APP 5: Notification of the Collection of Personal Information

Last updated 22 July 2026 · Reviewed by The PrivacyReady compliance team

The short answer

Australian Privacy Principle 5 requires that, at or before the time you collect personal information (or as soon as practicable afterwards), you take reasonable steps to notify the individual — or otherwise ensure they are aware — of specific matters: who you are, why you're collecting the information, who you might disclose it to, whether providing it is optional, and how they can access, correct, or complain about it. This is usually delivered as a short collection notice at the point of collection, distinct from your full privacy policy.

Governing provision	Privacy Act 1988 (Cth), Schedule 1, APP 5
Timing	At or before collection, or as soon as practicable after
Format	Reasonable steps to notify — no single mandated format
Minimum matters	Identity, purpose, disclosure recipients, consequences of not providing it, access/correction/complaint rights
Distinct from	Your privacy policy (APP 1) — a notice is point-specific, the policy is general

What APP 5 actually requires

APP 5.2 lists the matters a collection notice should cover, so far as reasonable in the circumstances: your identity and contact details; the fact and circumstances of collection if not obvious; whether collection is required or authorised by law; the purposes of collection; the consequences if the individual doesn't provide the information; who you usually disclose that kind of information to (including whether that's overseas, and if so, which countries); and how the individual can access, correct, or complain about the handling of their information, including a reference to your privacy policy.

A collection notice does not need to repeat your entire privacy policy. A short, point-of-collection statement — "We collect your name and email to respond to your enquiry. See our privacy policy for more information" — combined with a link to the full policy is usually sufficient for straightforward, low-risk collections.

Who this applies to

Every point at which your business collects personal information — web forms, booking pages, sign-up flows, paper intake forms, and verbal collection over the phone.

Common SME failure modes

No notice at the point of collection — only a general privacy policy linked somewhere in the footer, with no prompt at the form itself.
Generic notices that don't name the actual purpose — "for business purposes" does not meet the specificity APP 5 expects.
Silence on overseas disclosure — most SaaS-reliant businesses transfer data offshore but don't mention this at the collection point.
Verbal collection with no equivalent notice — phone-based intake often skips notification entirely.

Practical compliance steps

Add a short, specific notice next to every form that collects personal information.
Link the notice to your full privacy policy rather than duplicating it.
For phone or in-person collection, script a brief spoken notice covering purpose and where to find your policy.
Review notices whenever you add a new collection point or change what you collect.

Frequently asked questions

Is a link to my privacy policy enough, or do I need a separate notice on each form?

A link alone is usually not sufficient for anything beyond the most routine collection. APP 5 expects reasonable steps at the point of collection — a short, specific statement plus a link is the common practical approach.

Do I need to notify for every single field on a form, or can one notice cover the whole form?

One notice covering the form as a whole is standard practice, provided it accurately reflects the purpose of collecting each field on that form.

What if the purpose of collection is obvious — do I still need to notify?

APP 5.2 allows some matters to be omitted where they are "obvious from the circumstances," but this is a narrow exception. It is generally safer to include a brief notice even where the purpose seems self-evident.

Use the free Collection Notice Check to see which of your collection touchpoints are missing an APP 5 notice.

Check my collection notices →