| APP 1 | Open and transparent management | Maintain a clear privacy policy; take reasonable steps to implement practices that ensure compliance |
| APP 2 | Anonymity and pseudonymity | Give individuals the option of dealing anonymously or under a pseudonym where practicable |
| APP 3 | Collection of solicited personal information | Collect only information reasonably necessary for functions/activities; collect sensitive information only with consent |
| APP 4 | Dealing with unsolicited personal information | If unsolicited information could not have been collected under APP 3, destroy or de-identify it |
| APP 5 | Notification of collection | Notify individuals of: identity, purpose, third-party disclosures, overseas disclosures, access/correction rights, complaint mechanism |
| APP 6 | Use or disclosure | Use or disclose only for the purpose of collection or a directly related secondary purpose within reasonable expectations |
| APP 7 | Direct marketing | May use for direct marketing if individual would reasonably expect it and opt-out is provided; sensitive information requires consent |
| APP 8 | Cross-border disclosure | Before disclosing overseas, take reasonable steps to ensure the overseas recipient complies with the APPs |
| APP 9 | Adoption, use, or disclosure of government identifiers | Must not adopt a government identifier as own identifier; limited use and disclosure |
| APP 10 | Quality of personal information | Take reasonable steps to ensure information is accurate, up-to-date, complete, and relevant |
| APP 11 | Security of personal information | Take reasonable steps to protect from misuse, interference, loss, and unauthorised access; destroy or de-identify when no longer needed |
| APP 12 | Access to personal information | On request, give individuals access to their personal information |
| APP 13 | Correction of personal information | Take reasonable steps to correct if inaccurate, out-of-date, incomplete, irrelevant, or misleading |
