Privacy Act NSW: What Actually Applies to Your Business

For most private NSW businesses, "the privacy act" that applies is the Commonwealth Privacy Act 1988 - generally for businesses with turnover over $3 million. NSW's own state law, the PPIP Act, covers NSW public sector agencies only, not private business. A separate NSW law, the Health Records and Information Privacy Act, covers private health providers specifically.

Searching "privacy act nsw" usually means one thing: trying to work out which law actually applies to a business operating in NSW. The short version - for almost every private business, it's the Commonwealth Privacy Act 1988, not a NSW state law.

AI Framework's legislative register maps the Commonwealth and state instruments that apply to a private business's actual profile, because "which law applies" in NSW is a jurisdiction question first, and an AI question second.

Privacy act NSW: the law that actually applies

The Commonwealth Privacy Act 1988 covers private businesses with annual turnover over $3 million - and NSW's own state privacy law doesn't reach general private business at all. NSW's PPIP Act covers NSW public sector agencies only: departments, councils, universities, statutory bodies. There's no NSW-state equivalent of the Commonwealth Act for ordinary private business. The one exception is health information specifically - the Health Records and Information Privacy Act 2002 covers private health service providers and businesses over $3M turnover that hold health information.

Which law actually covers a NSW business

A handful of exceptions pull smaller businesses into the Commonwealth Act regardless of turnover: health service providers, businesses that trade in personal information, businesses related to a larger business over the threshold, and credit reporting bodies. The privacy act NSW businesses are subject to is, in almost every case, the Commonwealth one.

Two separate agencies enforce two separate things

The Commonwealth Privacy Act is enforced by the OAIC. NSW state privacy law is enforced by the NSW Information and Privacy Commission (IPC). For almost every private NSW business, that means the OAIC is the one that matters - the IPC's jurisdiction is NSW government, not private business.

Where AI changes things for a NSW business

The Commonwealth Privacy Act's obligations apply to the use of AI on personal information - the OAIC's own two AI guidance documents from October 2024 cover this specifically. The OAIC treats training or developing AI on personal information as a high privacy risk activity, and expects businesses to apply the Australian Privacy Principles actively across the AI lifecycle rather than as an afterthought.

One dated, concrete compliance point worth knowing: from 10 December 2026, APP 1.7 requires businesses to disclose in their privacy policy when a computer program is used to make or substantially support a decision that could significantly affect someone's rights or interests. This applies the same way in NSW as anywhere else in Australia - it isn't a state-specific rule, but it's the single clearest date on the calendar for any NSW business using AI in decisions about people.

The NSW-specific AI rules that aren't privacy law

Here's the part nothing else covering "privacy act nsw" currently mentions: NSW has separate laws governing AI-based staff monitoring, and they sit in workplace and safety law, not privacy law. The Workplace Surveillance Act 2005 (NSW) regulates camera, computer and tracking surveillance of employees - its definition of "computer surveillance" is broad enough to plausibly capture AI-based monitoring tools that track keystrokes, productivity or email activity, even though the Act predates AI as a category. It requires 14 days' written notice before overt surveillance begins and prohibits covert surveillance without a court order.

The Work Health and Safety Amendment (Digital Work Systems) Act 2026 (NSW), passed in February 2026, is described by multiple law firms as the first Australian WHS law to directly name AI. It defines a "digital work system" as an algorithm, artificial intelligence, automation or online platform used in the workplace, and imposes a duty on businesses to ensure worker health and safety isn't put at risk by work allocated through one - whether the business built the tool itself or bought it off the shelf. The reforms commence by proclamation rather than immediately on passage - worth checking current status before assuming they're fully in force.

For a NSW business using AI to allocate work, score productivity or monitor staff, this sits alongside privacy compliance as a separate body of law worth knowing about.

FAQ

Does the privacy act apply to my NSW business? Generally, yes, if your turnover is over $3 million - but it's the Commonwealth Privacy Act 1988, not a NSW state law. NSW's own privacy law covers government agencies, not private business.

What's the difference between the Privacy Act and the PPIP Act? The Commonwealth Privacy Act covers private business nationally. The PPIP Act is NSW's own law, covering NSW public sector agencies only - it has no private-business version.

Am I exempt from the privacy act in NSW? If your turnover is under $3 million and you're not in one of the specific exception categories (health information, trading in personal information, and a few others), you're generally exempt from the Commonwealth Act. Most real estate agencies, recruiters and professional services firms sit above the threshold. No separate NSW exemption question applies, since NSW state law doesn't cover private business in the first place.

Does NSW have any AI-specific laws for businesses? Yes - the Work Health and Safety Amendment (Digital Work Systems) Act 2026 explicitly names AI and imposes a safety duty where AI is used to allocate or monitor work. It's WHS law, separate from the Privacy Act and the Australian Privacy Principles, so it falls outside an AI governance framework like AI Framework.

For a broader view of how Australian privacy law applies to AI, see Data privacy regulations in Australia.

This page covers the privacy act NSW jurisdiction question. If your business handles personal information and uses AI, address it today with AI Framework.

This post is general information, not legal advice.

Current as at September 2026.