[Home](/)/[Resources](/resources)/Australia Privacy Act — Connected Devices

AustraliaPrivacy & Data

# Australia Privacy Act 1988: Connected Product Obligations and the 2024 Reforms

Any connected device that collects data from Australian users brings the Privacy Act 1988 into scope — regardless of where the manufacturer is based. The 13 Australian Privacy Principles govern how that data is collected, used, disclosed, and protected. The 2024 reforms raised penalties to GDPR scale and introduced new obligations for children's privacy and the right to erasure. This guide covers what hardware companies need to understand before shipping connected products into Australia.

Copy Link[Share on WhatsApp](https://wa.me/?text=https%3A%2F%2Fkrono-labs.com%2Fguides%2Faustralia-privacy-act-connected-devices)

At a glance

Law

Privacy Act 1988

Regulator

Office of the Australian Information Commissioner (OAIC)

Framework

13 Australian Privacy Principles (APPs)

Reform

2024 Privacy and Other Legislation Amendment Act

## Privacy Act obligations for connected hardware makers

### The 13 Australian Privacy Principles (APPs) and how they apply to IoT products

The APPs under Schedule 1 of the Privacy Act 1988 are the substantive privacy obligations for APP entities. For connected hardware, the most relevant APPs are: APP 1 (open and transparent management of personal information — requires a published privacy policy), APP 3 (collection of solicited personal information — only collect what is reasonably necessary), APP 6 (use and disclosure — personal information may only be used for its primary purpose or a directly related secondary purpose), APP 8 (cross-border disclosure — must ensure overseas recipients comply with APPs or take responsibility for their compliance), APP 11 (security — must protect personal information from misuse, interference, loss, and unauthorised access), and APP 12 (access — must give individuals access to their own data on request). Each connected device that collects sensor data, usage patterns, location, or user identity engages multiple APPs simultaneously.

### The APP entity threshold — who must comply (most overseas organizations collecting Australian data)

An 'APP entity' includes any organization that collects personal information and meets the threshold: annual turnover exceeding AUD 3 million, or handling health information, credit information, or tax file numbers regardless of size, or contracted to provide services to the Australian government. Importantly, the Act applies to overseas organizations when they collect personal information from people in Australia and carry on business in Australia or the act is done in connection with Australian operations. For an overseas hardware company selling connected devices with cloud services to Australian consumers, the Privacy Act almost certainly applies — even without a physical Australian presence. The Privacy Act is not limited to Australian-incorporated entities.

### Mandatory data breach notification under the Notifiable Data Breaches (NDB) scheme

The NDB scheme (Part IIIC of the Privacy Act) requires APP entities to notify the OAIC and affected individuals of an 'eligible data breach' — an unauthorised access or disclosure of personal information that is likely to result in serious harm to any individual. Connected device makers face NDB exposure from: cloud storage breaches, API key leakage, firmware vulnerabilities enabling data exfiltration, and supply chain compromises. The notification must be made as soon as practicable, with a 30-day outer limit from the time the entity becomes aware of grounds to suspect an eligible breach. Failure to notify is itself an interference with privacy and can attract civil penalty proceedings.

### 2024 Privacy and Other Legislation Amendment Act — enhanced penalties and children's online privacy protections

The Privacy and Other Legislation Amendment Act 2024 made the most significant changes to Australian privacy law in decades. Key changes for connected device makers: civil penalties increased to the higher of AUD 50 million, three times the benefit obtained, or 30% of adjusted turnover for the period (matching GDPR scale); a new statutory tort of serious invasion of privacy creates civil liability directly to individuals (in addition to OAIC enforcement); enhanced children's online privacy protections require age-appropriate design for services likely to be accessed by children; and a new right to request erasure of personal information collected online (to be commenced by regulation). The amendments signal a shift toward accountability-by-design requirements — not just process compliance.

## Compliance steps for IoT and connected product companies

01

Determine whether your organization is an APP entity under the Privacy Act: annual Australian turnover exceeds AUD 3 million, you handle health information, or you are an overseas organization collecting personal information from people in Australia in connection with a business. If any of these apply, the Privacy Act governs your data collection through connected devices.

02

Map all personal information collected by the connected device and its associated cloud services: device identifiers, usage patterns, location data, sensor readings that could identify individuals, account information, and any data transmitted to third-party analytics or advertising platforms. Document the lawful basis for each collection and its purpose.

03

Publish an Australian Privacy Policy meeting APP 1 requirements. The policy must: be clearly expressed and easily accessible, identify the kinds of personal information collected, explain how and why it is collected, disclose any cross-border disclosures and the countries involved, and explain how individuals can access and correct their data and lodge a complaint. A GDPR-compliant policy is not automatically an APP-compliant policy — check against each APP 1 requirement.

04

Implement the NDB scheme internally: establish a data breach response plan covering detection, assessment (is it an eligible data breach?), and notification (OAIC and affected individuals within 30 days). Connected device firmware and cloud services should have logging sufficient to detect and scope a breach. Document all assessments — even where you conclude notification is not required.

05

Review product design against 2024 reform obligations: if the connected device is likely to be accessed by children, conduct an age-appropriate design review. Implement data minimisation at the device level — avoid collecting personal information beyond what is reasonably necessary for device function. Prepare for the right to erasure by designing cloud services with a deletion capability that extends to device-associated data.

## Frequently asked questions

### Does Australia's Privacy Act apply to overseas companies selling connected devices?

Yes. The Privacy Act 1988 applies to any organization that collects personal information from people in Australia and carries on business in Australia. An overseas hardware company selling connected devices to Australian consumers, operating a cloud service that processes Australian users' data, is conducting business in Australia for Privacy Act purposes. There is no requirement to have a physical presence or Australian incorporation. The Act explicitly covers overseas organizations — the OAIC has taken this interpretation in guidance, and the 2024 reforms reinforce it. Overseas companies must appoint an Australian-accessible point of contact for privacy complaints and publish an APP-compliant privacy policy.

### What personal information does a typical IoT device collect that triggers the Privacy Act?

A connected device triggers the Privacy Act whenever it collects information that can identify an individual, directly or indirectly. This includes: device identifiers linked to an account (MAC addresses, serial numbers, device IDs), usage logs (when the device was active, what features were used), location data (GPS coordinates, Wi-Fi network associations), sensor data that reveals personal habits or health information (sleep patterns from a smart thermostat, activity data from a wearable), and user account information. Even anonymised telemetry can become personal information if it can be linked back to an identifiable person with reasonable effort. The Privacy Act's definition of 'personal information' is broad — when in doubt, assume the information is covered.

### What is an 'eligible data breach' under the NDB scheme?

An eligible data breach under Part IIIC of the Privacy Act has three elements: (1) there has been unauthorised access to, unauthorised disclosure of, or loss of personal information; (2) the organisation holds the information and is subject to the Privacy Act; and (3) the access, disclosure, or loss is likely to result in serious harm to one or more individuals whose information was involved. Serious harm includes physical, psychological, financial, or reputational harm. A firmware vulnerability that enables extraction of user credentials is an eligible data breach. A misconfigured API that exposes device usage logs is likely an eligible data breach. An internal employee accidentally accessing the wrong data set may or may not be, depending on the sensitivity of the information. The entity must assess within 30 days — if serious harm is likely, notification is mandatory.

### How do the 2024 Privacy Act reforms affect connected device makers?

The Privacy and Other Legislation Amendment Act 2024 raises the stakes significantly. Civil penalties can now reach AUD 50 million or 30% of adjusted turnover — comparable to GDPR exposure — for serious and repeated interferences with privacy. The new statutory tort allows individuals to sue directly for serious invasions of privacy (expected to cover deliberate data misuse and reckless security failures). Children's online privacy protections require that products likely to be used by children be designed with age-appropriate privacy safeguards from the outset — a design-stage obligation, not just a policy requirement. The right to erasure, once commenced, will require connected device makers to delete personal information collected online upon valid request, including device-associated cloud data. The reforms move Australian privacy law meaningfully closer to GDPR accountability standards.

**Disclaimer:** Educational resource only. Regulatory requirements change and vary by product category. Consult an accredited test laboratory or qualified compliance engineer before making certification decisions.

🇦🇺 Australia roadmap for your product

Every standard, document, and test that applies — free, no account required.

See your free roadmap[

Want an expert to take your product through 🇦🇺 Australia compliance for you?

One consultant from Krono's compliance team takes your product from requirements to legal sale, with a fixed quote before any work starts.

See compliance services](/services)

Learn this properly

In-depth course that teaches the full process, not just this one answer.

[Start the course — $149](/courses/44-australia-rcm-marking-electronics-cabling)[Prefer to read? Get the book — $24.99](/books/44-australia-rcm-marking-electronics-cabling)

Related guides

*   [Australia Compliance OverviewThe RCM mark, EESS electrical safety, ACMA radiocommunications, TGA medical devices, and the ACL safety net in Australia.](/guides/australia-compliance-overview)
*   [Canada Privacy Law for Connected DevicesPIPEDA and incoming Bill C-27/CPPA privacy obligations for connected devices sold in Canada: consent, breach notification, and IoT data mapping.](/guides/canada-privacy-law-connected-devices)
*   [UAE Personal Data Protection Law (PDPL)UAE Federal Decree-Law No. 45 of 2021 (PDPL) for connected product makers: data collection obligations, cross-border transfers, and Arabic privacy notices.](/guides/uae-data-protection-pdpl)
*   [Hong Kong PDPOHong Kong PDPO Cap. 486 for connected hardware: the six Data Protection Principles, direct marketing restrictions, and cross-border transfer obligations.](/guides/hong-kong-data-privacy-pdpo)
*   [Australia Consumer Data Right for Connected DevicesHow the Consumer Data Right framework applies to connected device manufacturers: accreditation tiers, CDR API security standards, consent and data-minimisation obligations, and ACCC/OAIC enforcement penalties.](/guides/australia-consumer-data-right-connected-devices)