Home › Compare laws side by side › Privacy Act / APPs vs EU GDPR

Privacy Act / APPs vs EU GDPR

Privacy Act 1988 (Cth), as amended by the Privacy and Other Legislation Amendment Act 2024 (Australia) compared with Regulation (EU) 2016/679 (General Data Protection Regulation) (European Union (EEA)) on the same topics. Every value comes from the law pages, which link to the official sources.

Topic	Privacy Act / APPs Australia 11/14 facts confirmed by two sources	EU GDPR European Union (EEA) ✓ Confirmed by two sources
Status	In force. POLA Act 2024 assented 10 Dec 2024; most changes from 11 Dec 2024; statutory privacy tort from 10 Jun 2025; automated-decision disclosure from 10 Dec 2026; Children's Online Privacy Code due by 10 Dec 2026. Further 'tranche 2' reforms not yet introduced.	In force since 25 May 2018. Digital Omnibus amendments proposed Nov 2025, not adopted as of Oct 2026.✓
Who it applies to	Australian Government agencies and private organisations with over A$3m annual turnover (plus listed exceptions). Overseas organisations are covered if they have an 'Australian link', e.g. carrying on business in Australia, even without a physical presence.	Any organisation processing personal data in the context of an EU establishment, plus non-EU organisations that offer goods/services to people in the EU or monitor their behaviour there.✓
Size thresholds	Small business exemption: A$3m or less turnover is exempt, unless it is a health provider, trades in personal data, is a Commonwealth contractor, a credit reporting body, or covered by AML/CTF, among others. Firms over A$3m in any year since 2002 stay covered.✓	None — applies regardless of size. Limited record-keeping relief for organisations under 250 staff (Art 30(5)), lost if processing is risky, not occasional, or includes special-category or criminal data.✓
Regulator	Office of the Australian Information Commissioner (OAIC)✓	National data protection authorities (DPAs), coordinated by the European Data Protection Board (EDPB)✓
Breach or incident reporting	Notifiable Data Breaches scheme: assess a suspected breach within 30 days; if serious harm is likely, notify the OAIC and affected individuals (or publish a statement if direct notice is impractical).✓	Notify the competent supervisory authority without undue delay and within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to individuals (Art 33). If you have an EU main establishment, that is your lead authority; if you have no EU establishment (even with an EU representative), notify the authority of every member state where affected people live (EDPB Guidelines 9/2022, para 73). Tell affected individuals without undue delay if the risk is high (Art 34).✓
Deadline to answer personal data requests	Being verified	1 month from receipt; extendable by 2 further months for complex requests if the person is told within the first month. Free of charge unless manifestly unfounded or excessive.✓
Data protection officer	No legal requirement for a DPO for private organisations; the OAIC recommends one as good practice.✓	DPO mandatory for public bodies, and where core activities involve large-scale regular and systematic monitoring, or large-scale processing of special-category or criminal-offence data.✓
Local representative	No local representative requirement.✓	Non-EU controllers/processors caught by Art 3(2) must appoint an EU representative in writing, unless processing is occasional, low-risk and excludes large-scale sensitive data, or they are a public body.✓
Sending data abroad	Before disclosing data overseas, take reasonable steps so the recipient complies with the APPs; you usually stay liable for their acts. Exceptions: similar foreign law, informed consent, legal requirement. Since Dec 2024 the government can whitelist countries; none listed yet.✓	Transfers outside the EEA need an adequacy decision (e.g. UK, Switzerland, EU-US Data Privacy Framework), or safeguards such as Standard Contractual Clauses or Binding Corporate Rules, or a narrow Art 49 derogation.✓
Cookies and consent	No specific cookie law; the APPs apply when cookies collect personal information. Sensitive information generally needs consent; direct marketing must offer an opt-out.✓	Cookie/tracker consent is governed by the ePrivacy Directive Art 5(3); where consent is the GDPR legal basis it must be freely given, specific, informed, unambiguous and as easy to withdraw as to give.✓
Maximum penalty	Serious interferences: greater of A$50m, 3x the benefit gained, or 30% of domestic turnover. Lower tier up to A$3.3m; infringement notices for administrative breaches. Individuals can also sue under the statutory tort.✓	Up to EUR 20 million or 4% of total worldwide annual turnover, whichever is higher (lower tier: EUR 10 million or 2%).✓

= confirmed by two independent sources, at least one official.

Facts marked “Being verified” are still being confirmed and are not given as answers.

Who each law applies to

Privacy Act / APPs: Australian Government agencies and private organisations with over A$3m annual turnover (plus listed exceptions). Overseas organisations are covered if they have an 'Australian link', e.g. carrying on business in Australia, even without a physical presence.
EU GDPR: Any organisation processing personal data in the context of an EU establishment, plus non-EU organisations that offer goods/services to people in the EU or monitor their behaviour there.

What you must do under Privacy Act / APPs

Check whether you are covered: A$3m+ turnover, a listed exception, or an Australian link
Keep an up-to-date APP privacy policy; from 10 Dec 2026 disclose substantially automated decisions
Take reasonable technical and organisational steps to secure personal information
Assess suspected breaches within 30 days and notify the OAIC and individuals if serious harm is likely
Take reasonable steps so overseas recipients comply with the APPs before disclosing data abroad
If your online service is likely used by children, prepare for the Children's Online Privacy Code

Full Privacy Act / APPs page, sources and checklist

What you must do under EU GDPR

Identify a lawful basis for every processing purpose and record it.
Publish a clear privacy notice covering purposes, recipients, retention and rights.
Keep a record of processing activities and sign Art 28 contracts with processors.
Run a DPIA before high-risk processing such as large-scale profiling or sensitive data.
Report qualifying breaches within 72 hours (lead authority, or every relevant DPA if you have no EU establishment) and log all breaches.
Answer access, erasure and other rights requests within one month.

Full EU GDPR page, sources and checklist

Partner

Termly

Create and maintain a privacy policy, cookie banner and request forms.

Create your privacy policy with Termly

Partner link: we may earn a commission if you buy, at no extra cost to you. It never affects our legal content. Affiliate disclosure

Information only, not legal advice. Laws change; confirm with the regulator or a qualified lawyer before relying on this page. Spotted an error? Email contact@glancedeskjurisdiction.com.