Skip to content
Get the Recruitment Kit

Home › Recruitment › Does the Privacy Act apply to recruitment agencies?

Does the Privacy Act apply to recruitment agencies?

Often yes, and sometimes even under the A$3 million small-business threshold. Three things drive it: the employee-records exemption does not cover candidates, the regulator treats recruitment providers as unlikely to get that exemption anyway, and s 6D(4) takes a business out of the small-business exemption on any of six grounds, of which turnover is only one. The ground that fits recruitment is s 6D(4)(c), disclosing personal information about someone for a benefit, which reaches an agency that supplies candidate information to employer clients for a fee, though the s 6D(7) consent carve-out will often answer it where candidates asked to be put forward. Section 6D(4)(a) runs one way: a single completed financial year over A$3 million ends the exemption for good. On top of all that, a new automated-decision disclosure duty starts on 10 December 2026.

By Jon Oates, Founder of Privaproof · Last updated

General information, not legal advice. Privaproof is not a law practice.

Why "we are a small agency, so we are exempt" is weaker here

Two exemptions get raised in recruitment, and both are narrower than people assume.

The employee-records exemption is about your own staff, not candidates

The employee-records exemption (s 7B(3)) is available only to "an organisation that is or was an employer of an individual", and only for acts directly related to that employment relationship and to an employee record. Candidates are not your employees, so their applications, CVs, references, screening results and interview notes are not employee records. The OAIC's employee records exemption guidance goes further: the exemption "is unlikely to apply to organisations that provide recruitment, human resource management services... under contract to an employer". So the very data an agency exists to handle sits under the Australian Privacy Principles. Read the detail: employee records vs candidate records

The small-business exemption is a list of exits, not just a turnover test

A business with annual turnover of A$3 million or less is generally outside the APPs under the small-business exemption (s 6D(1), (3)). But s 6D(4) sets out six grounds that take you out of it, and turnover is only the first. You are not a small business operator if you have had annual turnover of more than A$3 million for any financial year that has ended since you started the business (s 6D(4)(a), and that ground does not reverse if turnover later falls), if you provide a health service and hold health information (s 6D(4)(b)), if you disclose personal information about another individual to anyone else for a benefit, service or advantage (s 6D(4)(c)), if you provide a benefit, service or advantage to collect personal information about another individual from anyone else (s 6D(4)(d)), if you are a contracted service provider for a Commonwealth contract (s 6D(4)(e)), or if you are a credit reporting body (s 6D(4)(f)). Section 6D(9) adds a body corporate related to a body corporate that is not a small business, and s 6EA lets an operator choose to be treated as an organisation. For a recruitment agency the live one is s 6D(4)(c): collecting candidate information and providing it to employer clients for a fee is a disclosure for a benefit. Paying a third party for access to a talent pool is the s 6D(4)(d) side of the same coin.

But there is a carve-out that matters a great deal here, and it often runs in the agency's favour. Section 6D(7) takes a disclosure outside s 6D(4)(c) where the individual consented to it, or where it is required or authorised by or under legislation, and s 6D(8) does the same for the s 6D(4)(d) collection limb. A candidate who registers with you and asks to be put forward for roles has consented to exactly the disclosure in question. So the limb bites less often than the bare words suggest, and the real question becomes whether your consents genuinely cover what you actually do with candidate data: passing it to clients the candidate never asked to be sent to, adding people to a talent pool from scraped or third-party sources, or reusing an old application for a new role.

Whether any of these apply is fact-specific, and it is worth three questions rather than an assumption. Has any completed financial year since you started been over A$3 million? Are you part of a group with a company above the threshold? Do your candidate consents cover every client you send a CV to? If the answer to all three is no, you may genuinely be exempt on turnover, and we will say so. If it is yes to any of them, the whole business is inside the Act regardless of what you turn over now.

What being covered actually means

If the APPs apply to you, then for the candidate (and other) personal information you hold you owe, among other things:

The 10 December 2026 change applies to you too

Separately from the coverage question, from 10 December 2026 APP 1.7 requires an APP entity's privacy policy to carry the APP 1.8 information where three things are true together: a computer program makes, or does a thing substantially and directly related to making, a decision; that decision could reasonably be expected to significantly affect an individual's rights or interests; and the individual's personal information is used in the program. An applicant-tracking system that scores, ranks or auto-rejects candidates is the obvious fit, and APP 1.9(a) settles the auto-reject: refusing or failing to make a decision counts as making one. Read: the ADM rule and your ATS

Common questions

We are well under A$3 million. Are we really covered?

Possibly, and for more than two reasons. Candidate data is not shielded by the employee-records exemption. Separately, s 6D(4) sets out six exits from the small-business exemption and turnover is only one of them, so supplying candidate information to employer clients for a fee (s 6D(4)(c)) or being related to a company above the threshold (s 6D(9)) can put you outside it entirely. And s 6D(4)(a) runs one way: if any completed financial year since you started was over A$3 million, you are outside the exemption now even if you are well under today. Current turnover alone does not settle it.

We only recruit, we do not "sell" data. Does the trading point still apply?

It can, because s 6D(4)(c) is about disclosing personal information about another individual to anyone else for a benefit, service or advantage, not about "selling data" in the everyday sense. Placing candidates with employers for a fee involves disclosing their information for a benefit. But s 6D(7) carves out disclosures the individual consented to, and a candidate who asked to be put forward has consented to that disclosure, so in the ordinary case the limb does not bite. It matters most where you go beyond what the candidate agreed to. Section 6D(4)(d) runs the other way: paying a benefit, service or advantage to be allowed to collect personal information from someone else, such as buying access to a talent pool, is its own ground. Fact-specific, so check it rather than assume in either direction.

Are our own internal staff records covered?

Genuine employee records about your own current or former staff can fall within the employee-records exemption. That is separate from your candidate data, which generally does not. Keep the two apart. Read: in-house HR vs recruitment agency

This is general information and document templates you tailor to your own business, not legal advice. Privaproof is not a law practice and does not provide legal advice. Whether the Privacy Act 1988 (Cth) applies to your business depends on the facts, including your turnover, structure and how you collect and supply candidate data. For advice on your specific circumstances, consult a qualified Australian legal practitioner.

Keep reading