The Australian Privacy Principles are 13 rules governing how covered organisations handle personal information, from collecting a client’s details to deleting records they no longer need. For a mortgage brokerage, they affect the fact find, document storage and every disclosure to a lender or service provider.
The Privacy Act 1988 is the Commonwealth law behind the APPs. An Australian credit licence does not, by itself, settle whether your brokerage must comply with all 13 principles.
Does the Privacy Act Apply to Your Brokerage?
The Privacy Act generally covers private-sector organisations with annual turnover above $3 million and some smaller businesses. An APP entity is an agency or organisation covered by the APPs. A company can be covered, as can a sole trader, partnership or trust.
Most small business operators with turnover of $3 million or less are exempt from the APPs. Exceptions include credit reporting bodies, certain businesses trading in personal information and businesses that opt in. Related-company rules and previous turnover can also remove the exemption. The OAIC’s small business guidance explains these tests.
Credit-related work needs a separate assessment. A credit reporting body is different from a broker or lender. The OAIC confirms that a small business credit provider can be exempt from the APPs while still having credit reporting obligations.
Section 6H of the Privacy Act 1988 can treat an agent performing specified tasks for a credit provider as a credit provider. The contract and the actual role matter. Handling loan applications does not support a blanket claim that every mortgage broker is an APP entity.
Record the basis for your brokerage’s coverage. Also review the privacy commitments in your aggregator and lender agreements. Those commitments can require practices beyond the statutory minimum that applies to your business.
Personal and Sensitive Information
Personal information is information or an opinion about an identified person, or someone who can reasonably be identified. In a loan file, that can include a client’s income, address and borrowing position. It also includes opinions recorded about the client.
Sensitive information is a defined subset with stronger protections. Examples include health information, racial or ethnic origin, union membership and criminal records. Financial information needs strong protection, but its financial nature alone does not make it sensitive information under the Act. The OAIC’s definitions explain the distinction.
The 13 Australian Privacy Principles
The 13 APPs cover the full life of a client record. This summary applies the OAIC’s Australian Privacy Principles guidelines to everyday brokerage work.
| APP | What it requires | Brokerage example |
|---|---|---|
| 1: Privacy management | Maintain privacy practices and a clear policy explaining how you handle personal information. | Give staff a process for privacy complaints and publish the policy clients can request. |
| 2: Anonymity and pseudonymity | Allow people to deal anonymously or under a pseudonym unless a legal exception or practical barrier applies. | Answer a general question about refinancing without demanding identity documents, while requiring identification for an application where necessary. |
| 3: Information you request | Collect only information reasonably necessary for your functions using lawful and fair means, with consent generally also required for sensitive information unless an exception applies. | Ask for evidence needed to assess the client’s loan, without collecting unrelated medical history. |
| 4: Information you did not request | Assess whether unsolicited information could have been collected under APP 3, then apply the retention or disposal rules. | Review an unexpected attachment instead of saving it automatically to the client file. |
| 5: Collection notification | Take reasonable steps to explain the relevant collection matters at collection, or as soon as practicable afterwards. | Tell a client why you need their payslips and the kinds of recipients who usually receive the information. |
| 6: Use and disclosure | Use or disclose information for its collection purpose, or a permitted secondary purpose. | Send application information to the lender for the disclosed loan purpose, then assess any proposed unrelated referral separately. |
| 7: Direct marketing | Follow the applicable restrictions and opt-out requirements when using personal information for marketing. | Honour a client’s request to stop marketing and assess email or telephone campaigns under the relevant communications laws. |
| 8: Overseas disclosure | Before an overseas disclosure, take reasonable steps to prevent the recipient breaching the APPs other than APP 1, unless an exception applies. | Assess an offshore processor’s handling of client files before granting access. |
| 9: Government identifiers | Restrict adoption, use and disclosure of government-related identifiers unless an exception applies. | Give the client an internal file number instead of adopting their driver licence number as your customer identifier. |
| 10: Information quality | Take reasonable steps to keep collected information accurate, current and complete, with relevance also considered when using or disclosing it. | Confirm changed employment details before sending a new application. |
| 11: Security and disposal | Protect held information and take reasonable steps to destroy or de-identify it when the disposal conditions apply. | Restrict file access to authorised staff and remove surplus copies under a documented retention process. |
| 12: Access | Give people access to their personal information on request, subject to the permitted exceptions. | Verify a client’s identity before securely providing the information they request. |
| 13: Correction | Take reasonable steps to correct information when requested or when satisfied it is wrong for its purpose. | Correct a misstated income figure and address copies previously disclosed where the notification requirements apply. |
For APP 4, disposal depends on whether destruction or de-identification is lawful and reasonable. Commonwealth records have a separate exception. APP 7 also yields to the Spam Act and Do Not Call Register Act to the extent those laws apply.
Collecting Client Information
APP 3 limits what you collect, while APP 5 governs what you tell the client about that collection. A signed privacy consent does not remove the need to justify collecting each category of information.
Under APP 3, an organisation’s collection must be “reasonably necessary” for its functions or activities. Collect directly from the client unless that is unreasonable or impracticable. Assess sensitive information against its additional consent requirement and any applicable exception.
Data minimisation means asking for the information needed for the task and avoiding unnecessary collection. Privacy by design puts those limits into the process before staff start collecting files.
For example, design the fact find so questions match the advice and application being prepared. Explain document requirements before inviting uploads. Avoid an unrestricted request for every financial document the client holds. Where identity verification requires a document, control who receives the copy and how long it remains necessary.
Information from a third party still needs a lawful collection basis. A client’s accountant sending financial statements does not remove your APP 3 obligations. Nor does a referral give unlimited permission to collect the referred person’s details.
The APP 5 collection notice requirements apply to direct collection and collection from others. Explain your identity, purposes and usual disclosures. Explain the relevant consequences if information is withheld. Cover access and complaints, plus likely overseas recipients and their countries where practicable. Deliver the notice before or at collection where practicable.
Using, Disclosing and Sending Data Overseas
APP 6 requires a permitted purpose for sharing client information, and APP 8 can add obligations when the recipient is overseas. A secure transmission method alone does not establish permission to disclose.
Under APP 6, secondary use or disclosure needs consent or another exception. One exception covers a related purpose the client would reasonably expect. For sensitive information, that purpose must be directly related. Other exceptions include disclosure required or authorised by Australian law.
Map the information each lender or aggregator receives to the purpose explained to the client. Restrict the material to that purpose. An unrelated referral to another business needs its own assessment.
For offshore staff, establish whether access is an internal use or disclosure to a separate recipient. Assess the entity’s actual control over the information. For cloud services and AI tools, assess the information entered and who can access or reuse it.
APP 8 generally makes the Australian entity accountable for an overseas recipient’s mishandling, subject to exceptions. Assess the recipient’s safeguards and put enforceable handling terms in place where appropriate. Telling a client that information may go overseas is different from satisfying APP 8.
A general consent to overseas processing does not automatically satisfy the specific informed-consent exception that removes APP 8.1 protection. Assess that exception against its actual conditions before relying on it.
Securing, Correcting and Deleting Client Data
APP 11 requires security controls and a reason to retain information. APPs 12 and 13 give clients rights to access and correct their personal information.
Reasonable security steps include technical and organisational measures. For a brokerage, practical controls include individual accounts, access based on job duties, secure transfer methods and staff privacy training. Review access when someone changes roles or leaves.
Under APP 11, take reasonable steps to destroy or de-identify information you no longer need for a permitted purpose. This disposal obligation has exceptions for Commonwealth records and retention required by Australian law or a court or tribunal order.
Set retention rules by record type and the obligations that apply to it. Settlement does not automatically end the need for a loan file. A client’s deletion request does not override a legal retention requirement. Include downloaded copies and email attachments in the retention process.
APP 12 requires access on request, subject to its exceptions. Confirm who is asking and protect other people’s information when responding. An organisation must respond within a reasonable period. If refusing access, follow the written-notice and complaint requirements.
APP 13 also requires action when you identify an error yourself. Record the correction and consider information already disclosed. If the client asks, take reasonable steps to notify other APP entities of a correction unless that would be impracticable or unlawful. Do not charge the client to request or make a correction.
The Privacy Officer and Policy
Give one person responsibility for the brokerage’s privacy processes and keep the APP 1 policy consistent with those processes. In a small brokerage, the owner can perform this privacy officer role.
The title alone does not meet APP 1. The responsible person needs authority to maintain procedures, arrange training and handle access requests and complaints. Build privacy training around actual work, including client uploads and disclosures to service providers.
Under APP 1, the policy must explain how the business manages personal information. It must address the information held, collection and handling practices, access and correction, complaints and overseas disclosure. Make it available free of charge in an appropriate form.
Use a client file to test the policy against practice. Identify where its information enters the brokerage, who receives it and what triggers disposal. If the policy and the actual process differ, correct the process or policy before using it to explain your handling of the next client’s information.
