All Topics

Businesses that qualify as APP entities under the Privacy Act 1988 (Cth), generally those with annual turnover above $3 million or those handling health information or fulfilling Commonwealth contracts, must comply with the Australian Privacy Principles, including maintaining a privacy policy, issuing privacy collection notices and notifying the OAIC of eligible data breaches.

ASIC can pursue greenwashing enforcement even where investors suffer no direct financial loss, as demonstrated by the $12.9 million penalty in ASIC v Vanguard.

Delegating your reporting obligations to a third party does not transfer your regulatory accountability. Across all major regimes, the reporting entity remains ultimately responsible for the accuracy, completeness, and timeliness of submitted data