Do labour-hire firms need a privacy policy?
Generally yes. A labour-hire or on-hire firm handles worker and candidate personal information as its core business and discloses worker details to the host businesses it supplies, so where you are covered by the Australian Privacy Principles you need a privacy policy and proper collection notices. The wrinkle is the employee-records exemption, s 7B(3) of the Privacy Act 1988 (Cth): where you are the legal employer of the on-hire worker it can reach that worker's genuine employee records, but it is built around an employer and an employee record, so it does not reach the applicant and candidate data you handle around that.
By Jon Oates, Founder of Privaproof · Last updated
General information, not legal advice. Privaproof is not a law practice.
Why labour-hire sits under the Privacy Act
A labour-hire firm collects and holds a lot of personal information: applicants and workers, identity and right-to-work documents, qualifications and checks, and it discloses worker details to host employers it places people with. That engages the Australian Privacy Principles wherever you are a covered entity, and turnover alone does not settle that: under s 6D(4)(c) and (d) a business paid to collect personal information, or that discloses it for a benefit, is not a small business operator, subject to the consent carve-outs in s 6D(7) and (8). Does your host agreement do either? Read: does the Privacy Act apply to recruitment agencies?
The employee-records exemption is more complex here
Unlike a placement agency that hands a candidate to a client to employ, a labour-hire firm may itself be the employer of the on-hire worker. Whether it is depends on how you engage your workers, and that decides how much of s 7B(3) you can use:
- On-hire workers you employ. s 7B(3) exempts an act by an organisation that is or was an employer where it is directly related to both a current or former employment relationship and an employee record you hold about that individual. Both limbs, not either.
- Applicants and candidates. An applicant is not yet your employee and has no employee record with you, so the second limb of s 7B(3) fails. The OAIC is blunt about the sector: "The employee records exemption is unlikely to apply to organisations that provide recruitment, human resource management services, or medical, training or superannuation services under contract to an employer." OAIC guidance Read: employee records vs candidate records
- Information moving both ways. Passing a worker's details to a host is a use or disclosure, and wherever s 7B(3) does not cover it you handle it under APP 6.1 and cover it in your collection notice. Running the other way, the OAIC states the exemption "does not cover contractors and subcontractors when they handle the personal information of the employees of another organisation", so a host's own staff records in your hands are not exempt at all.
So the practical position is that you cannot treat the whole operation as exempt just because you employ the workers. Applicant handling sits outside s 7B(3), and so does anything you hold about people you do not employ. A test on your own files: for each one, can you name the employment relationship and the employee record it belongs to?
What you need, in practice
- A privacy policy (APP 1.3) covering worker and candidate data and disclosure to host businesses. From 10 December 2026 an entity covered by the APPs must also disclose automated decision-making where a computer program is used in making a decision that could reasonably be expected to significantly affect a person, which reaches screening tools that score, rank or auto-reject. Read: the ADM rule and your ATS
- Collection notices for applicants and workers, covering third-party collection (referees, checks) under APP 5.2(b) and, under APP 5.2(f), the types of recipients you usually disclose to, which is where the hosts belong.
- Sensitive-information handling for police checks and medicals: a criminal record is sensitive information under s 6(1) and a medical is health information, so APP 3.3 permits collection only with consent and where reasonably necessary for your functions. Read: police checks and medicals
- A data-breach plan and a retention schedule for the worker and candidate data you hold, because APP 11.2 requires you to destroy or de-identify what you no longer need.
A separate regime to be aware of (not privacy)
Several states run labour-hire licensing schemes that sit outside privacy law and impose their own obligations on providers, including Victoria (Labour Hire Licensing Act 2018), Queensland (Labour Hire Licensing Act 2017) and South Australia (Labour Hire Licensing Act 2017). Whether one applies to you depends on your state and the nature of your work. A licence answers nothing about your Privacy Act position, so confirm your licensing position for your own state independently.
This is general information and document templates you tailor to your own business, not legal advice.
Common questions
We employ our on-hire workers. Are we exempt?
Not across the board. s 7B(3) reaches an act directly related to both a current or former employment relationship and an employee record you hold, so it can cover records of workers you actually employ. It does not cover your applicant and candidate data, nor information about people you do not employ, including a host's own staff. So you still need a policy and notices.
Do we need to tell workers we share their details with hosts?
Yes, where you are covered by the APPs. Hosts are the kind of recipient APP 5.2(f) asks you to name in a collection notice, being the types of persons you usually disclose that kind of information to, and the disclosure sits under APP 6.1 wherever the exemption does not reach it. Workers should understand that placing them means sharing relevant details with the host.
Is labour-hire licensing the same as privacy compliance?
No. Labour-hire licensing (where it applies in your state) is a separate regulatory regime with its own requirements. This page is about your Privacy Act obligations; confirm any licensing obligations separately for your state.
This is general information and document templates you tailor to your own business, not legal advice. Privaproof is not a law practice and does not provide legal advice. State labour-hire licensing is a separate regime that varies by jurisdiction, so confirm your own position. For advice on your specific circumstances, consult a qualified Australian legal practitioner.