Sign in
Start free

Asia Pacific

Privacy Act 1988

Australia’s federal privacy law

Australia’s federal privacy law, built on 13 Australian Privacy Principles (APPs). Cookies that identify or could reasonably identify someone count as personal information. The Office of the Australian Information Commissioner (OAIC) enforces it. A first set of reforms passed in December 2024, and a draft second set was published for consultation in August 2026.

Start free
Run a free scan

At a glance

Notice

Region
Australia
Status
In force since 1989, reform in progress
Penalties
For a company’s serious interference with privacy, the greater of AUD 50 million, three times the benefit obtained or, if that cannot be worked out, 30% of adjusted turnover for the period. Lower penalty tiers and infringement notices were added in December 2024.
Who it affects
Australian Government agencies and private-sector organisations with annual turnover above AUD 3 million, plus all health service providers and some other categories regardless of size.

What the Privacy Act requires

  • Be open about how you handle personal information through a clear privacy policy.
  • Collect only personal information that is reasonably necessary.
  • Tell individuals about the collection at or before the time you collect their information, or as soon as practicable afterwards.
  • Allow access and correction of personal information you hold.
  • Take reasonable steps to secure personal information from misuse.
  • Notify the OAIC and affected individuals of eligible data breaches.

What the banner does here

There is no cookie-consent rule as such. The banner gives the notice and keeps a record where a cookie can identify someone.

How GrantCookie covers it

  • Scheduled scans. The scanner finds the cookies and trackers your site sets, sorts them into categories and re-checks on every scheduled scan, so the banner asks about what is really there.
  • Provable records. Every choice is timestamped and stored with the banner version the visitor saw. Paid plans include consent log export.
  • Changing a choice later. A re-open control stays on every page, so visitors can change their choice at any time.

See every feature

The consent log: each row has a timestamp in UTC, a consent ID and the visitor’s choice

This page is general guidance. It is not legal advice. Check your specific obligations with a qualified adviser.

Related regulations

All regulations

  • PDPA (Singapore)

    Notice

    Personal Data Protection Act 2012

    Singapore In force since 2014, major update in 2021

  • DPDP

    Opt-in

    Digital Personal Data Protection Act, 2023

    India Enacted 2023; consent rules apply from May 2027

  • PDPA (Thailand)

    Opt-in

    Personal Data Protection Act B.E. 2562 (2019)

    Thailand Fully enforceable since June 2022

Start free. No card, no sales call.

Scan your site, publish the banner, and move up a tier when you outgrow the free plan. Every plan is on the pricing page.

14-day trial on paid plans · Cancel any time · No card required to start

Start free
See every price