In-house HR vs recruitment agency: who is covered by the Privacy Act?
It depends on whose data, at what stage, and whether you are covered at all. The employee-records exemption (s 7B(3)) is written for an organisation "that is or was an employer of an individual" and for "an employee record held by the organisation", so an in-house team can rely on it for its own current and former staff. The OAIC says it does not cover future employment relationships, so it does not reach an applicant you never employ, and is unlikely to apply to recruitment providers at all. Whether either of you is covered is a separate s 6D question.
By Jon Oates, Founder of Privaproof · Last updated
General information, not legal advice. Privaproof is not a law practice.
Three situations, three answers
1. In-house HR, handling your own current or former staff. The exemption (s 7B(3)) can apply here. It covers an organisation "that is or was an employer of an individual" where the act is directly related to both a current or former employment relationship and "an employee record held by the organisation and relating to the individual". Both limbs must be met, so a genuine employee file can fall outside the APPs on that basis.
2. In-house HR, handling job applicants. This is the part people miss. The OAIC states that the exemption "does not cover future employment relationships" and "will not apply to the collection of personal information about prospective employees who are subsequently not employed by an organisation, such as unsuccessful job applicants". But "once an employment relationship is formed", the records of "that individual's pre-employment checks become exempt". The exemption follows the hire, so it is the applicants you do not hire that it never reaches.
3. A recruitment or staffing agency. You are handling candidate data as your core business, usually under contract to employer clients. The OAIC states:
"The employee records exemption is unlikely to apply to organisations that provide recruitment, human resource management services, or medical, training or superannuation services under contract to an employer."
So the exemption does not shield an agency's candidate handling, and no contract with a client employer changes that. Whether an agency is covered by the Act at all is a separate question under s 6D, where turnover alone does not settle it. Read the detail: employee records vs candidate records
What follows from each
- An agency should settle coverage under s 6D first, then, if covered, run candidate data on the full APP standard: privacy policy, collection notice, sensitive-info care, overseas rules, retention limits, and the automated-decision disclosure. Read: does the Privacy Act apply to recruitment agencies?
- An in-house team should keep the two streams separate: the exemption can cover established staff files, while applicant handling sits outside it. You may also be outside the Act entirely, because with annual turnover of A$3 million or less and no s 6D(4) trigger you are a small business operator and the APPs do not reach candidate data either. If you are covered, the privacy policy and collection notices should cover candidates properly, not just employees.
A change on the horizon
The employee-records exemption has been under review as part of the wider Privacy Act reform, and there have been proposals to narrow it. That does not change the position today, and this page describes the current law, but it is one more reason to work from documents that are kept current as the law changes so your position moves with any reform rather than going stale.
This is general information and document templates you tailor to your own business, not legal advice.
Common questions
We are an employer, not an agency. Do we still need candidate privacy documents?
Settle coverage first, because you may not need them. With annual turnover of A$3 million or less and no s 6D(4) trigger you are a small business operator under s 6D and outside the APPs, and the exemption is then beside the point. If you are covered, the exemption does not reach applicants you do not employ, so yes: candidates need a collection notice and policy coverage of their own.
Our HR is outsourced to a provider. Who is covered?
The exemption is unlikely to help the provider. The OAIC says it "does not cover contractors and subcontractors when they handle the personal information of the employees of another organisation, notwithstanding their contractual arrangements", and that such a contractor must comply with the APPs, including the notice requirements in APP 5. So if the provider is an APP entity, that data sits on the APP standard, and your contract should reflect it.
When does an applicant become an "employee" for the exemption?
Broadly, when an employment relationship is formed. The OAIC draws it both ways: the exemption "does not cover future employment relationships", but "once an employment relationship is formed with an individual, the records the employer holds relating to that individual's pre-employment checks become exempt". So the same police check can be APP-covered for the candidate you turn down and exempt for the one you hire, which is why the streams are worth separating at collection.
This is general information and document templates you tailor to your own business, not legal advice. Privaproof is not a law practice and does not provide legal advice. Whether the employee-records exemption applies to any particular record depends on the facts, and the exemption is under review, so confirm the current law. For advice on your specific circumstances, consult a qualified Australian legal practitioner.