Privacy Act 1988 for Accountants

The Privacy Act covers accounting practices above its turnover threshold and some smaller practices. Every practice holding an individual’s TFN has separate duties, regardless of turnover.

Does the Privacy Act Apply to Your Practice?

A practice covered by the Australian Privacy Principles is an APP entity. Most businesses with annual turnover above $3 million fall within that framework. A smaller practice must assess the exceptions before claiming the small business exemption.

The Office of the Australian Information Commissioner (OAIC) has a small business checklist. Its turnover calculation includes income from all sources, with specified exclusions. A single quiet year does not necessarily restore the exemption.

Document the answers to these coverage questions:

• Whether the practice is related to a larger body corporate covered by the Act.
• Whether it provides services under a Commonwealth contract.
• Whether it trades in personal information outside the relevant consent or legal-authority exceptions.
• Whether it has voluntarily opted into the Act.
• Whether it is an anti-money laundering and counter-terrorism financing reporting entity or an authorised agent of one.

The reporting-entity provision can cover a small practice’s AML/CTF activities without automatically extending to every other activity. Record both the reason for coverage and its scope.

Holding a client’s medical receipt does not itself mean the practice provides a health service. Apply the actual statutory category to the services you provide.

Once coverage is established, the Australian Privacy Principles govern how you handle personal information. Keep a data breach response plan for incidents that require assessment and possible notification.

The Privacy (TFN) Rule for Tax Practices

The Privacy (Tax File Number) Rule 2015 applies to TFN recipients, including small practices exempt from the APPs. A recipient is anyone holding or controlling a record containing an individual’s TFN information, even if obtained unlawfully.

The OAIC’s TFN guidance requires lawful collection and restricted use. Client consent alone does not authorise an otherwise prohibited use of a TFN.

When requesting a TFN, explain the authorising law and collection purpose. State that refusing to quote it is not an offence, and explain the consequences of refusal.

Restrict access to staff who need the TFN for an authorised purpose. Protect paper files as well as electronic records, train staff and securely destroy or permanently de-identify TFN information when the Rule requires it.

For example, a practice cannot use a client’s TFN as a general identity number across unrelated services. A legitimate tax purpose for collecting it does not authorise every later use.

Tax Genie removes every TFN before AI review. It keeps each TFN hidden until a staff member reveals it and records every reveal, so the practice can see who accessed it.

Privacy Law Reform and What Changes

The 2024 amendments introduced changes with different commencement arrangements. Separate provisions already operating from provisions awaiting commencement and proposals that have not become law.

The amending legislation adds civil penalties for interferences with privacy below the serious-interference threshold. It also permits infringement or compliance notices for specified failures, including privacy-policy obligations.

A breach need not reach the highest penalty tier before enforcement becomes possible.

The statutory tort for serious invasions of privacy operates from 2025. It gives individuals a court action that can reach defendants outside APP coverage. A small practice’s exemption from the APPs is therefore not blanket protection from privacy proceedings.

The tort concerns serious, intentional or reckless invasions through intrusion or misuse of information. A reasonable expectation of privacy and a public-interest balance also form part of the test.

Courts can grant damages or injunctions, subject to statutory defences and exemptions.

Further reform remains a separate exercise. The Attorney-General’s Department’s 2026 exposure-draft consultation concerns proposed changes, not a replacement Act already operating.

The government’s reform announcement describes proposals for fair and reasonable handling, stronger consent and restrictions on trading information. It also describes an erasure proposal directed at large digital platforms.

The small business exemption remains part of the coverage assessment. Its proposed removal has been considered through the wider reform review. Do not assign your practice a removal deadline from a policy proposal.

Automated Decision-Making Disclosures

The automated decision-making additions to APP 1 have a delayed commencement in 2026. The OAIC’s commencement and consultation page identifies the exact boundary. The obligation applies to relevant decisions made after commencement, including under older software arrangements.

An APP entity must describe relevant automated decisions in its privacy policy when personal information is used and the decision could reasonably significantly affect an individual’s rights or interests.

The rule includes a computer making the decision itself. It also includes a computer doing something substantially and directly related to making that decision. A staff member’s final approval does not automatically exclude the arrangement.

The required disclosures identify the kinds of personal information used. They distinguish decisions made solely by computer from decisions for which a computer performs that substantial and direct part.

For a practice, assess an automated client-acceptance refusal against that test. Compare it with spelling assistance on an email, which does not by itself establish a qualifying decision. The task and its consequences determine coverage, not the AI label.

Record the tool’s input and output, the decision it affects and the staff member’s actual role. That record gives the privacy officer a basis for deciding what the policy must disclose.

Appointing a Privacy Officer

Give one person responsibility for day-to-day privacy work. In a small practice, that can be the principal or practice manager, with authority to obtain records and escalate problems.

The OAIC’s privacy management framework recommends clear responsibilities and senior accountability. It does not mean every private accounting practice must create a separate full-time position.

The government-agency Privacy Officer requirements have a different scope. Do not copy that agency appointment rule into your practice policy as a universal private-sector requirement.

The practice privacy officer needs a usable record of:

• Why the practice is covered, including any activity-specific coverage.
• What personal information it holds and which providers hold copies.
• Collection notices, policy versions and staff training.
• Access, correction and deletion requests, with decisions and reasons.
• Privacy incidents and actions taken.
• New software assessments and changes to data handling.

Name a backup for absences and explain when an issue goes to the principal. A mailbox without a responsible person leaves client requests unassigned.

Client Requests to Delete Their Data

Australian privacy law does not give every client a general right to be forgotten. The OAIC’s comparison with European erasure rights explains this difference.

APP 11 requires reasonable steps to destroy or de-identify personal information no longer needed for a permitted purpose. Exceptions include information an Australian law or court order requires you to retain.

The APP 11 guidance explains the retention and disposal tests.

A client’s departure does not erase record-keeping obligations. The business record-keeping guidance explains that most business records need five years, with some categories requiring longer. That is not one universal period for every document in a client file.

For a hypothetical departing client, separate required tax records from duplicate downloads and obsolete contact details. Identify the legal or permitted purpose for each retained category, restrict access and set a review point.

Reply with what you deleted, what you retained and the reason for retention. Record the decision and arrange disposal when the remaining retention requirement ends. Apply the TFN Rule separately to any retained TFN information.