommended steps to protect yourself (change passwords, monitor accounts).
What should you NOT do?
- Don’t assume every business is covered — most small businesses (under $3 million turnover) are exempt unless they handle health information or meet other criteria.
- Don’t ignore data breach notifications — act quickly to protect your accounts and identity.
- Don’t confuse privacy with defamation — the Privacy Act protects your data, not your reputation.
How Victoria differs from federal law
Privacy protection in Victoria involves the federal Privacy Act 1988 (Cth) for private organisations and the Privacy and Data Protection Act 2014 (Vic) (PDP Act) for Victorian Government agencies.
- The PDP Act 2014 regulates how Victorian Government departments, statutory authorities, local councils, and contracted service providers collect, use, store, and disclose personal information. It contains 10 Information Privacy Principles (IPPs).
- The Health Records Act 2001 (Vic) provides additional protections for health information held by both Victorian Government and private health service providers.
- The Office of the Victorian Information Commissioner (OVIC) oversees compliance with the PDP Act and handles complaints about breaches by Victorian Government entities.
- Victoria has a Protective Data Security Framework under the PDP Act, requiring Victorian Government agencies to implement specific data security standards.
- For private-sector organisations, the federal Privacy Act (administered by the OAIC) applies. The federal Notifiable Data Breaches scheme applies to private organisations with turnover exceeding $3 million.
Additional Steps in Victoria
For complaints about Victorian Government agencies, contact the Office of the Victorian Information Commissioner (OVIC) (ovic.vic.gov.au or 1300 006 842). For private-sector privacy complaints, contact the OAIC (oaic.gov.au). For health information complaints, contact OVIC under the Health Records Act.
Relevant Law: Privacy and Data Protection Act 2014 (Vic); Health Records Act 2001 (Vic); Privacy Act 1988 (Cth); Freedom of Information Act 1982 (Vic)
Common Questions
When does privacy and personal data apply?
An organisation covered by the Privacy Act collects, uses, or discloses your personal information.You want to access or correct personal information an organisation holds about you.You believe an organisation has breached your privacy or failed to notify you of a data breach.Note: employee records held by a current or former employer are generally exempt from the APPs (except for government agencies).
What should I do if a company in Australia has mishandled my personal data or suffered a data breach?
Check the organisation’s privacy policy to understand how they handle your data.To access or correct your data, make a written request to the organisation. They must respond within 30 days.If you believe your privacy has been breached, complain to the organisation first. If unresolved after 30 days, lodge a complaint with the OAIC at oaic.gov.au.If you receive a data breach notification, follow the recommended steps to protect yourself (change passwords, monitor accounts).
What mistakes should I avoid with privacy and personal data?
Don’t assume every business is covered — most small businesses (under $3 million turnover) are exempt unless they handle health information or meet other criteria.Don’t ignore data breach notifications — act quickly to protect your accounts and identity.Don’t confuse privacy with defamation — the Privacy Act protects your data, not your reputation.
Privacy and Personal Data in other states
Same topic, different jurisdiction. Pick the one that applies to you.