Am I Collecting More Than I Need?
Select the data fields your business collects. Get an instant APP 3 check across 19 common Australian collection points.
Under APP 3 of the Privacy Act 1988 (Cth), a business must not collect personal information unless it is reasonably necessary for, or directly related to, one or more of its functions or activities. Sensitive information — health, biometric, racial, political, religious, criminal record — is held to a stricter necessity test and needs consent. Select the fields below to see which ones are a collection risk.
Last updated: 2 July 2026
How each field is scored
| Result | Meaning |
|---|---|
| Compliant | Collection is reasonably necessary for the stated context by default, or you've confirmed a specific documented reason for collecting it |
| Over-collection risk | Collection isn't obviously necessary for the stated context, and no specific documented reason has been confirmed |
Why most forms collect more than they need
"Reasonably necessary" under APP 3 is an objective test — it's not enough that a business believes a field might be useful someday. A date of birth field on a newsletter signup, a mandatory phone number on a contact form, or an income question on a loyalty program are common examples of fields collected because a template included them, not because a specific function or activity required them.
Sensitive information — defined in s 6 of the Privacy Act 1988 (Cth) to include health, genetic and biometric data, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, and criminal record — is held to a stricter necessity test under APP 3.3 and generally also needs the individual's consent. The genuine exceptions are real: a delivery address is necessary to ship a physical order, and a date of birth is legally required to sell an age-restricted product. The point of this check is to separate those from fields collected just in case.
Collection necessity check
Select every data field your business collects. For each one that isn't obviously necessary by default, tell us whether you have a specific documented reason for collecting it. You'll get an instant APP 3 report at a permanent URL you can revisit or share.
When you need a collection necessity check
- — You've never reviewed your intake forms and data fields against APP 3
- — You're newly covered by the Privacy Act following the 1 July 2026 threshold removal
- — You're drafting or updating your privacy policy and need to document your collection justifications
- — You collect any sensitive information — health, biometric, racial, political, religious or criminal record data
- — You're preparing for an OAIC inquiry or a compliance audit
Frequently asked questions
What does APP 3 of the Privacy Act require?
APP 3 requires that a business not collect personal information unless it is reasonably necessary for, or directly related to, one or more of its functions or activities. Sensitive information is held to a stricter necessity test and needs consent.
What counts as sensitive information under the Privacy Act?
Section 6 of the Privacy Act 1988 (Cth) defines sensitive information to include health, genetic and biometric information, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, and criminal record.
What happens if a business collects information it doesn't need?
Over-collection breaches APP 3. A serious or repeated breach of the Privacy Act 1988 (Cth) can attract a penalty of up to $50 million, 3x the benefit obtained, or 30% of adjusted turnover; non-serious contraventions carry a penalty of up to $66,000.
What does the free collection necessity check check?
It checks the fields you select against a catalogue of 19 common Australian collection points, flagging which are typically reasonably necessary and which are an over-collection risk unless justified.
Select your data fields above to get an instant APP 3 collection necessity report.
Get my collection report →