Every business that collects personal information relies on consent at some point. It might be a customer ticking a checkbox, a client signing an intake form, or a website visitor accepting a cookie banner. Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), consent is not a single event. It is a legal standard with specific requirements. Getting it wrong can expose a business to regulatory penalties and reputational damage. Since June 2025, it can also lead to a direct civil claim from an individual. This guide explains what counts as valid consent under Australian law, where the General Data Protection Regulation (GDPR) applies to Australian businesses, and the practical steps founders and operators should take to reduce their risk.
What Counts as Valid Consent Under Australian Privacy Law
The Office of the Australian Information Commissioner (OAIC) sets out four elements of valid consent. First, the individual needs to be adequately informed before they decide. They must understand what they are agreeing to, along with the consequences of saying yes or no. Second, the individual must give consent voluntarily. There should be no pressure, and no take-it-or-leave-it bundling of unrelated permissions. Third, consent must stay current and specific. A business cannot rely on a general agreement from years ago to justify a new use of someone’s data. It cannot assume ongoing consent for purposes it never clearly described. Fourth, the individual needs the capacity to understand the decision and communicate it clearly.
Consent can be express or implied. A person gives express consent explicitly, through a signature, a clicked checkbox, or a clear verbal agreement. Businesses must get express consent before they collect or use sensitive information, such as health records, biometric data, or information about sexual orientation or criminal history. Implied consent may apply to non-sensitive personal information, where it is reasonable to infer agreement from someone’s conduct. Simply telling a person what a business does with their data, buried in a long privacy policy, is not enough on its own. A genuine and easily accessible opt-out is usually needed to support a claim of implied consent.
Consent Is Not a Blanket Permission
Many businesses believe that once they have consent, they can use personal information however they like. That is a misconception. APP 3 requires businesses to only collect personal information that is reasonably necessary for their functions, regardless of consent. Consent is one part of a broader compliance picture. That picture also includes clear collection notices under APP 5, secure storage, and limits on how long a business retains information. Businesses handling health information for a medical practice, or other sensitive data, should treat consent as the starting point of compliance, not the end of it.
The Small Business Exemption Still Applies, For Now
Many small operators assume the Privacy Act does not apply to them. Businesses with an annual turnover under 3 million dollars are generally exempt. The Attorney-General’s Department confirms this threshold is still current. However, the exemption does not cover every small business. Health service providers, businesses that trade in personal information for a benefit, and contracted service providers under Commonwealth contracts are common exceptions. Commentators have discussed reforming this threshold, so businesses close to the cutoff should monitor developments rather than assume the exemption will stay unchanged indefinitely.
Higher Penalties and a New Right to Sue
Getting consent wrong now carries more risk than it did a few years ago. For a serious or repeated interference with privacy, a corporation can face a steep civil penalty. The maximum is the greater of 50 million dollars, three times the value of any benefit from the breach, or 30 percent of adjusted turnover during the breach period. An individual can face a penalty of up to 2.5 million dollars. Separately, a new statutory tort for serious invasions of privacy commenced on 10 June 2025. It lets an individual sue directly where someone has intruded on their seclusion or misused their personal information. The public interest in protecting their privacy must outweigh any competing public interest. Courts can award damages, an injunction, or an order requiring an apology. Claims generally need to start within one year of the person becoming aware of the invasion, or three years of it occurring.
How the GDPR Can Still Apply to Australian Businesses
Australian businesses that offer goods or services to people in the European Union can fall within the GDPR’s reach. The same applies if a business monitors the behaviour of individuals in the EU. Neither situation requires a physical presence in Europe. The GDPR sets a higher bar for consent than Australian law. It requires consent to be freely given, specific, informed, and given through a clear affirmative action. It also grants individuals rights to access, correct, and erase their personal data. Businesses must notify a supervisory authority of a qualifying data breach within 72 hours. A Data Protection Officer is only mandatory under Article 37 in three situations. The organisation must be a public authority, or its core activities must involve regular and systematic monitoring of individuals at scale, or its core activities must involve large scale processing of special category data. Most small Australian businesses trading occasionally with EU customers will not meet these thresholds, but it is worth checking against actual data flows rather than assuming.
Practical Steps to Reduce Risk
Businesses should review their consent mechanisms rather than treat a privacy policy as a formality. Ask for separate consent for distinct purposes, instead of bundling everything into one broad acceptance. Keep clear records of when and how each person gave consent, in case a business needs to demonstrate this later. Review website cookie banners and forms to confirm they meet the informed and voluntary standard. Train staff who collect personal information on what does and does not count as valid consent. For businesses in regulated industries, such as fintech startups seeking an AFSL, privacy compliance often intersects with other licensing obligations. It is worth reviewing these together rather than in isolation. A privacy and data protection lawyer can review existing consent processes and flag gaps before they become a regulatory or litigation risk.
Frequently Asked Questions
1. Is a privacy policy the same as consent?
No. A privacy policy is a notice that tells people what a business does with their information under APP 5. Consent is a separate, affirmative agreement. A business cannot treat a person reading its privacy policy as proof of consent.
2. Can a business rely on implied consent for sensitive information?
No. Sensitive information, including health, biometric, and criminal history data, always needs express consent under Australian privacy law. Implied consent only applies to non-sensitive personal information, and even then, a genuine opt-out is usually needed.
3. Does the small business exemption mean startups can ignore the Privacy Act?
Not necessarily. The exemption generally applies to businesses with turnover under 3 million dollars. Common exceptions include health service providers and businesses that trade in personal information. Many startups also choose to comply voluntarily, because customers and investors expect it.
4. What happens if a business gets consent wrong?
The OAIC can investigate, and corporations can face civil penalties of up to 50 million dollars. Since June 2025, an individual can also bring a direct legal claim under the new statutory tort for serious invasions of privacy.
5. Do Australian businesses need to comply with the GDPR?
Only if they offer goods or services to people in the European Union, or monitor the behaviour of individuals there. Where the GDPR does apply, its consent and data subject rights standards are generally higher than the Australian Privacy Principles.
6. When is a Data Protection Officer required?
Only when the organisation is a public authority, or its core activities involve regular and systematic monitoring of individuals at scale, or its core activities involve large scale processing of special category data. Most small businesses will not meet this threshold.
How Allied Legal Can Help
Consent requirements sit differently for every business, depending on the data collected, the industry, and whether any overseas customers are involved. Our privacy and data protection team works with Australian startups and scaleups to review existing consent forms, cookie banners, and privacy policies against the Australian Privacy Principles, and to flag where the GDPR or another overseas regime might also apply. We can help draft clear, compliant consent language for onboarding and marketing, set up data collection notices under APP 5, and assess whether the small business exemption genuinely applies to your operations. If a data breach or privacy complaint has already occurred, we can also advise on notification obligations and exposure under the new statutory tort. Reach out to Allied Legal to have your consent processes reviewed before they become a compliance gap.
This article is provided for general information only and does not constitute legal advice. You should obtain legal advice specific to your circumstances before acting on any information contained in this article.
