GDPR vs Australian Privacy Act: 90 day checklist for compliance teams

Most Australian organisations answer to the Privacy Act, not the GDPR: the trigger for GDPR exposure is EU establishment, offering goods or services to EU residents, or monitoring their behaviour. The single biggest operational shift is structural. GDPR splits duties between controllers and processors, while the Privacy Act makes every APP entity directly responsible for the personal information it holds, with no equivalent split, and its own enforcement risk if you get the mapping wrong.

---

TL;DR:

• Australian organizations must assess EU exposure by checking if they have an establishment, offer goods or services, or monitor EU residents; many SaaS and e-commerce businesses fall under GDPR even without a physical EU presence.
• Unlike GDPR’s control/processor split, the Privacy Act makes each APP entity directly responsible for personal information regardless of how it’s obtained or outsourced, increasing compliance obligations.
• GDPR requires documented legal bases and specific roles like a Data Protection Officer, while the Privacy Act relies on principles and flexibility, demanding different organizational practices and recordkeeping.
• GDPR grants rights like erasure and data portability, which do not have direct Australian equivalents; Australian entities respond through existing APP processes, generally without mandated response times.
• Sending personal data overseas requires thorough due diligence and contractual safeguards under GDPR (Chapter V) and APP 8, with practical measures including mapping data flows, contractual clauses, and data localization for high-risk categories.

---

Table of Contents

• Scope and purpose: mapping GDPR and the Privacy Act for Australian entities
• Operational differences: terminology, legal bases and organisational duties
• Comparing individual rights and compliance obligations
• Cross-border disclosures: chapter V vs APP 8 and practical controls
• Actionable compliance steps for Australian organisations that face GDPR and/or APP obligations
• Regulatory enforcement: fines, penalty units and OAIC powers
• Children’s Online Privacy Code and other recent Australian reforms
• Checklist: immediate actions, short-term fixes and a 90-day programme
• Publisher E-E-A-T: how Australian-hosted platforms reduce regulatory friction
• Author perspective: a pragmatic, risk-based stance for Australian teams
• A practical option for reducing cross-border exposure
• Authoritative primary sources and guidance
• Sources
• FAQ

Scope and purpose: mapping GDPR and the Privacy Act for Australian entities

Working out which law governs a given activity starts with territorial reach, and the two regimes draw that line very differently.

GDPR applies through three tests. An organisation is caught if it has an establishment in the EU, if it offers goods or services to people in the EU (even without charging for them), or if it monitors the behaviour of people located in the EU, such as through website analytics or targeted advertising. An Australian business with no EU office can still fall under GDPR if it runs a checkout in euros, ships to EU addresses, or profiles EU visitors for marketing purposes. That is the exposure test compliance teams need to run first, and it is a “yes” for more organisations than most boards expect, particularly SaaS platforms, e-commerce brands and anyone using EU-facing tracking pixels.

The Privacy Act works on a different logic. It covers Australian government agencies and private sector organisations with an annual turnover exceeding $3 million, along with specific categories regardless of size, such as health service providers, credit reporting bodies and businesses that trade in personal information, according to the Privacy Act legislation summarised by the OAIC. Overseas entities that carry on business in Australia and collect or hold personal information here also fall within scope, which matters for any foreign parent company running Australian operations. Small businesses under the threshold are generally exempt, though the exemption has been under sustained review and should never be treated as permanent.

The policy aims behind each law shape how prescriptive they are day to day. GDPR was built as a harmonised, rights-first regime for the entire EU bloc: it spells out lawful bases, mandates specific documentation, and gives regulators uniform enforcement powers across member states. The Privacy Act takes a principles-based route instead. The 13 Australian Privacy Principles set out what entities must achieve, such as collecting only what is reasonably necessary or taking reasonable steps to secure information, without dictating the exact mechanism for getting there. That flexibility is deliberate, and legal commentators note Australia has modernised its regime with GDPR’s influence clearly visible while preserving a bespoke, principle-driven model rather than importing it wholesale.

For a compliance team, the practical upshot is this: run the GDPR territorial test on every EU-facing product or campaign, run the turnover and category test for the Privacy Act, and expect some organisations, especially those selling into Europe or handling EU customer data through a subsidiary, to be subject to both.

Operational differences: terminology, legal bases and organisational duties

Once you know which law applies, the terminology and duties diverge sharply, and this is where teams most often misapply GDPR habits onto an APP framework, or the reverse.

GDPR draws a hard line between controllers, who decide the purpose and means of processing, and processors, who act on a controller’s instructions. Each role carries distinct obligations: controllers answer for lawful basis and transparency, processors answer for security and sub-processing controls, and a data processing agreement sits between them. Australian law skips that split entirely. Any APP entity that holds personal information is directly responsible for complying with the Australian Privacy Principles, whether it collected the information itself or received it from another party. There is no controller/processor carve-out to shelter a downstream vendor from accountability, which means outsourcing a function to a third party never transfers away your own APP obligations.

Legal bases work differently too. GDPR requires a lawful basis for every processing activity, chosen from six options: consent, contract necessity, legal obligation, vital interests, public task or legitimate interests. The Privacy Act does not run on a lawful-basis model at all. Instead, APP entities must collect only information that is reasonably necessary for their functions, and the OAIC’s guidance on GDPR and the Privacy Act treats consent as one of several relevant factors rather than the anchor for every activity. In practice, an Australian entity relying on “legitimate interests” language borrowed from a GDPR privacy notice is speaking a language the APPs do not recognise, and should instead document why the collection was reasonably necessary for a stated function.

Organisational duties follow the same pattern of GDPR precision versus APP flexibility.

• GDPR mandates a Data Protection Officer for public authorities and organisations engaged in large-scale monitoring or special category processing, with a defined role and reporting line.
• GDPR requires a Data Protection Impact Assessment before high-risk processing begins, following a prescribed risk methodology.
• The Privacy Act has no DPO mandate, but APP 1.2 expects entities to implement practices, procedures and systems that ensure APP compliance, effectively a privacy management framework rather than a named role.
• Privacy Impact Assessments are recommended by the OAIC for higher-risk projects but are not universally mandatory outside government agencies bound by specific direction.

For privacy notices and recordkeeping, GDPR’s transparency obligations are longer and more itemised, listing lawful basis, retention periods, data subject rights and transfer mechanisms in each notice. APP 5 requires clear notification of collection purposes and likely disclosures but leaves the format and depth to the entity’s judgement. Teams running both regimes often find it simpler to build one GDPR-standard notice and layer an APP-compliant summary on top, rather than maintaining two structurally different documents.

Comparing individual rights and compliance obligations

Individual rights are where the two regimes diverge most visibly, and where Australian entities most often assume protection they do not actually have to provide.

GDPR grants data subjects a defined set of rights: erasure (“the right to be forgotten”), portability (receiving data in a machine-readable format to transfer elsewhere), access, rectification and objection to processing, including for direct marketing. The OAIC’s comparative guidance is explicit that erasure and portability in particular have no direct APP equivalent. That gap surprises a lot of Australian privacy teams building programmed against a GDPR checklist, because two of its headline rights simply do not exist as standalone rights under Australian law.

Handling requests that echo GDPR rights still requires action under the APPs, just through a different mechanism:

1. For a deletion-style request, APP 11.2 requires reasonable steps to destroy or de-identify personal information once it is no longer needed for any purpose it was collected for, rather than granting an unconditional erasure right on demand.
2. For an access-style request, APP 12 gives individuals a right to access their personal information held by an entity, with defined exceptions, functioning much like GDPR’s access right but without the one-month statutory response clock.
3. For a portability-style request, there is no formal mechanism under the APPs, so entities typically respond through the APP 12 access process and provide data in a reasonably usable format rather than a technically mandated one.
4. For an objection to direct marketing, APP 7 gives individuals a right to opt out of receiving marketing communications, which lands close to GDPR’s objection right in practical effect.

Recordkeeping and accountability expectations follow the same divide. GDPR requires many controllers and processors to maintain formal records of processing activities, documenting categories of data, purposes, recipients and retention periods, and to produce them to a regulator on request. The Privacy Act carries no equivalent records-of-processing mandate, but the OAIC expects entities to have a documented privacy management framework under APP 1.2, covering how the entity identifies risk, trains staff and handles complaints. The paperwork looks different, but regulators on both sides increasingly want to see that a decision was reasoned and recorded, not just made.

Cross-border disclosures: chapter V vs APP 8 and practical controls

Sending personal information overseas is one of the few areas where both regimes impose a genuine before-the-fact obligation, and the mechanics are worth getting right before data starts moving.

GDPR’s Chapter V restricts transfers of personal data outside the EEA unless a valid mechanism applies. The main routes are an adequacy decision (the European Commission has assessed the destination country’s laws as offering equivalent protection), Standard Contractual Clauses, Binding Corporate Rules for intra-group transfers, or a narrow set of derogations for specific situations. Following the Schrems II decision, the European Data Protection Board’s guidance on supplementary measures makes clear that exporters cannot rely on SCCs alone. They must verify that the destination country’s laws do not undermine the protection SCCs are meant to provide, and add contractual or technical supplementary measures, such as encryption with keys held outside the recipient’s jurisdiction, where they do not.

APP 8 takes a different structural approach. Before disclosing personal information to an overseas recipient, an APP entity must take reasonable steps to ensure the recipient does not breach the APPs, unless an exception applies. Section 16C then makes the disclosing entity accountable for acts or practices of the overseas recipient as if they were its own, which puts real weight behind the word “reasonable” and means due diligence on the recipient is not optional paperwork.

Practical controls that satisfy both frameworks:

• Map every cross-border data flow, including cloud hosting, support vendors and SaaS subprocessors, before assessing what mechanism applies.
• Build contractual clauses into vendor agreements that mirror APP 8 obligations and, where GDPR applies, incorporate current Standard Contractual Clauses.
• Add supplementary measures such as encryption or pseudonymisation where a recipient jurisdiction cannot be verified as offering comparable protection.
• Consider data localisation for high-risk categories, particularly health and financial information, where reasonable steps are hard to evidence for an overseas recipient.

Compliance officers assessing offshore hosting arrangements often work through a structured set of questions before signing off, covering how data sovereignty affects cross-border risk, and it is worth running that exercise before a vendor contract is signed rather than after an incident.

Actionable compliance steps for Australian organisations that face GDPR and/or APP obligations

Turning the comparison into a workplan starts with a clear-eyed test of exposure, then moves into governance, contracting and breach readiness.

1. Run the GDPR triage test first: check every EU-facing website, app or campaign for EU establishment, EU-directed offers, or monitoring of EU residents, and flag anything that fails the test for immediate legal review.
2. Appoint a privacy lead with clear authority, and maintain records of processing activities for any function that touches EU data subjects, even if the rest of the business only answers to the APPs.
3. Adopt a documented privacy management framework under APP 1.2, covering collection practices, staff training, complaint handling and periodic review, so the OAIC sees an active programme rather than a static policy document.
4. Run a Privacy Impact Assessment, or a full Data Protection Impact Assessment where GDPR applies, before launching any high-risk project, and keep the risk-based reasoning on file even when a full DPIA is not mandatory.
5. Update vendor contracts to include processor obligations where GDPR applies and overseas recipient clauses where APP 8 applies, layering in Standard Contractual Clauses or supplementary measures as needed, with technical controls such as properly configured TLS/SSL certificates forming part of the baseline security case.
6. Build a breach playbook covering detection, severity assessment and notification triggers, and test it against a realistic scenario rather than leaving it as a policy nobody has rehearsed. Detailed breach notification obligations and timelines differ enough between regimes that a single generic playbook rarely covers both properly.

Pro Tip: Run the GDPR exposure test annually, not once. A single new EU-facing marketing campaign or an analytics tool change can flip an Australia-only business into GDPR scope overnight.

Practical controls to avoid unnecessary offshore exposure while you work through this list are covered in more detail in a guide to preventing offshore transfers when deploying AI, which is worth a look before any new AI vendor is onboarded.

Regulatory enforcement: fines, penalty units and OAIC powers

Boards weighing risk appetite need to understand just how differently the two regimes bite when something goes wrong.

EEA regulators have shown a willingness to use the top tier against large multinational platforms, and enforcement practice across member states has matured into a genuine deterrent rather than a theoretical ceiling.

Australia’s penalty structure works through penalty units rather than a percentage of turnover. Recent reforms raised the maximum civil penalty for serious or repeated interferences with privacy to up to 2,000 penalty units, introduced through the Privacy and Other Legislation Amendment Act 2024. The OAIC also gained expanded enforcement powers under that Act, including infringement notices for specific offences and stronger investigative tools, marking a shift from a largely advisory regulator toward one with more direct enforcement teeth.

The practical difference for risk appetite is straightforward. A multinational with EU exposure faces fines calculated against global turnover, which can dwarf an Australia-only penalty in absolute terms. An Australia-only entity now faces a materially higher ceiling than it did before the 2024 reforms, and a regulator more willing to use its powers. Neither risk profile supports treating either regime as the soft option, and disclosure decisions after an incident should be tested against both exposure paths, not just the one that seems most immediately relevant.

Children’s Online Privacy Code and other recent Australian reforms

The Privacy and Other Legislation Amendment Act 2024 does more than raise penalties, and one of its most consequential elements for consumer-facing organisations is the mandate for a dedicated Children’s Online Privacy Code.

The Code is built around the best interests of the child as its central organising principle, and OAIC commentary on its direction points to tighter data minimisation and deletion obligations for services likely to be accessed by children. Expect stricter consent standards for collecting children’s data, design expectations that discourage default settings which maximise data collection, and closer scrutiny of behavioural advertising aimed at younger users. The 2024 Act itself formally mandates the Code alongside broader changes to the Privacy Act’s objects and enforcement provisions.

For any service that might reasonably be accessed by children, even if it is not explicitly designed for them, practical readiness now means a few concrete things. Review default privacy settings on any platform likely to attract younger users, and set them to the most protective option rather than the most engagement-friendly one. Document the “necessary” test for any data collected from or about children, because regulators tend to read that word narrowly and expect a specific justification rather than a general business rationale. Audit advertising and profiling practices for anything that targets or could plausibly reach children, and be ready to show how design choices reflect the best interests principle rather than commercial convenience.

None of this replaces a full legal review once the Code’s specific rules are finalised, but organisations that wait until then to start the audit will be doing it under time pressure rather than on their own schedule.

Checklist: immediate actions, short-term fixes and a 90-day programme

Turning everything above into a sequence helps a compliance team avoid the trap of trying to fix everything at once.

1. Immediate (this week): Map every data flow that could trigger EU exposure and identify the highest-risk cross-border transfers currently in operation.
2. Immediate: Update privacy notices so collection purposes, retention and disclosure practices are current and accurate, even before deeper structural changes are made.
3. Short-term (this quarter): Revise vendor and processor contracts to include APP 8 and, where relevant, GDPR-compliant clauses, adding Standard Contractual Clauses or equivalent safeguards where transfers demand them.
4. Short-term: Build and test a breach standard operating procedure that covers detection, severity assessment and notification timing for both regimes where both apply.
5. 90-day programme: Schedule Privacy Impact Assessments (or DPIAs where GDPR applies) for any high-risk project in the pipeline, and lock in a training schedule for staff who handle personal information.
6. 90-day programme: Appoint a privacy lead or DPO where the GDPR threshold requires one, and run a data retention and minimisation audit across every system holding personal information.

Treat this as a rolling programme rather than a one-off exercise. The 2024 reforms and the Children’s Online Privacy Code will keep shifting the baseline, and a compliance function that revisits this checklist twice a year will stay ahead of most of its peers.

Publisher E-E-A-T: how Australian-hosted platforms reduce regulatory friction

Data sovereignty means personal information stays subject to Australian law throughout its lifecycle, hosted and processed within Australian jurisdiction rather than passed to an overseas server governed by a different legal regime. That distinction matters directly for APP 8, because reasonable steps and section 16C accountability are far easier to evidence when there is no overseas recipient in the chain to assess in the first place.

An Australia-hosted private cloud removes a category of risk rather than mitigating it after the fact: there is no cross-border disclosure to map, no foreign jurisdiction’s laws to verify, and no supplementary measures to negotiate. For regulated sectors such as health, finance and debt collection, where APP 11 security obligations and sector-specific rules stack on top of the general APPs, keeping data within Australian borders simplifies the compliance evidence a board or regulator will eventually ask to see.

Author perspective: a pragmatic, risk-based stance for Australian teams

Chasing full GDPR equivalence when only the Privacy Act applies wastes budget on controls the law never asked for. The smarter path is proportional: adopt GDPR-grade measures, like DPIAs and detailed processing records, for genuinely high-risk processing, and rely on the APPs’ flexibility everywhere else, provided every departure is reasoned and written down. Boards should expect governance evidence, not just policy documents, because that is increasingly what the OAIC and EU regulators alike are asking to see.

— Sowrabh

A practical option for reducing cross-border exposure

Mapping every offshore data flow and negotiating supplementary measures for each one is real work, and some organisations would rather remove the exposure than manage it. Some conversational AI platforms run multichannel solutions covering voice, SMS, email and live chat, hosted within an Australian private cloud, which can help reduce overseas disclosure issues relevant to APP 8 and section 16C.

For businesses in health, finance, debt collection or real estate, where data residency scrutiny is highest, that Australian hosting also means audit evidence for a regulator is simpler to produce than for a platform routing data through offshore infrastructure. The Conversational AI CRM integrates with existing systems without moving personal information outside Australian jurisdiction, and industry-specific deployments are available for healthcare, banking and finance and debt collection. Teams wanting maximum control can also review the on-premises deployment option. Check current plans and book a walkthrough at Conversationalai.

Authoritative primary sources and guidance

For the legal detail behind this comparison, consult the Privacy Act 1988 text, the OAIC’s guidance on GDPR and the Privacy Act, the EDPB’s recommendations on transfer safeguards, and the Privacy and Other Legislation Amendment Act 2024.

This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.

Sources

• The Privacy Act (OAIC)
• EDPB recommendations on supplementary measures for transfers
• Legislation

FAQ

Does Australia have an equivalent to GDPR?

Australia does not have a direct equivalent to GDPR. The Privacy Act 1988 covers similar ground through the Australian Privacy Principles, but it takes a principles-based approach without GDPR’s controller and processor split or its erasure and portability rights.

Are privacy policy and GDPR the same?

No, a privacy policy is a document, while GDPR is a law. Under both GDPR and the Privacy Act, organisations must publish a privacy policy or notice, but GDPR sets far more detailed content requirements than the Australian Privacy Principles do.

What is the GDPR in Australia?

GDPR is an EU law, not an Australian one, but it can still apply to an Australian organisation with an EU establishment, EU-facing offers, or monitoring of people in the EU. When it applies, an Australian business must meet GDPR obligations alongside any Privacy Act duties that also apply.

What is the current Privacy Act in Australia?

The current law is the Privacy Act 1988 (Cth), as amended by the Privacy and Other Legislation Amendment Act 2024. That amendment raised civil penalties for serious interferences with privacy to up to 2,000 penalty units and mandated a Children’s Online Privacy Code.

Recommended

• Australian Data Sovereignty: 12 Questions Compliance Officers Must Ask
• Act now: Notifiable data breaches for Australian compliance teams
• 90 Day APRA CPS 234 AI Playbook for Australian Compliance
• 90 Day Compliance Fix for IT: Data Residency vs Sovereignty