What evidence does an auditor or the regulator ask for under Privacy Act APP 7.1, 7.4 to APP 7.8?

Recorded consent for any marketing that draws on health information; The opt-out mechanism in every marketing email or letter; A log of opt-out and source requests with the date actioned; A note of which law governs each marketing channel (email and SMS under the Spam Act)

Rules / Privacy Act: the Australian Privacy Principles and notifiable data breaches

PrivacyPrivacy Act: the Australian Privacy Principles and notifiable data breachesprivacy-act--app-7-direct-marketing

Requirement

APP 7: newsletters and marketing to clients

A practice may use personal information for direct marketing only within APP 7: for health and other sensitive information, only with the person's consent; for other information, where the person would reasonably expect it or has consented, with a simple way to opt out that is honoured within a reasonable period. The Spam Act and the Do Not Call Register Act displace APP 7 to the extent they apply.

Clause

Privacy Act APP 7.1, 7.4 to APP 7.8

Regulator

Office of the Australian Information Commissioner

Edition held

Privacy Act 1988 (Cth), Compilation No. 104 (C2026C00227), in force 4 June 2026, registered 17 June 2026 (Schedule 1, the Australian Privacy Principles; Part IIIC, notifiable data breaches)

Checked current

6 October 2026, Federal Register of Legislation Versions API: the latest and current compilation on 6 October 2026

Who it applies to

Every allied health practice that provides a health service and holds health information, whatever its turnover (s 6D(4)(b)), every profession, speech pathology included, NDIS registered or not.

Every clause in the standards library

Privacy Act: the Australian Privacy Principles and notifiable data breaches on the standards library

Under review, not in force

From 10 December 2026, APP 1.7 to 1.9 add automated-decision content to the privacy policy (Privacy and Other Legislation Amendment Act 2024, Schedule 1 items 87 and 88). Not in force yet.

Applies when

APP 7 applies only to use or disclosure of personal information for direct marketing. On the profile it is not applicable until the practice answers yes. The question: Does the practice send newsletters, promotions or other direct marketing to clients or past clients?

APP 7.1, 7.4Do not use or disclose personal information for direct marketing unless an exception appliessource

Requirement, our statement of the clause

Do not use or disclose personal information for direct marketing unless an exception applies; health information and other sensitive information may be used for direct marketing only with the person's consent.

Evidence that typically shows this

Recorded consent for any marketing that draws on health information

Common gap to check

Marketing lists built from treatment records without consent

APP 7.2, 7.3Other personal information may be used for direct marketing where the person would reasonably expect it, or has consented (or consent is impracticable, for information collected from someone else), with a simple means to opt out, and (under 7.3) a prominent opt-out statement in each communicationsource

Requirement, our statement of the clause

Other personal information may be used for direct marketing where the person would reasonably expect it, or has consented (or consent is impracticable, for information collected from someone else), with a simple means to opt out, and (under 7.3) a prominent opt-out statement in each communication.

Evidence that typically shows this

The opt-out mechanism in every marketing email or letter

Common gap to check

No working unsubscribe or opt-out

APP 7.6, 7.7On request, stop direct marketing, stop disclosing for others' marketing, and say where the information came from, free of charge and within a reasonable periodsource

Requirement, our statement of the clause

On request, stop direct marketing, stop disclosing for others' marketing, and say where the information came from, free of charge and within a reasonable period.

Evidence that typically shows this

A log of opt-out and source requests with the date actioned

Common gap to check

Opt-outs not applied across all mailing tools

APP 7.8APP 7 does not apply to the extent the Spam Act 2003, the Do Not Call Register Act 2006 or another prescribed law appliessource

Requirement, our statement of the clause

APP 7 does not apply to the extent the Spam Act 2003, the Do Not Call Register Act 2006 or another prescribed law applies.

Evidence that typically shows this

A note of which law governs each marketing channel (email and SMS under the Spam Act)

Common gap to check

Email marketing run without considering the Spam Act

Worksheet: what your practice holds, and where

Ref	Held (yes, partly, no, not applicable)	Where it is kept	Owner	Last reviewed	Next review
APP 7.1, 7.4
APP 7.2, 7.3
APP 7.6, 7.7
APP 7.8

Download the worksheet (CSV)Print the worksheet (A4)

Completing this worksheet records what your practice holds and where. It does not make a practice compliant or ready for audit, and it is not legal advice.

Related requirements

Privacy Act: the Australian Privacy Principles and notifiable data breaches

APP 6.1 to APP 6.5APP 6: sharing client information with other practitioners and the NDIS
APP 8.1, APP 8.2(a), (b), APP 8.2(c), (d)APP 8: client information that goes overseas
APP 5.1 to APP 5.2(g) to (j)APP 5: the collection notice for clients
APP 9.1, APP 9.2APP 9: NDIS numbers, Medicare numbers and other government identifiers
APP 4.1, 4.2, APP 4.3, 4.4APP 4: information the practice did not ask for
APP 10.1, APP 10.2APP 10: keeping client information accurate and up to date
APP 3.2 to APP 3.5, 3.6APP 3: collecting health information, consent and necessity
APP 11.1, APP 11.3, APP 11.2APP 11: securing client records and destroying them when no longer needed
Every page of this instrument

The same topic in other instruments (privacy and records)

NDIS Practice Standards Core 5.1, Core 5.2, Core 5.3Core module: Privacy and dignity
NDIS Practice Standards Core 12.1 to Core 12.4Core module: Information management
NDIS Code of Conduct s 6(1)(b)Respect the privacy of people with disability
Children guidance P-2Protect privacy and dignity, and ask before touching
Ahpra shared Code of conduct 3.3Confidentiality and privacy
Psychology Board Code of conduct 3.3Privacy and confidentiality

See every requirement for your practice See the specimen practice