The Australian Privacy Principles (APPs) form the backbone of privacy law in Australia. If you're a marketer collecting email addresses, running retargeting ads, using analytics tools, or storing customer data in any SaaS platform, the APPs govern what you can do with that data. The 2025 Privacy Act reforms have tightened requirements further, particularly around consent, data breach notification, and overseas data transfers.
The APPs that matter most for marketers
APP 3. Collection
You may only collect personal information that is reasonably necessary for your business functions. Collecting data "just in case" or "for future use" without a clear purpose is a breach. Your sign-up forms should ask for only what you actually need.
APP 5. Notification
When you collect personal information, you must tell the person what you're collecting, why, who you'll share it with, and whether it will go overseas. This is your privacy notice. And it needs to be specific, not a copy-pasted generic policy.
APP 6. Use and disclosure
You can only use personal information for the purpose you collected it for (or a directly related purpose the person would reasonably expect). Collecting an email for a product enquiry and adding it to your marketing newsletter without consent is a breach.
APP 8. Cross-border disclosure
Before sending personal information overseas. Which includes using a SaaS tool hosted outside Australia. You must take reasonable steps to ensure the overseas recipient handles the information in accordance with the APPs. This is the principle that makes data residency a practical, not just philosophical, concern.
Practical steps for marketing teams
- Audit your marketing stack. Where does each tool store data?
- Review your sign-up forms. Are you collecting only what you need?
- Update your privacy policy to reflect what you actually do with data
- Implement proper consent mechanisms for marketing communications
- Choose Australian-hosted tools where possible to simplify APP 8 obligations
Why Brand and Go chose Sydney
Brand and Go hosts all data in australia-southeast1 (Sydney) specifically to simplify your APP 8 obligations. When your marketing platform is Australian- hosted, you don't need to assess overseas privacy laws or add cross-border disclosure clauses. Your data stays in Australia, under Australian law.