Do labour-hire firms need a privacy policy?
Generally yes. A labour-hire or on-hire firm handles worker and candidate personal information as its core business and discloses worker details to the host businesses it supplies, so it needs a privacy policy and proper collection notices like any covered organisation. The wrinkle is the employee-records exemption: because a labour-hire firm often employs the on-hire workers itself, the exemption can reach those workers' genuine employee records, but it does not cover the applicant and candidate data you handle before and around that.
By Jon Oates, Founder of Privaproof · Last updated
General information, not legal advice. Privaproof is not a law practice.
Why labour-hire sits under the Privacy Act
A labour-hire firm collects and holds a lot of personal information: applicants and workers, identity and right-to-work documents, qualifications and checks, and it discloses worker details to host employers it places people with. That collection and disclosure engages the Australian Privacy Principles wherever you are a covered entity. And recall that handling candidate data can also affect whether the small-business exemption is available at all. Read: does the Privacy Act apply to recruitment agencies?
The employee-records exemption is more complex here
Unlike a placement agency that hands a candidate to a client to employ, a labour-hire firm frequently is the employer of the on-hire worker. That matters for the exemption:
- On-hire workers you employ. Genuine employee records directly related to that employment relationship can fall within the employee-records exemption, as they would for any employer's own staff.
- Applicants and candidates. People who have applied or whom you are assessing are not yet your employees, so their data is candidate data under the APPs, exempt from the exemption, so to speak. Read: employee records vs candidate records
- Disclosure to host businesses. Passing a worker's personal information to a host employer is a use and disclosure you need to handle under APP 6 and cover in your collection notice, regardless of the exemption.
So the practical position is that you cannot treat the whole operation as exempt just because you employ the workers. Your applicant handling and your disclosures to hosts sit under the APPs, which is why a proper policy and notices are needed.
What you need, in practice
1. A privacy policy covering worker and candidate data, disclosure to host businesses, and, from 10 December 2026, any automated decision-making in your screening or allocation tools. Read: the ADM rule and your ATS 2. Collection notices for applicants and workers, including third-party collection (referees, checks) and disclosure to hosts. 3. Sensitive-information handling for police checks and medicals. Read: police checks and medicals 4. A data-breach plan and a retention schedule for the worker and candidate data you hold.
A separate regime to be aware of (not privacy)
Several states run labour-hire licensing schemes that are separate from privacy law and impose their own obligations on labour-hire providers. Whether one applies to you, and what it requires, depends on your state and the nature of your work, so confirm your own licensing position independently, that is a different question from your Privacy Act obligations covered here confirm the current labour-hire licensing position for your state.
This is general information and document templates you tailor to your own business, not legal advice.
Common questions
We employ our on-hire workers. Are we exempt?
Not across the board. Genuine employee records about workers you employ can fall within the exemption, but your applicant and candidate data does not, and your disclosure of worker information to host businesses is still governed by the APPs. So you still need a policy and notices.
Do we need to tell workers we share their details with hosts?
Yes. Disclosing a worker's personal information to a host business is a disclosure you should cover in your collection notice and handle under APP 6. Workers should understand that placing them means sharing relevant details with the host.
Is labour-hire licensing the same as privacy compliance?
No. Labour-hire licensing (where it applies in your state) is a separate regulatory regime with its own requirements. This page is about your Privacy Act obligations; confirm any licensing obligations separately for your state.
This is general information and document templates you tailor to your own business, not legal advice. Privaproof is not a law practice and does not provide legal advice. State labour-hire licensing is a separate regime that varies by jurisdiction, so confirm your own position. Privaproof's recruitment documents are self-authored and are not independently reviewed by a solicitor. For advice on your specific circumstances, consult a qualified Australian legal practitioner.