What evidence does an auditor or the regulator ask for under Privacy Act APP 5.1 to APP 5.2(g) to (j)?

The collection notice in the intake pack or online booking flow, with when it is given; Collection notice text checked against 5.2(a) to (c); Collection notice text checked against 5.2(d) to (f); Collection notice text checked against 5.2(g) to (j)

Rules / Privacy Act: the Australian Privacy Principles and notifiable data breaches

PrivacyPrivacy Act: the Australian Privacy Principles and notifiable data breachesprivacy-act--app-5-collection-notice

Requirement

APP 5: the collection notice for clients

At or before collection, or as soon as practicable after, a practice takes reasonable steps to tell a client the matters in APP 5.2: who it is, why it collects, who it usually discloses to, what happens if information is not given, and where the privacy policy explains access, correction and complaints.

Clause

Privacy Act APP 5.1 to APP 5.2(g) to (j)

Regulator

Office of the Australian Information Commissioner

Edition held

Privacy Act 1988 (Cth), Compilation No. 104 (C2026C00227), in force 4 June 2026, registered 17 June 2026 (Schedule 1, the Australian Privacy Principles; Part IIIC, notifiable data breaches)

Checked current

6 October 2026, Federal Register of Legislation Versions API: the latest and current compilation on 6 October 2026

Who it applies to

Every allied health practice that provides a health service and holds health information, whatever its turnover (s 6D(4)(b)), every profession, speech pathology included, NDIS registered or not.

Every clause in the standards library

Privacy Act: the Australian Privacy Principles and notifiable data breaches on the standards library

Under review, not in force

From 10 December 2026, APP 1.7 to 1.9 add automated-decision content to the privacy policy (Privacy and Other Legislation Amendment Act 2024, Schedule 1 items 87 and 88). Not in force yet.

APP 5.1At or before the time of collection, or as soon as practicable after, take reasonablesource

Requirement, our statement of the clause

At or before the time of collection, or as soon as practicable after, take reasonable steps to notify the person of the APP 5.2 matters or otherwise make them aware.

Evidence that typically shows this

The collection notice in the intake pack or online booking flow, with when it is given

Common gap to check

Notice given only after the first session
No notice when information comes from a referrer

APP 5.2(a), (b), (c)The notice covers the practice's identity and contact details, the fact andsource

Requirement, our statement of the clause

The notice covers the practice's identity and contact details, the fact and circumstances of collection where information comes from someone else, and any Australian law that requires or authorises the collection.

Evidence that typically shows this

Collection notice text checked against 5.2(a) to (c)

Common gap to check

NDIS or Medicare collection requirements not named where they apply

APP 5.2(d), (e), (f)The notice covers the purposes of collection, the main consequences if information issource

Requirement, our statement of the clause

The notice covers the purposes of collection, the main consequences if information is not collected, and the bodies or kinds of bodies the practice usually discloses to (for example referrers, other treating practitioners, plan managers, the NDIA or the NDIS Commission).

Evidence that typically shows this

Collection notice text checked against 5.2(d) to (f)

Common gap to check

Usual disclosures (plan managers, NDIA reports) missing from the notice

APP 5.2(g) to (j)The notice says the privacy policy explains access, correction and complaints, andsource

Requirement, our statement of the clause

The notice says the privacy policy explains access, correction and complaints, and whether information is likely to go overseas and, where practicable, to which countries.

Evidence that typically shows this

Collection notice text checked against 5.2(g) to (j)

Common gap to check

Overseas storage by practice software not mentioned

Worksheet: what your practice holds, and where

Ref	Held (yes, partly, no, not applicable)	Where it is kept	Owner	Last reviewed	Next review
APP 5.1
APP 5.2(a), (b), (c)
APP 5.2(d), (e), (f)
APP 5.2(g) to (j)

Download the worksheet (CSV)Print the worksheet (A4)

Completing this worksheet records what your practice holds and where. It does not make a practice compliant or ready for audit, and it is not legal advice.

Related requirements

Privacy Act: the Australian Privacy Principles and notifiable data breaches

APP 3.2 to APP 3.5, 3.6APP 3: collecting health information, consent and necessity
APP 6.1 to APP 6.5APP 6: sharing client information with other practitioners and the NDIS
APP 1.2 to APP 1.5, 1.6APP 1: the practice privacy policy and what it must contain
APP 11.1, APP 11.3, APP 11.2APP 11: securing client records and destroying them when no longer needed
s 6D(1), (3) to s 6(1) health information, sensitive informationDoes the Privacy Act apply to an allied health practice?
APP 12.1, 12.4 to APP 13.3 to 13.5APP 12 and 13: client requests to see or correct their records
s 26WE(2) to s 26WHNotifiable data breaches: the 30-day assessment of a suspected breach
s 26WK(2), (3) to s 26WMNotifiable data breaches: notifying the Commissioner and the people affected
Every page of this instrument

The same topic in other instruments (privacy and records)

NDIS Practice Standards Core 5.1, Core 5.2, Core 5.3Core module: Privacy and dignity
NDIS Practice Standards Core 12.1 to Core 12.4Core module: Information management
NDIS Code of Conduct s 6(1)(b)Respect the privacy of people with disability
Children guidance P-2Protect privacy and dignity, and ask before touching
Ahpra shared Code of conduct 3.3Confidentiality and privacy
Psychology Board Code of conduct 3.3Privacy and confidentiality

See every requirement for your practice See the specimen practice