Key takeaway
In the first week of January 2026 the OAIC began its first-ever compliance sweep: a targeted review of the privacy policies of approximately 60 entities across six sectors that routinely collect personal information in person: rental and property, chemists and pharmacists, licensed venues, car rental companies, car dealerships, and pawnbrokers and second-hand dealers. The compliance sweep is assessing entities’ privacy policies against APP 1.4. The OAIC has warned that entities with non-compliant privacy policies may face compliance and infringement notices, with penalties of up to $66,000. Although the sweep is targeting approximately 60 entities across six sectors, those sectors have been selected because of identified privacy risks rather than because APP 1.4 is limited to them. APP 1.4 applies more broadly to APP entities, making it prudent for organisations outside the target sectors to review their privacy policies for compliance.
Most organisations treat their privacy policy as a document to publish once and revisit rarely. The OAIC’s first targeted compliance sweep is a reminder that the regulator now treats it as an active compliance artefact, and is prepared to check it.
What a Sweep Actually Looks For
What the OAIC has said it is assessing is compliance with APP 1.4, which prescribes the contents a privacy policy must contain: the kinds of personal information collected and held, how it is collected and held, the purposes of collection, holding, use and disclosure, how an individual can access and seek correction of their information, how they can complain and how the complaint will be handled, and whether the information is likely to be disclosed overseas (and if so, to which countries). The OAIC updated its APP 1 guidance shortly before the sweep and has pointed to it in announcing the review, so it is the natural benchmark to read a policy against.
Generic, templated policies are the most common failure point: language copied from a precedent that does not, or no longer, reflect what the business actually does, or that omits practices introduced since the policy was last updated (a new CRM, a new marketing tool, a new AI-assisted decision process).
Why This Matters Beyond the Named Sectors
A targeted sweep is also a signal of regulatory appetite, not a scope limitation. The selection method is the part worth reading closely: the OAIC has said it identified targets by reference to size and location, and to high-profile and high-risk entities within each sector, including entities that have previously suffered a data breach. Those are attributes, not industries. A business in an unnamed sector that is large, prominent, or already on the record with a breach fits the same profile.
The named sectors are not where we expect most clients to feel this. The exposure we see sits in in-person collection nobody has mapped: visitor and contractor sign-in at a mine site, licence and 100-point ID checks at a facility gate, or a managed service provider collecting identity documents when it onboards a client’s staff for device provisioning. In each case, the collection is real, routine, and absent from the privacy policy. The OAIC’s 2026 community attitudes survey found 82% of Australians now rank data breaches as their top privacy concern, up from 74% in 2023, a reasonable proxy for how a customer reacts on discovering their licence was photographed at a gatehouse and never mentioned anywhere.
The sweep also reflects a shift in method rather than a one-off exercise. The OAIC has described this as moving from a largely complaint-driven posture to proactively reviewing published policies across chosen sectors, backed by the enforcement consequences the 2024 amendments expanded, including for the failure to have a privacy policy containing the information APP 1.4 requires. Businesses in adjacent sectors (and any business handling sensitive categories of information) should expect similar reviews to broaden, and a policy that would not survive scrutiny today is a live, not theoretical, risk.
There is also a second reason to open the policy now rather than later. From 10 December 2026, an entity must include information in its privacy policy where it uses computer programs to make, or to do something substantially and directly related to making, a decision that could reasonably be expected to significantly affect an individual’s rights or interests. Any organisation that will need to make that amendment before December is going to be in the document anyway; doing the APP 1.4 review in the same sitting is materially cheaper than doing it twice. We cover the December 2026 ADM transparency obligation in detail in a separate article.
A Practical Self-Check
- Does your privacy policy reflect every system currently collecting personal information, including newer tools like CRM platforms or AI-assisted services?
- Are your collection notices specific: do they say what is collected and why, as APP 5.1 requires at or before the time of collection, rather than relying on broad, generic language?
- Is your complaints-handling process actually described, and does it match what happens in practice?
- Are you collecting only what you actually need, and do you know when information gets destroyed or de-identified once it is no longer needed (APP 11.2)? Retention is not itself an APP 1.4 content requirement, but it is where over-collection at the counter shows up.
- When was the policy last reviewed against current practice, and is that review documented?
Disclaimer
This article is general information only and is not legal advice. It refers to a compliance activity announced by the OAIC. While the OAIC has confirmed that the sweep assesses compliance with APP 1.4 and has published guidance on APP 1, it has not published the internal methodology or scoring it applies to individual policies, and the outcomes of the sweep were not public at the time of writing. Obtain advice specific to your organisation’s circumstances before acting.
Source: Office of the Australian Information Commissioner, Privacy compliance sweep to put privacy policies under the spotlight, https://www.oaic.gov.au/news/media-centre/privacy-compliance-sweep-to-put-privacy-policies-under-the-spotlight.