Allied Health NDIS Audit Checklist: worksheet
Privacy Act: the Australian Privacy Principles and notifiable data breaches. Edition held: Privacy Act 1988 (Cth), Compilation No. 104 (C2026C00227), in force 4 June 2026, registered 17 June 2026 (Schedule 1, the Australian Privacy Principles; Part IIIC, notifiable data breaches); checked current on 6 October 2026 (Federal Register of Legislation Versions API: the latest and current compilation on 6 October 2026).
Under review, not in force: From 10 December 2026, APP 1.7 to 1.9 add automated-decision content to the privacy policy (Privacy and Other Legislation Amendment Act 2024, Schedule 1 items 87 and 88). Not in force yet.
Standards library: https://compliance.theartofservice.com/frameworks/australian-privacy-principles-apps. Page: https://allied-health-ndis-audit-checklist.theartofservice.com/rules/privacy-act/app-7-direct-marketing/
Applies when: APP 7 applies only to use or disclosure of personal information for direct marketing. On the profile it is not applicable until the practice answers yes. The question: Does the practice send newsletters, promotions or other direct marketing to clients or past clients?
| Ref | Requirement (our statement of the clause) | Evidence an auditor or the regulator asks for | Common gap to check | Held (yes, partly, no, not applicable) | Where it is kept | Owner | Last reviewed | Next review |
|---|---|---|---|---|---|---|---|---|
| APP 7.1, 7.4 | Do not use or disclose personal information for direct marketing unless an exception applies; health information and other sensitive information may be used for direct marketing only with the person's consent. Source: https://www.legislation.gov.au/C2004A03712/latest/text | Recorded consent for any marketing that draws on health information | Marketing lists built from treatment records without consent | ☐ yes ☐ partly ☐ no ☐ n/a | ||||
| APP 7.2, 7.3 | Other personal information may be used for direct marketing where the person would reasonably expect it, or has consented (or consent is impracticable, for information collected from someone else), with a simple means to opt out, and (under 7.3) a prominent opt-out statement in each communication. Source: https://www.legislation.gov.au/C2004A03712/latest/text | The opt-out mechanism in every marketing email or letter | No working unsubscribe or opt-out | ☐ yes ☐ partly ☐ no ☐ n/a | ||||
| APP 7.6, 7.7 | On request, stop direct marketing, stop disclosing for others' marketing, and say where the information came from, free of charge and within a reasonable period. Source: https://www.legislation.gov.au/C2004A03712/latest/text | A log of opt-out and source requests with the date actioned | Opt-outs not applied across all mailing tools | ☐ yes ☐ partly ☐ no ☐ n/a | ||||
| APP 7.8 | APP 7 does not apply to the extent the Spam Act 2003, the Do Not Call Register Act 2006 or another prescribed law applies. Source: https://www.legislation.gov.au/C2004A03712/latest/text | A note of which law governs each marketing channel (email and SMS under the Spam Act) | Email marketing run without considering the Spam Act | ☐ yes ☐ partly ☐ no ☐ n/a |
Completing this worksheet records what your practice holds and where. It does not make a practice compliant or ready for audit, and it is not legal advice.