Ultimate Guide To The Australian Privacy Act Changes
Navigating the upcoming changes to the Australian Privacy Act is vital for volunteer committees. The removal of the $3 million small-business exemption means most organisations will need to adopt a comprehensive privacy policy. To remain compliant and avoid fines, it’s important to understand the 13 Australian Privacy Principles, implement robust data security measures, and draft clear terms and conditions. This will help ensure your members' personal information is safe.
As you hopefully know by now, big changes are happening with Australia’s privacy laws, with several reforms passed in the last few years, and more changes set to happen in the not-so-distant future.
So today, let’s have a look at these laws as they stand, what changes are likely to come in the near future, and what you need to do to make sure your membership organisation is compliant.
I know this can be a pretty dense and complicated topic with pretty severe consequences if you get it wrong (as everything related to the government tends to be), but I will do my best to keep it as light, easy to understand and as informative as possible; with plenty of resources for further reading.
First, let’s take a quick look at who the current laws apply to. Chances are you won’t be on the list, but it's set to get a lot bigger, so stay with me.
Australian Privacy Act For Non-Profits: The Quick Summary
- The Big Change: Australia’s privacy laws are tightening. While the Privacy Act currently only mandates compliance for organisations with a $3 million a year turnover (or those handling gambling, health, or trading data), the government has agreed in principle to scratch that $3 Million small-business exemption. Soon, every organisation will be on the hook.
- The 2026 Kids' Deadline: If you handle junior members under 15, strict new online privacy rules take effect by December 2026, requiring parental consent and child-friendly privacy terms.
- The Fix: You don't need a panic room; you just need a modern, compliant Privacy Policy and a solid set of Terms & Conditions (T&Cs) on your website.
Who Does the Privacy Act Currently Apply To?
Under the current legislation, as of 2026, the Australian Privacy Act applies to organisations with an annual turnover of more than $3 million. This includes bodies corporate, partnerships, trusts, and unincorporated associations.
Even if your club or association turns over less than $3 million a year, you are still legally required to comply with the Privacy Act if your organisation falls into any of the following categories:
- Health Service Providers: This includes clubs that run gyms, weight loss clinics, or childcare centres.
- Gambling Services: This includes licensed clubs and RSLs that operate gaming machines or other gambling services.
- Employee Associations: This includes registered unions and industry advocacy groups (e.g., the Fair Work (Registered Organisations) Act 2009).
- Opt-in Organisations: Any club or business that has voluntarily opted in to be covered by the Privacy Act to show their members they take data security seriously.
- Data Traders: Any organisation that buys or sells personal information.
If your club meets the $3 million threshold or falls into any of the categories above, you must comply with the Privacy Act.
Who Does The OAIC's Children's Online Privacy Code Apply To?
If the Privacy Act already applies to you, and if you have youth members, you also need to comply with the new Children's Online Privacy Code, which will take effect in December 2026.
This new act dictates how organisations that are "primarily concerned with the activities of children" must handle children’s data and security.
Under this new Code:
- The New Age of Consent: The legal age of consent for data collection is 15. For junior members under 15, you must obtain verifiable consent from a parent or guardian.
- The "Best Interests" Test: Any data you collect from a child must be strictly necessary for the club to function.
- Child-Friendly Policies: You are legally required to have a separate, easy-to-understand Privacy Policy written in language that a child can actually understand; it can include images, graphics and videos.
Note for Small Clubs: If your club turns over less than $3 million, you are exempt from this Code. However, because junior member data is highly sensitive, the OAIC strongly recommends that all youth clubs adopt these child-safety data practices immediately to protect their members and future-proof their operations.
Is The $3 Million Privacy Act Exemption Being Removed?
Yes, the government has “agreed in principle” to removing the $3 million exemption, but no further details or timeline have yet emerged.
It does seem possible that if a politician gives a simple, easy-to-understand answer to any question, they spontaneously combust. I’m sure if a politician’s partner asked them if they loved them, the answer would begin with, “Well, first I think it’s of great importance to define what one means by love…”
Anyway, the point is that at some ill-defined point in the future, every club that has members and collects information like names, emails, and addresses from those members will need to apply to the Privacy Act. Basically, the Privacy Act is now a Sword of Damocles hanging over all our heads, and sooner or later, it’s coming down.
So, right now, your club or association quite likely does not need to comply with the Australian Privacy Act. However, it’s very much something you need to be getting ready for because the law will “in principle” be changing. Even if the law never changes, which seems unlikely, a lot of the requirements of the Privacy Act are really good benchmarks for how you should be behaving and keeping members' data secure. They become a sort of best practice list, even if they aren’t mandatory.
So, with that in mind, let's now look at what the Australian Privacy Act requires from those it applies to.
What Does The Australian Privacy Act Require Clubs & Associations To Do?
The Australian Privacy Act requires those to whom it applies to follow these 13 core Privacy Principles:
- Open and transparent management of personal information: You need a clear, easy-to-understand, and accessible privacy policy that explains what you do with members’ personal information.
- Anonymity and pseudonymity: You must let people interact with you anonymously or use a pseudonym. But don't panic, there is a massive exception for when that is simply "impracticable." You can still require real names for your club memberships, payments, and insurance. This law is more so that people don’t have to give all of their details to a company just to buy a new toaster.
- Collection of solicited personal information: You are only allowed to collect data that is strictly necessary to run your club. If you run a local tennis club, you don't need to ask for a member's blood type or their mother's maiden name. You can't just hoard data in your own personal Smaug pile for the sake of it.
- Dealing with unsolicited personal information: If someone accidentally gives you a bunch of personal information you didn't ask for and don't need, you are legally required to destroy or de-identify it.
- Notification of the collection of personal information: Whenever you collect personal information from people, you need to let them know what information you are collecting and who you might share it with. The more sensitive the data, the stricter the notification requirements are.
- Use or disclosure of personal information: You can generally only use someone's data for the primary reason you collected it. You can't collect emails for a club roster and then sell that list to a local real estate agent.
- Direct marketing: You cannot use personal data for direct marketing unless the person has explicitly opted in, and you must always provide a simple way for them to opt out.
- Cross-border disclosure of personal information: If you send your members' data overseas, like storing it on an American-based server, as American membership systems do, you need that country and company to follow “substantially similar” laws to Australia, and you are liable if they breach said law.
- Adoption, use or disclosure of government-related identifiers: You cannot use a government ID (like a Medicare number, Tax File Number, or driver's licence number) as a way to identify members.
- Quality of personal information: You must take reasonable steps to ensure the data you hold is accurate, up-to-date, and complete.
- Security of personal information: You must actively protect the data from hackers, loss, and unauthorised access. Crucially, when you no longer need the data, you must securely destroy it.
- Access to personal information: Members must be able to readily see any data you have on them. If you are using Member Jungle, you already have this in place.
- Correction of personal information: Members must be able to update any data you have on them. If you are using Member Jungle, you already have this in place.
Remember that if you have children as members, that:
- They must be 15 to consent to you collecting data on them
- Children under 15 need a parent or guardian’s consent
- You must only collect data that is absolutely crucial to your operation
- You just have a separate child-friendly privacy policy that they can read
Take a deep breath, we got through the 13 Australian Privacy Principles. Remember, it’s quite likely that none of this applies to you yet, so you have time to get your ducks in a row.
How Do You Actually Comply With The Australian Privacy Act?
Looking at that list of 13 rules might make you want to throw your computer out the window, but don't panic. You don't need 13 separate documents or a full-time legal team to cover your bases. You basically just need to double-check what data you are collecting, whether you’re using an Australian service like Member Jungle, where your data is being stored, and the privacy policy and terms and conditions.
Your Privacy Policy: This is literally your answer to APP 1. A good privacy policy acts as your club's master rulebook. It openly explains to your members exactly how you collect, secure, and eventually destroy their data, helping tick off many of the other principles too.
Your Terms and Conditions (T&Cs): While the privacy policy explains what you do with your members' data, your T&Cs form the legally binding contract between your club and the member. This covers your rules of engagement, payment terms, refunds, and dispute resolution.
If you have these two documents properly drafted and easily accessible on your website, you are already miles ahead of the pack.
How To Actually Create A Privacy Policy and T&Cs Without Losing Your Mind
Creating a Privacy Policy and T&Cs isn’t too hard, and with a bit of help, you could have it sorted in an afternoon.
In fact, I’ve already written a complete, step-by-step guide specifically for clubs and associations on how to do exactly this. Instead of trying to figure it out from scratch or spending thousands of dollars on legal fees, you can read our full breakdown here: How to Create a Privacy Policy and Terms & Conditions for Your Club.
That article will walk you through the best templates, legal generators, and AI tools to use to get your club compliant quickly and easily.
Quick Checklist: Is Your Club Privacy-Ready?
Before you go, here is a quick final cheat sheet to ensure your membership organisation stays on the right side of the OAIC:
- Publish a Master Rulebook: Ensure you have an up-to-date Privacy Policy explaining exactly how you collect, secure, and destroy member details.
- Fix Your Sign-up Forms: Ditch the pre-ticked boxes and add a short, layered "Collection Notice" right above your checkout or registration buttons.
- Ditch the Insecure Spreadsheets: Move away from shared Excel files or loose paperwork on the bar. Secure your data using local, Australian-hosted storage.
- Prep for Junior Members: If you run a youth group or junior sports club, start setting up systems to verify parental consent for kids under 15 before December 2026.
Be Ready For The Privacy Law Changes
If you are a Member Jungle customer, we’ve already done a lot of the heavy lifting for you. Our system handles secure Australian data storage, automated renewals, and gives members access to their own data, so you are already compliant with a good number of those 13 APPs. We give you a secure place on your website to display your privacy policy and terms and conditions. A few tweaks here and there, and you are ready for whenever these laws finally come into play.
If you want to create a privacy policy that is more accessible for children (an excellent idea even if it's not currently legally required), consider checking out Write Like a Pro: Essential Writing Tips. It’s not specifically about writing for kids, but it goes into great detail on how to write in a way that is simple, easy to understand, and will go a long way to helping you write a highly accessible policy.
If you aren’t using Member Jungle, whether you are using an overseas alternative like Join It or Wild Apricot, or just using a Google Drive with member details stored on a spreadsheet somewhere, there may be more work for you to do. While there is no rush just yet, it’s much better to get this stuff sorted early than have to try and make your organisation compliant in a screaming panic when the new law finally arrives.
So, if you want to know more about Member Jungle and how we can help keep your club compliant and secure, check out: