APP 6: Use or Disclosure of Personal Information

Last updated 22 July 2026 · Reviewed by The PrivacyReady compliance team

The short answer

Australian Privacy Principle 6 restricts you to using or disclosing personal information only for the primary purpose you collected it for, unless the individual consents to a different (secondary) use, they would reasonably expect the secondary use and it is related to the primary purpose, or another specific exception in APP 6.2 applies — such as a serious threat to health or safety, or a requirement of law. Using a customer's email — collected to confirm an order — to add them to a marketing list without separate consent is a common breach of this principle.

Governing provision	Privacy Act 1988 (Cth), Schedule 1, APP 6
Default rule	Use/disclose only for the primary purpose of collection
Secondary use allowed if	Consent given, or reasonably expected + related purpose, or a listed exception applies
Common breach	Repurposing transactional data for marketing without consent
Related principle	APP 7 specifically governs direct marketing use

What "primary purpose" means

The primary purpose is the specific reason you collected a particular piece of information, as identified at collection (and ideally documented in your APP 5 notice). If a customer provides their email to receive an order confirmation, that is the primary purpose. Using the same email address for an unrelated newsletter is a secondary use, and APP 6 requires a valid basis for it — typically consent, or it being a reasonably expected and related use.

APP 6.2 sets out other exceptions: where required or authorised by law, where necessary to lessen or prevent a serious threat to life, health, or safety, where reasonably necessary for enforcement-related activities by an enforcement body, or in a few other specific circumstances.

Who this applies to

Any business holding personal information that might be tempted to reuse it for a purpose beyond the one it was collected for — most commonly, using transactional or support data for marketing, analytics, or sale/transfer to a related business.

Common SME failure modes

Adding transactional contacts to marketing lists without a separate opt-in.
Sharing customer lists with a related or acquiring business without considering whether that disclosure fits the original purpose.
Using support ticket data for product analytics in ways not disclosed at collection.
Assuming "reasonably expected" covers more than it does — the bar is what an ordinary individual would expect, not what is convenient for the business.

Practical compliance steps

Document the primary purpose for each category of information you collect, ideally in the collection notice itself.
Before any new use of existing data, check whether it fits the primary purpose, a reasonably expected related use, consent, or a specific APP 6.2 exception.
If none apply, seek fresh, specific consent before proceeding.
Review any data-sharing arrangement with a related company or on business sale for the same test.

Frequently asked questions

Can I use a customer's purchase history to recommend related products?

This often falls within a reasonably expected, related secondary purpose — most customers expect a retailer to use purchase history for basic recommendations. It becomes riskier the further the use strays from the original transactional context, so document your reasoning and check current OAIC guidance if the use case is not clear-cut.

Does selling my business let me transfer the customer database to the buyer?

Only if the transfer is consistent with APP 6 — generally requiring either that individuals were told at collection that their information might be disclosed on a business sale, or that you obtain fresh consent. This is a frequently overlooked step in small business sales.

If a customer consents to marketing once, can I use their data for any future marketing?

Consent should be specific to what was actually agreed to. Broad, indefinite consent is harder to rely on over time, and separately, APP 7 requires every marketing communication to include a working opt-out regardless of the original consent.

Use the free Privacy Act Business Applicability Check to understand which use-and-disclosure obligations apply to your business.

Check my obligations →