Broker guide
The 13 Australian Privacy Principles for Mortgage Brokers
All 13 Australian Privacy Principles explained with a broker example for each, from collection notices to overseas disclosure and data security.
- Published
- Updated
The Australian Privacy Principles are 13 rules governing how covered organisations and government agencies handle personal information under the Privacy Act 1988. For mortgage brokers, they apply across a client’s file, including information entered into an AI tool.
A new tool changes who can access client information and what happens to it. Assess those data flows before uploading documents or connecting client records.
What the Australian Privacy Principles Are
The Australian Privacy Principles (APPs) set obligations for collecting and handling personal information, including security and clients’ access rights. An APP entity is an agency or organisation covered by the Privacy Act.
Most private businesses with annual turnover above $3 million are covered, along with some smaller businesses. The small-business exemption has exceptions, so turnover alone doesn’t settle whether your brokerage is an APP entity. The Office of the Australian Information Commissioner (OAIC) explains these in its small-business guidance.
The Privacy Act explains the wider legal framework. The OAIC’s introductory APP guidelines distinguish the binding principles from the regulator’s interpretation and good-practice examples. For a specific legal question about your brokerage, contact the OAIC or a lawyer.
The 13 APPs at a Glance
There are 13 Australian Privacy Principles. Each linked principle below opens its corresponding chapter of the OAIC APP guidelines. The broker examples are hypothetical applications.
| Principle | What It Requires | Broker Example |
|---|---|---|
| APP 1: Open and transparent management | Maintain privacy procedures and a clear, accessible privacy policy. | Explain how your brokerage handles client files and privacy complaints. |
| APP 2: Anonymity and pseudonymity | Allow anonymous dealings or a pseudonym unless a legal or practical exception applies. | Answer a general enquiry without demanding identification; assess identification needs when an application starts. |
| APP 3: Solicited information | Collect only information reasonably necessary for your activities, by lawful and fair means. | Request income evidence needed for the application, avoiding unrelated personal records. |
| APP 4: Unsolicited information | Assess unexpected information and destroy or de-identify it where required. | Review an unrelated medical report a client sends instead of automatically saving it. |
| APP 5: Collection notification | Take reasonable steps to explain collection and relevant handling arrangements. | Give a collection notice when requesting a client’s fact find. |
| APP 6: Use or disclosure | Use or disclose information for its collection purpose unless an exception permits another purpose. | Assess the permitted purpose before sending client documents to an AI provider. |
| APP 7: Direct marketing | Meet the applicable marketing conditions and honour opt-out requests. | Assess permission before using a client list for promotions and provide a simple opt-out. |
| APP 8: Cross-border disclosure | Take reasonable steps before overseas disclosure, subject to specified exceptions. | Assess an offshore processor’s handling of client information before granting access. |
| APP 9: Government related identifiers | Restrict adoption, use and disclosure of government identifiers. | Assign your own client number instead of using a driver’s licence number as your client identifier. |
| APP 10: Information quality | Take reasonable steps to keep collected information accurate, current and complete; assess relevance when using or disclosing it. | Check an AI-generated income summary against the client’s evidence before sending it to a lender. |
| APP 11: Information security | Protect information and destroy or de-identify it when retention is no longer justified. | Restrict file access and remove expired records under your retention schedule. |
| APP 12: Access | Give individuals access to their personal information on request, subject to exceptions. | Locate a client’s information across your file systems when they request access. |
| APP 13: Correction | Take reasonable steps to correct personal information and handle correction requests. | Correct an inaccurate employment record and assess whether recipients need notification. |
Collecting Client Information (APPs 3 to 5)
APP 3 allows a private-sector APP entity to collect personal information reasonably necessary for its functions or activities. Collection must be lawful and fair, and generally from the individual unless that is unreasonable or impracticable.
For example, requesting payslips to assess a loan application has a defined purpose. Collecting a client’s entire email history because an AI tool can analyse it requires a separate necessity assessment.
APP 4 covers information you didn’t solicit. Decide within a reasonable period whether APP 3 would have allowed its collection. If it wouldn’t, destroy or de-identify it as soon as practicable where lawful and reasonable, subject to the Commonwealth-record exception.
APP 5 requires reasonable steps to notify clients of relevant collection matters at or before collection, or as soon as practicable afterwards. A privacy collection notice must reflect the actual process.
Explain your identity and contact details, why you collect the information and any relevant legal collection requirement. Cover the consequences of non-collection and usual recipients.
Identify likely overseas disclosures and name the countries where practicable. Explain how your privacy policy covers access, correction and complaints.
A website privacy policy alone doesn’t establish that you’ve taken reasonable steps to notify someone completing a separate document-upload form.
Using and Disclosing Information (APP 6)
APP 6 generally permits use or disclosure for the primary purpose of collection. Another purpose needs consent or an applicable exception.
One exception covers a secondary purpose the client reasonably expects, where it relates to the primary purpose. For sensitive information, the relationship must be direct. Other exceptions include handling required or authorised by Australian law.
In a hypothetical application, you collect payslips to help arrange a home loan. Sending necessary income evidence to the intended lender serves that purpose. Allowing an AI provider to use those payslips for general model training introduces another purpose requiring assessment.
Whether an AI input is a use or disclosure depends on effective control over the information. A subscription or a confidentiality promise doesn’t settle that question. Assess the actual access and contract terms before sharing client data.
The OAIC recommends avoiding personal information in publicly available generative AI tools, particularly sensitive information. Its guidance on commercially available AI products explains the risks. Our guide to OAIC AI guidance applies those considerations to broker workflows.
Sending Information Overseas (APP 8)
APP 8 generally requires reasonable steps before disclosing personal information to an overseas recipient. Those steps must address the recipient’s compliance with the APPs other than APP 1. Under section 16C, your brokerage can remain accountable for the overseas recipient’s handling.
Check where an AI provider processes information and which overseas staff or subcontractors can access it. An Australian storage location doesn’t establish that all processing and support access remain in Australia.
Some arrangements that keep information under your effective control are a use rather than a disclosure. The distinction depends on the arrangement, so a foreign server alone doesn’t decide the APP 8 question.
APP 8 has exceptions, including specified overseas legal protections and informed consent after a particular warning about accountability. A generic consent to overseas processing doesn’t automatically meet that exception. Assess APP 6 permission separately, then document the applicable APP 8 basis before enabling overseas access.
Security and Retention (APP 11)
APP 11 requires reasonable technical and organisational measures to protect personal information against misuse and loss, including unauthorised access or disclosure. The measures depend on the risks and circumstances.
For a brokerage, practical measures include limiting file access by role and requiring multi-factor authentication. Staff training and a process for removing access when someone leaves support those controls. Include AI inputs and retained outputs in the assessment.
When information is no longer needed for a permitted purpose, take reasonable steps to destroy or de-identify it. Exceptions include legally required retention and Commonwealth records. APP 11 doesn’t set one universal retention period for every broker document.
Use a retention schedule that records why each file category remains necessary. Before removing records, account for legal retention requirements. Ensure the process covers copies held by service providers as well as your main client system.
Access and Correction (APPs 12 and 13)
APP 12 generally gives clients access to personal information you hold about them. APP 13 requires reasonable steps to correct information where requested or where you’re satisfied it needs correction.
Tell clients how to contact your privacy contact and describe the information they want. Verify identity proportionately before releasing records.
A private organisation must respond within a reasonable period. The OAIC’s general guide is no more than 30 calendar days.
Access isn’t confined to the documents a client originally supplied. Consider personal information held in file notes and AI-generated summaries too.
Access exceptions can apply, including protecting another person’s privacy. If refusing access, provide the required written reasons and complaint options.
For correction, assess whether information is inaccurate or misleading for the purpose you hold it. You can’t charge for a correction request or the correction itself. Where requested, take reasonable steps to notify other APP entities that received corrected information, unless that is unlawful or impracticable.
If you refuse correction, give written reasons and complaint options. On request, take reasonable steps to attach the client’s statement that they consider the information incorrect. A disputed AI summary needs this process just as another client record does.
Sensitive Information
Sensitive information is a defined subset of personal information under the Privacy Act, with higher protections. It includes health information and criminal records, along with information about racial or ethnic origin, religious or philosophical beliefs and sexual orientation or practices.
The definition also covers political opinions and association membership, professional or trade association membership and trade union membership. Genetic information and specified biometric information or templates are included. The OAIC explains the categories in Chapter B of its APP guidelines.
Financial information needs protection, but a bank balance alone isn’t sensitive information under that statutory definition. A statement showing health-related payments or union membership can raise a different issue.
APP 3 generally requires consent as well as reasonable necessity before collecting sensitive information, unless an exception applies. Consent must be informed and voluntary. It must also be current and specific, and the person must have capacity.
A privacy notice doesn’t itself establish consent.
Before adopting an AI tool, identify whether it will receive or infer sensitive information. Remove unnecessary details and establish the lawful collection and handling basis before staff use it with client files.
