Last Updated on 22/08/2025 by Damin Murdock
Consent is widely seen as the foundation of privacy compliance, but under the Privacy Act 1988 (Cth) (the Act) and the Australian Privacy Principles (APPs), it is not the only legal ground for collecting and using personal information. For Australian organisations, understanding when consent is truly required is essential to avoiding legal risk and maintaining public trust.
Collecting Personal Information: The Basics
Under APP 3, organisations must not collect personal information unless:
- It is reasonably necessary for their functions or activities
- The collection is carried out by lawful and fair means
- The individual has the option to remain anonymous or use a pseudonym, unless an exception applies.
These requirements apply to both government and private sector organisations covered by the Act.
Notification Requirements: Keeping Individuals Informed
Before or at the time of collecting personal information, organisations must take reasonable steps to notify individuals affected by such data collection. This notification should include:
- The organisation’s identity and contact information;
- The purpose of the collection;
- Any third parties the information may be disclosed to;
- How individuals can access or correct their data; and
- How to make a complaint about a privacy breach.
Transparency is a core component of responsible privacy practice and essential to compliance.
When Consent Is and Isn’t Required
Organisations do not need consent to use personal information for the primary purpose it was collected, for instance, processing a purchase or delivering a service.
However, using that information for a secondary purpose usually requires explicit consent, unless:
- The person would reasonably expect the use;
- The use is related or directly related to the primary purpose (depending on sensitivity);
- It’s required or authorised by law; and/or
- A permitted general situation applies (e.g. preventing a serious threat to life or health).
Key Takeaways
1. Transparency and Privacy Policies
All organisations must maintain a clear, publicly available privacy policy that outlines how they manage personal information. This includes details on collection, use, disclosure, storage, and complaint mechanisms.
2. Accuracy and Security Obligations
Even where consent is not explicitly required:
- Organisations must ensure the information collected is accurate and up-to-date;
- Personal data must be protected from misuse, interference, loss, and unauthorised access; and
- Special care must be taken when handling unsolicited information (e.g. through third-party referrals).
3. Disclosure Limits
Information can only be disclosed:
- With the individual’s consent;
- After providing reasonable notice;
- When required or authorised by law; and
- In emergency situations where disclosure is necessary to protect life or health.
Final Thoughts
In today’s data-driven economy, understanding the role and limits of consent is critical to privacy compliance. While consent remains important, it is only one part of the broader legal framework under the APPs.
At Leo Lawyers, we help organisations navigate complex privacy laws with clarity and confidence. Feel free to contact Damin Murdock at Leo Lawyers via our website, on (02) 8201 0051 or at office@leolawyers.com.au. Further, if you liked this article, please subscribe to our newsletter via our Website, and subscribe to our YouTube , LinkedIn, Facebook and Instagram. If you liked this article or video, please also give us a favourable Google Review.
DISCLAIMER: This is not legal advice and is general information only. You should not rely upon the information contained in this article and if you require specific legal advice, please contact us.
Damin Murdock (J.D | LL.M | BACS - Finance) is a seasoned commercial lawyer with over 17 years of experience, recognised as a trusted legal advisor and courtroom advocate who has built a formidable reputation for delivering strategic legal solutions across corporate, commercial, construction, and technology law. He has held senior leadership positions, including director of a national Australian law firm, principal lawyer of MurdockCheng Legal Practice, and Chief Legal Officer of Lawpath, Australia's largest legal technology platform. Throughout his career, Damin has personally advised more than 2,000 startups and SMEs, earning over 300 five-star reviews from satisfied clients who value his clear communication, commercial pragmatism, and in-depth legal knowledge. As an established legal thought leader, he has hosted over 100 webinars and legal videos that have attracted tens of thousands of views, reinforcing his trusted authority in both legal and business communities."
