What does Privacy Act APP 3.2 to APP 3.5, 3.6 require?

Collect personal information that is not sensitive only where it is reasonably necessary for one or more of the practice's functions or activities. Collect sensitive information, including health information, only with the person's consent and where it is reasonably necessary for the practice's functions or activities. Sensitive information may be collected without consent only where an exception applies, such as collection required or authorised by an Australian law, or a permitted health situation under s 16B (for example where the information is necessary to provide a health service and is

What evidence does an auditor or the regulator ask for under Privacy Act APP 3.2 to APP 3.5, 3.6?

Intake and referral forms reviewed field by field for necessity; Consent recorded at intake for the health information collected, with how consent was given; Consent arrangements for children and people with a substitute decision-maker; A note of each situation where the practice collects health information without consent and the exception relied on; Referral intake procedure noting when information comes from someone other than the client

Rules / Privacy Act: the Australian Privacy Principles and notifiable data breaches

PrivacyPrivacy Act: the Australian Privacy Principles and notifiable data breachesprivacy-act--app-3-collecting-health-information

Requirement

APP 3: collecting health information, consent and necessity

Health information is sensitive information. A practice may collect it only with the person's consent and where it is reasonably necessary for the practice's functions, unless an exception such as a permitted health situation applies, and only by lawful and fair means, usually from the person.

Clause

Privacy Act APP 3.2 to APP 3.5, 3.6

Regulator

Office of the Australian Information Commissioner

Edition held

Privacy Act 1988 (Cth), Compilation No. 104 (C2026C00227), in force 4 June 2026, registered 17 June 2026 (Schedule 1, the Australian Privacy Principles; Part IIIC, notifiable data breaches)

Checked current

6 October 2026, Federal Register of Legislation Versions API: the latest and current compilation on 6 October 2026

Who it applies to

Every allied health practice that provides a health service and holds health information, whatever its turnover (s 6D(4)(b)), every profession, speech pathology included, NDIS registered or not.

Every clause in the standards library

Privacy Act: the Australian Privacy Principles and notifiable data breaches on the standards library

Under review, not in force

From 10 December 2026, APP 1.7 to 1.9 add automated-decision content to the privacy policy (Privacy and Other Legislation Amendment Act 2024, Schedule 1 items 87 and 88). Not in force yet.

APP 3.2Collect personal information that is not sensitive only where it is reasonably necessary for one or more of the practice's functions or activitiessource

Requirement, our statement of the clause

Collect personal information that is not sensitive only where it is reasonably necessary for one or more of the practice's functions or activities.

Evidence that typically shows this

Intake and referral forms reviewed field by field for necessity

Common gap to check

Intake forms asking for information no service uses

APP 3.3(a)Collect sensitive information, including health information, only with the person's consent and where it is reasonably necessary for the practice's functions or activitiessource

Requirement, our statement of the clause

Collect sensitive information, including health information, only with the person's consent and where it is reasonably necessary for the practice's functions or activities.

Evidence that typically shows this

Consent recorded at intake for the health information collected, with how consent was given
Consent arrangements for children and people with a substitute decision-maker

Common gap to check

Consent assumed rather than recorded
No process where a parent, guardian or nominee consents

APP 3.4(a), (c), s 16BSensitive information may be collected without consent only where an exception applies, such as collection required or authorised by an Australian law, or a permitted health situation under s 16B (for example where the information is necessary to provide a health service and is collected as required by law or in line with binding professional confidentiality rules)source

Requirement, our statement of the clause

Sensitive information may be collected without consent only where an exception applies, such as collection required or authorised by an Australian law, or a permitted health situation under s 16B (for example where the information is necessary to provide a health service and is collected as required by law or in line with binding professional confidentiality rules).

Evidence that typically shows this

A note of each situation where the practice collects health information without consent and the exception relied on

Common gap to check

Collecting a client's family history about other people without checking s 16B(1A)

APP 3.5, 3.6Collect personal information only by lawful and fair means, and from the person unless it is unreasonable or impracticable to do so (for example a referral from a treating doctor)source

Requirement, our statement of the clause

Collect personal information only by lawful and fair means, and from the person unless it is unreasonable or impracticable to do so (for example a referral from a treating doctor).

Evidence that typically shows this

Referral intake procedure noting when information comes from someone other than the client

Common gap to check

No record of the source when information comes from a third party

Worksheet: what your practice holds, and where

Ref	Held (yes, partly, no, not applicable)	Where it is kept	Owner	Last reviewed	Next review
APP 3.2
APP 3.3(a)
APP 3.4(a), (c), s 16B
APP 3.5, 3.6

Download the worksheet (CSV)Print the worksheet (A4)

Completing this worksheet records what your practice holds and where. It does not make a practice compliant or ready for audit, and it is not legal advice.

Related requirements

Privacy Act: the Australian Privacy Principles and notifiable data breaches

APP 2.1, APP 2.2APP 2: letting people deal with the practice anonymously or under a pseudonym
APP 4.1, 4.2, APP 4.3, 4.4APP 4: information the practice did not ask for
APP 1.2 to APP 1.5, 1.6APP 1: the practice privacy policy and what it must contain
APP 5.1 to APP 5.2(g) to (j)APP 5: the collection notice for clients
s 6D(1), (3) to s 6(1) health information, sensitive informationDoes the Privacy Act apply to an allied health practice?
APP 6.1 to APP 6.5APP 6: sharing client information with other practitioners and the NDIS
APP 7.1, 7.4 to APP 7.8APP 7: newsletters and marketing to clients
APP 8.1, APP 8.2(a), (b), APP 8.2(c), (d)APP 8: client information that goes overseas
Every page of this instrument

The same topic in other instruments (privacy and records)

NDIS Practice Standards Core 5.1, Core 5.2, Core 5.3Core module: Privacy and dignity
NDIS Practice Standards Core 12.1 to Core 12.4Core module: Information management
NDIS Code of Conduct s 6(1)(b)Respect the privacy of people with disability
Children guidance P-2Protect privacy and dignity, and ask before touching
Ahpra shared Code of conduct 3.3Confidentiality and privacy
Psychology Board Code of conduct 3.3Privacy and confidentiality

See every requirement for your practice See the specimen practice