Not-for-profit Law
Legal help for community organisations


Please change your location to view this page.

This page contains content that does not match your current location

Some community organisations, including those with revenue over $3mil, and those that have contractual arrangements with government (eg. funding agreements) may be required to comply with privacy laws.

It is best practice to assume that all privacy laws apply to your group. It is also important to note that there are Privacy Laws at both state and federal levels.

EU General Data Protection Regulation and Australian not-for-profits
We've received many questions from not-for-profit organisations about whether the European Union General Data Protection Regulation (EU GDPR), effective from 25 May 2018, applies to their Australian-based organisation. Click here to read general legal information on this topic.  

Privacy reforms

The Federal Government has recently made changes to the Privacy Act 1988 (Cth). These changes include new Australian Privacy Principles (APPs). The changes, including the new principles, commenced on 12 March 2014.

The Office of the Australian Information Commissioner has updated its website to reflect the new laws.

Norton Rose Fulbright has generously provided a Privacy Compliance Manual for use by Australian charities and not-for-profits when transitioning to the new privacy laws and APPs. To download the manual, go to the bottom of this page where you will be asked to complete a form to grant access to the Manual.

National Privacy Guide

The Not-for-profit Law Privacy Guide has been updated to reflect the new federal privacy laws. You can download the guide below which includes information about:

  • what is covered by privacy law, sources of privacy laws and exemptions
  • obligations under privacy law including consent, notification and storing personal information and compliance, and
  • privacy policies
  • fundraising and privacy
  • private ancillary funds, and
  • state and territory privacy principles.

Notifiable Data Breaches scheme

The Notifiable Data Breaches scheme fact sheet supplements the Privacy Guide. It explains your organisation's obligations if there is a data breach and how to comply with the Notifiable Data Breaches scheme. 

Additional information

There are legal issues that cross-over with privacy that are not addressed in the Privacy Guide, including:

  • Cyber Security - Regardless of the industry your organisation operates in, your organisation probably collects and stores a huge amount of information and uses many different kinds of technology in its daily operations. This factsheet covers off on cyber security -  the practice of protecting this information, your organisation’s electronic systems and digital information and reducing the likelihood of a breach. 

  • Confidentiality - In some circumstances you may have an obligation to keep certain information confidential. This can be because of:
    • an agreement containing confidentiality obligation
    • the commercial or secret nature of the information itself, or
    • the circumstances in which the information was obtained.
  • Surveillance - Federal and Victorian State laws regulate surveillance, recording, monitoring and interception of communications, including when these are done in the workplace. The laws cover video, audio, computer, telephone and tracking (eg. GPS) surveillance. For information go to the Office of the Australian Information Commissioner.
  • Direct marketing and research - The Spam Act 2003 (Cth) regulates how you send promotional emails and other commercial electronic messages, while the Do Not Call Register Act 2006 (Cth) and related industry standards regulate telemarketing and telephone research. For information go to the Australian Communications and Media Authority (ACMA) and/or the Do Not Call Register website.
  • Freedom of information (FOI) - If someone has asked to access their information or told you they have a right to it under FOI laws, you will need to consider if that legislation applies to your organisation (eg. if your organisation holds personal information as a result of a contract between it and the government). For information go to the Victorian Government's Freedom of Information online and/or the Australian Government's Office of the Australian Information Commissioner.


Privacy Compliance Manual

Norton Rose Fulbright has provided Not-for-profit Law, a service of Justice Connect, with its Privacy Compliance Manual for use by charities and not-for-profits. The Manual contains an overview of new federal privacy laws and a template privacy policy. To access the Manual, please fill in the form below.


Not-for-profit Law, a service of Justice Connect, will not disclose the contents of this form, but may use de-identified information when reporting on the types of organisations accessing this manual.

Our Privacy Policy is available at The policy contains important information about how you can access and request correction of information we hold about you, how you may complain about a breach of the Australian Privacy Principles and how we will deal with any privacy complaint.

Subscribe to the Update

Subscribe to the Update

Subscribe to the monthly Not-for-profit Law Update for information on changes to the law, new resources, events and other sector news.


Ready for changes to privacy laws? Have an hour to update your knowledge?

Ready for changes to privacy laws? Have an hour to update your knowledge?

In February 2018, new laws about how to deal with serious privacy breaches will come into play. To learn about what these laws mean for your organisation, join our webinar on Privacy Law for community groups!

More information and bookings