A customer record export has appeared on a public forum. Your Shopify store is still taking orders, the Odoo ERP is still synchronising fulfilment data, and nobody can say precisely which records were accessed. The business owner wants one answer: must we notify the OAIC, customers, or both?
That question can't be answered by a privacy policy sitting in a footer. It depends on your data map, access logs, retention settings, supplier contracts, breach workflow and the people responsible for making decisions. This guide treats the Australian Privacy Act as an operating requirement for retailers, clinics, logistics firms, manufacturers, hospitality operators, schools and professional services teams running Odoo, Shopify, WooCommerce, custom websites or mobile apps.
You'll get a practical view of the law, a control map for your technology stack, and a 90-day implementation plan you can put in front of your operations manager, developer and privacy lead. The focus is simple: reduce uncertainty before an incident forces rushed decisions.
Why This Guide Matters to Australian Businesses Right Now
A Sydney retailer discovers that a file containing customer names, delivery addresses and order references has been posted online. The Shopify administrator account shows an unfamiliar login, while the Odoo database contains the customer history used by the warehouse and support team. The retailer now has to preserve evidence, contain access, understand the affected data and assess whether the incident may be an eligible data breach.
That retailer doesn't need another abstract summary of privacy law. It needs answers to operational questions:
- Who can access customer records?
- Which system holds the authoritative copy?
- Can the team identify the affected individuals?
- Where are overseas service providers involved?
- Who approves a notification and records the reasoning?
The same problem appears in an Adelaide clinic when a staff member sends a patient spreadsheet to the wrong recipient, in a logistics business when consignment data is exposed through a contractor portal, and in a professional services firm when an old shared mailbox contains identity documents. The platform changes, but the failure pattern is consistent. Businesses collect personal information in one place, copy it into several systems, and then struggle to prove what happened.
Practical rule: If your team can't trace a customer record from collection to deletion, your privacy programme is incomplete.
The useful outcome isn't a thicker policy. It's a working control environment. By the end of this guide, you should be able to identify whether the Australian Privacy Act applies to your business, connect the APPs to Odoo ERP, Shopify, WooCommerce and custom apps, and assign practical work for the next 90 days.
Treat the legal requirements as a design brief. Your website, ERP, email platform, mobile app, cloud storage and support desk must produce evidence that people can understand and act on. That approach makes compliance more useful during normal operations and far more dependable during a breach.
How the Australian Privacy Act and APPs Actually Work
Think of the Privacy Act as a building code for personal information. It doesn't merely ask whether your premises exist. It asks whether the structure, access points, maintenance processes and emergency exits are fit for the risks created by your operations.
The Act was passed by the Australian Parliament at the end of 1988 and commenced on 1 January 1989. It originally implemented Australia's commitment to the OECD privacy guidelines and Article 17 of the International Covenant on Civil and Political Rights, and established 11 Information Privacy Principles for Australian Government agencies. The current framework uses 13 Australian Privacy Principles, set out in the Privacy Act legislation.
Businesses often assume that the small-business exemption settles the question. The federal scheme typically captures organisations with annual turnover above A$3 million, but sector-specific rules and data-handling activities can bring smaller operators into scope. The practical question isn't, “Are we large enough?” It's, “Which obligations apply to the information and services we operate?”
The APPs translated into controls
| APP | Plain-English requirement | Typical business control |
|---|---|---|
| APP 1 | Manage personal information openly and transparently | Current privacy policy, data inventory and named privacy contact |
| APP 2 | Offer anonymity or pseudonymity where practical | Guest checkout or limited-information enquiry path |
| APP 3 | Collect only information that is reasonably necessary | Field-by-field collection review |
| APP 4 | Handle unsolicited information properly | Triage, deletion and de-identification procedure |
| APP 5 | Explain collection practices at the point of collection | Checkout notice, form notice and app consent screen |
| APP 6 | Use or disclose information for permitted purposes | Purpose register and approved disclosure workflow |
| APP 7 | Control direct marketing use | Consent records and unsubscribe suppression list |
| APP 8 | Manage overseas disclosures | Supplier register, transfer assessment and contract controls |
| APP 9 | Restrict use of government identifiers | Separate access and prohibited-use checks |
| APP 10 | Keep information accurate | Customer update process and data-quality review |
| APP 11 | Secure information and destroy or de-identify it when no longer needed | Access control, logging, retention schedule and deletion jobs |
| APP 12 | Provide access to personal information | Verified access request workflow |
| APP 13 | Correct inaccurate personal information | Correction queue with downstream update tracking |
In an Odoo implementation, APP 1 and APP 11 should appear as documented roles, access groups, audit logs and retention rules. Shopify and WooCommerce need visible collection notices, data export and deletion handling, while a mobile app needs consent records and governance over analytics SDKs. If you need a plain-language example of how a digital service presents privacy information, you can browse HyperWhisper privacy terms.
Your policy should match your systems. A statement promising deletion is weak if nobody knows how to delete a customer from Odoo, Shopify backups, WooCommerce extensions, email lists and support exports. Use the Wistec data privacy compliance resource as a practical reference point, then test each promise against your actual stack.
Penalties and Enforcement Under the Tiered Regime
Privacy risk now needs a place in the same management conversations as cyber security, financial controls and service continuity. The Australian Privacy Act's tiered enforcement model means a business can face direct financial exposure for serious interference, non-serious interference or certain administrative failures.
For a body corporate involved in a serious interference with privacy, the top civil penalty is the greater of A$50 million, three times the benefit obtained, or 30% of adjusted turnover during the breach period when the benefit can't be determined. The OAIC guide to privacy regulatory action sets out that maximum.
A non-serious interference can attract a mid-tier A$3.3 million penalty, while the lower-tier infringement framework can impose A$330,000 per contravention for corporations for administrative failures such as missing or non-compliant privacy policies and data-breach statements. The figures and structure are also discussed in the OAIC submission on privacy legislation reforms.
What the tiers mean operationally
| Failure type | Financial exposure | Management response |
|---|---|---|
| Serious interference with privacy | Greater of A$50 million, three times the benefit, or 30% of adjusted turnover | Preventative controls, tested incident response and executive oversight |
| Non-serious interference | A$3.3 million | Corrective action, documented investigation and control remediation |
| Certain administrative contraventions | A$330,000 per contravention for corporations | Policy ownership, workflow evidence and compliance checks |
| Certain infringement notices | Up to A$19,800 for a body corporate other than a publicly listed corporation, or A$66,000 for a publicly listed company | Fast correction and response to regulator notices |
| Failure to comply with a compliance notice | A$330,000 pecuniary penalty for a body corporate | Assign notice ownership and track every required action |
The infringement notice figures come from recent legal commentary on changes to Australian privacy laws, including the JWS privacy law update. They aren’t a substitute for legal advice on classification. They are a reason to stop treating a privacy policy as a one-off document.
Management decision: Fund evidence-producing controls before an incident. A logged access review, tested deletion workflow and approved breach statement are more valuable than another meeting about intentions.
A retailer using Shopify with Odoo should be able to show who accessed customer data, which supplier received it, why the data was retained and how the response team reached its decision. That evidence reduces guesswork when the OAIC asks questions and gives executives a defensible basis for action.
The Notifiable Data Breaches Scheme in Practice
A suspected breach creates a clock, not a discussion forum. Under the Notifiable Data Breaches scheme, an entity that suspects a breach may be an eligible data breach must conduct a reasonable and expeditious assessment, generally completing it within 30 calendar days after becoming aware of the grounds or information that caused the suspicion. The OAIC NDB assessment guidance explains this requirement.
Consider a Shopify store connected to an Odoo ERP backend. A compromised administrator account may expose order information in Shopify, while customer service notes, delivery details and commercial history remain in Odoo. The assessment team needs logs from both platforms, identity and access records, supplier information, affected-data categories and a clear record of what was known at each point.
The first response sequence
- Contain the exposure. Disable suspected accounts, revoke sessions, isolate affected integrations and preserve relevant logs. Don’t destroy evidence while trying to clean up.
- Assess the incident. Identify the information involved, the people affected, the likely consequences and the controls that failed. Record uncertainty rather than filling gaps with assumptions.
- Decide and notify. If the breach is likely to result in serious harm, follow the NDB notification process for affected individuals and the OAIC. Keep the approval and reasoning in the incident record.
- Review the control failure. Correct permissions, retention, supplier access or software configuration. A notification doesn’t close the operational work.
APP 11 requires reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification or disclosure. It also requires destruction or de-identification when information is no longer needed. The Wistec disaster recovery solutions resource can help frame recovery responsibilities, but your incident plan must still name your own systems, owners and escalation points.
The OAIC recorded 1,113 notifications in 2024 and 1,205 in 2025, with 2025 the highest annual total since mandatory reporting began in 2018. January to June 2025 alone recorded 532 notifications, according to the OAIC 2025 NDB statistics. Those figures make notification activity a useful operational warning signal. If your business can’t produce reliable access, retention and incident evidence, it isn’t ready for the assessment clock.
Mapping Compliance to Your Tech Stack
Compliance should become a backlog that a developer, system administrator and operations manager can execute. Start with the data journey, then assign a control to each stage: collection, use, disclosure, access, correction, retention and deletion.
Odoo ERP
An Odoo ERP often becomes the operational centre for customers, invoices, deliveries, support notes and supplier interactions. Configure role-based access so warehouse staff don’t automatically see information needed only by finance or clinical administration. Review administrator privileges, require individual accounts, retain audit logs and document who approves access changes.
Use customer consent fields only when they serve a defined purpose. A checkbox without a purpose, timestamp, source and withdrawal process creates a record, but not a dependable consent workflow. Add retention rules for inactive records and build a controlled process for access, correction and deletion requests.
Shopify and WooCommerce
For Shopify, connect the privacy policy and collection notices to the customer journey, not just the footer. Review apps that receive order, contact or behavioural data, then record the supplier, purpose and any overseas disclosure. Build a process for customer data export and deletion that includes the store, marketing tools, fulfilment integrations and support systems.
WooCommerce gives you more infrastructure control, but that flexibility creates more responsibility. Audit plugins, hosting, payment providers, analytics tools, backups and administrator accounts. A privacy request can fail when the WordPress database is updated but a plugin, spreadsheet or mailing list keeps the same record.
Custom websites and mobile apps
A software development Sydney Adelaide team should receive a privacy backlog before coding begins. For a custom site, require data-field inventories, collection notices, access logging, secure administrative roles and documented deletion behaviour. For mobile apps, review on-device consent, analytics SDKs, crash reporting, push-notification identifiers and cross-border data flows under APP 8.
Forms deserve special attention. If a third-party form processor receives names, emails or health-related details, document that disclosure and check its retention and security commitments. A useful example of the type of supplier privacy information to review is the Formcarry privacy policy.
A platform checklist for your next sprint
- Odoo implementation: Map models and fields to business purposes, then remove unnecessary access.
- Shopify implementation: Catalogue apps, export pathways, deletion requests and overseas processors.
- WooCommerce: Review plugins, admin roles, hosting, backups and payment integrations.
- Custom software: Add privacy acceptance criteria to every feature handling personal information.
- Mobile apps: Record SDK data collection, consent state and deletion behaviour.
- Cloud and email: Assign ownership for mailboxes, shared drives, exports and retention. The Wistec email and cloud services resource provides a useful starting point for reviewing those environments.
The point is evidence. A business should be able to demonstrate which technical and organisational measures protect each category of personal information, not merely assert that controls exist.
Industry-Specific Risks Australian Businesses Keep Missing
A generic checklist misses the places where teams collect risky information. The right control depends on the people, transactions and third parties your industry uses every day.
Retail and eCommerce
Retailers often focus on payment security and overlook abandoned carts, loyalty profiles, delivery instructions and marketing consent. Shopify may hold the order, Odoo may hold the customer account and an email platform may hold the campaign history. APP 5 and APP 7 require clear collection and marketing handling, so connect consent status to the customer record and suppress marketing after withdrawal.
Healthcare and clinics
Clinics handle health information that deserves careful access design. A receptionist may need appointment details but not a full clinical history, while an external specialist may receive information through an overseas service. Use Odoo roles, segregated records, verified recipient details and an approval trail for disclosures. Don’t let convenience turn shared inboxes into an uncontrolled patient database.
Logistics and supply chain
A logistics company holds sender, recipient, driver, delivery and consignment data across depots, contractors and customer portals. APP 8 becomes practical when a transport partner or cloud platform operates outside Australia. Maintain a supplier register, limit driver visibility to assigned work and remove old delivery exports from shared folders.
Hospitality and tourism
Hotels and tour operators may collect identity details, payment information, booking preferences and, in some settings, biometric records. The control question is purpose. Collect what the booking and service require, restrict front-desk access, and document how identity information moves to booking, payment and guest-service systems.
Education and training
Schools and training providers must design carefully for children, guardians, attendance records and support information. Use verified guardian workflows, age-appropriate notices, restricted teacher access and clear deletion ownership. A WooCommerce enrolment form or mobile learning app should never send more information to analytics tools than the service needs.
Professional services
Accountants and lawyers hold sensitive client material, but professional confidentiality doesn’t replace APP obligations. Separate matter access, restrict document links, track corrections and review external storage and email forwarding. A small firm should still know which Odoo, Microsoft 365, form and document systems contain client information.
Your 90-Day Compliance Plan and Free Policy Template
A workable programme needs an owner, a sequence and evidence. Run three 30-day sprints rather than attempting a broad transformation with no finish line.
Days 1 to 30, discover and document
Create a data inventory covering Shopify or WooCommerce, Odoo ERP, mobile apps, forms, email, cloud storage, analytics, payment providers and suppliers. Record the purpose, access group, retention expectation, overseas disclosure and deletion method for each data set.
Review your privacy policy against APP 1. It should explain what you collect, why you collect it, how you use and disclose it, how people can access or correct information, how they can complain, and whether overseas recipients are involved. Your breach plan should name the incident lead, technical responder, business approver, communication owner, evidence location and escalation path.
Days 31 to 60, configure and train
Implement role-based access, administrator reviews, consent fields, retention rules and request workflows. Update collection notices on checkout forms, enquiry forms and mobile screens. Train staff on misdirected emails, unsolicited information, access requests and suspected breaches.
A store data collection statement should use plain language, identify the information requested, explain the purpose, identify relevant service providers and provide a practical privacy contact. Don’t hide critical information behind an overly broad policy link.
Days 61 to 90, test and evidence
Run an access request, correction request, deletion review and simulated breach. Confirm that logs are available, managers understand their responsibilities and the business can identify affected records without searching every system manually. Record failures and assign remediation dates.
You can request a free policy template outline covering APP 1 transparency, collection notices, access and correction, complaints, overseas disclosures, retention, security and breach contacts. Treat it as a starting document, then tailor it to your data flows. Wistec provides Odoo implementation, Shopify implementation, WooCommerce builds, custom software development Sydney Adelaide and mobile app development, so privacy controls can be included in the delivery backlog rather than added after launch.
Frequently Asked Questions and Next Steps
Does the Australian Privacy Act apply to small businesses?
The federal privacy scheme commonly applies to entities with annual turnover above A$3 million, but that isn’t a complete exemption test. Sector-specific coverage and personal-information activities can bring smaller businesses into the framework, as explained by the Australian Government privacy guidance.
What’s the difference between an eligible data breach and a serious data breach?
An eligible data breach is an incident involving personal information where unauthorised access, disclosure or loss is likely to result in serious harm. The assessment focuses on the information involved, the people affected, the likely consequences and whether remedial action changes the risk.
How long do you have to assess a suspected breach?
An entity must conduct a reasonable and expeditious assessment and generally complete it within 30 calendar days after becoming aware of the grounds or information that caused the suspicion. If the incident is likely to result in serious harm, the NDB notification process requires action for affected individuals and the OAIC.
What happens if you ignore a compliance notice?
Ignoring a compliance notice can expose a body corporate to an A$330,000 pecuniary penalty, according to the stated enforcement framework. Assign one accountable owner, track every required action and preserve evidence showing how the business responded.
The three priorities are straightforward: know your APPs, know your penalty exposure and know your assessment clock. Then connect those obligations to the controls inside Odoo, Shopify, WooCommerce, your cloud services and mobile apps.
Wistec can help you map personal information, configure Odoo ERP controls, deliver Shopify and WooCommerce implementation, and build custom websites or mobile apps with privacy requirements included. Visit Wistec to discuss a practical compliance and technology plan for your Sydney or Adelaide business.