Does the Privacy Act apply to recruitment agencies?
Often yes, and sometimes even under the A$3 million small-business threshold. Three things drive it: the employee-records exemption does not cover candidates, the regulator treats recruitment providers as unlikely to get that exemption anyway, and an agency that supplies candidate information to employer clients may be trading in personal information in a way that removes the usual small-business exemption, though the consent carve-out in s 6D(7) will often prevent that where candidates asked to be put forward. On top of all that, a new automated-decision disclosure duty starts on 10 December 2026.
By Jon Oates, Founder of Privaproof · Last updated
General information, not legal advice. Privaproof is not a law practice.
Why "we are a small agency, so we are exempt" is weaker here
Two exemptions get raised in recruitment, and both are narrower than people assume.
The employee-records exemption is about your own staff, not candidates
The employee-records exemption covers records directly related to a business's own current or former employees. Candidates are not your employees, so their applications, CVs, references, screening results and interview notes are not employee records, and the exemption generally does not reach them. The OAIC has gone further and said the exemption is unlikely to apply to recruitment and human-resource-services providers at all. So the very data an agency exists to handle sits under the Australian Privacy Principles. Read the detail: employee records vs candidate records
The small-business exemption can fall away if you trade in candidate data
A business with annual turnover of A$3 million or less is often outside the APPs under the small-business exemption (s 6D). But that exemption is lost if, among other things, the business discloses personal information about an individual to anyone else for a benefit, service or advantage, or provides a service to another person to collect their personal information. A recruitment agency's core activity, collecting candidate information and providing it to employer clients for a fee, can look a lot like exactly that.
But there is a carve-out that matters a great deal here, and it usually cuts in your favour. Section 6D(7) takes a disclosure outside the trading limb where the individual consented to it, and s 6D(8) does the same for the collection limb. A candidate who registers with you and asks to be put forward for roles is consenting to exactly the disclosure in question, which is the ordinary case in recruitment rather than an exception. So the trading limb is much less likely to bite than the bare words suggest, and the real question becomes whether your consents genuinely cover what you actually do with candidate data, including passing it to clients the candidate never asked to be sent to, adding people to a talent pool from scraped or third-party sources, or reusing an old application for a new role.
Whether it applies in your case is fact-specific and worth working through rather than assuming either way, because if it does apply your whole business is covered regardless of turnover confirm against how your agency actually collects, uses and supplies candidate data.
What being covered actually means
If the APPs apply to you, then for the candidate (and other) personal information you hold you owe, among other things:
- A privacy policy (APP 1), including, from 10 December 2026, disclosure of any automated decision-making in your hiring tools. Read: what a recruitment agency's privacy policy must cover
- A collection notice (APP 5) at the points you collect candidate data, including data you gather about someone from a third party such as a referee.
- Higher handling standards for sensitive information such as police checks and pre-employment medicals (APP 3). Read: police checks and medicals
- Care with overseas disclosure (APP 8) if you use offshore recruiters or screening providers.
- Security, retention limits and a data-breach response for candidate files.
The 10 December 2026 change applies to you too
Separately from the coverage question, from 10 December 2026 an entity covered by the APPs must disclose automated decision-making that significantly affects a person. An applicant-tracking system that scores, ranks or auto-rejects candidates is squarely the kind of tool that triggers this. Read: the ADM rule and your ATS
Common questions
We are well under A$3 million. Are we really covered?
Possibly, for two independent reasons. Candidate data is not shielded by the employee-records exemption, and if you supply candidate information to employer clients for a fee you may fall outside the small-business exemption entirely. Turnover alone does not settle it in recruitment.
We only recruit, we do not "sell" data. Does the trading point still apply?
It can, because the test is about disclosing personal information for a benefit or providing a service to collect it, not about "selling data" in the everyday sense. Placing candidates with employers for a fee involves disclosing their information for a benefit. But s 6D(7) carves out disclosures the individual consented to, and a candidate who asked to be put forward has consented to that disclosure, so in the ordinary case the limb does not bite. It matters most where you go beyond what the candidate agreed to. Fact-specific, so check it rather than assume in either direction.
Are our own internal staff records covered?
Genuine employee records about your own current or former staff can fall within the employee-records exemption. That is separate from your candidate data, which generally does not. Keep the two apart. Read: in-house HR vs recruitment agency
This is general information and document templates you tailor to your own business, not legal advice. Privaproof is not a law practice and does not provide legal advice. Whether the Privacy Act 1988 (Cth) applies to your business depends on the facts, including your turnover, structure and how you collect and supply candidate data. Privaproof's recruitment documents are self-authored and are not independently reviewed by a solicitor. For advice on your specific circumstances, consult a qualified Australian legal practitioner.