Australian Privacy Law: APPs, Contracts, and Cross-Border Compliance
October 14, 2026
In this episode of Privacy in Practice, Kellie du Preez and Danie Strachan speak with Tanvi Mehta Krensel, Partner at Squire Patton Boggs and former lead product privacy lawyer for APAC and emerging markets at TikTok. They discuss how Australian privacy law differs from the GDPR, including the absence of a controller/processor distinction under the Privacy Act, how to approach Australian contracts, and the separate requirements for privacy policies and APP5 collection notices. They also consider what global organizations should know when operating in Australia.
In this episode of Privacy in Practice, Kellie du Preez and Danie Strachan speak with Tanvi Mehta Krensel, Partner at Squire Patton Boggs and former lead product privacy lawyer for APAC and emerging markets at TikTok, about applying Australian privacy law within global privacy programs and contracts.
Tanvi explains that the Privacy Act does not distinguish between controller and processor, so every APP entity is subject to the same Privacy Act provisions regardless of how they handle personal information. She discusses recent OAIC guidance that treats contracts as important evidence of control and explains how, without mandatory contract terms like those in GDPR Article 28, bargaining power may influence how control and responsibilities are allocated.
The conversation also covers why a website privacy policy alone does not satisfy APP 5, what OAIC decisions indicate about reasonable security steps, and how OAIC guidance addresses cross-border disclosures. Tanvi also explains why cookie consent mechanisms may not adequately address pixels or the collection of sensitive information and discusses several Australian requirements with no direct GDPR equivalent.
What This Episode Covers:
- How Australia’s federal, state, territory, and health privacy laws interact
- How Australia treats marketing consent, cookies, pixels, and sensitive information
- How contracts allocate responsibilities without a controller/processor distinction
- When a GDPR-style data protection addendum may or may not suit an Australian agreement
- What reasonable steps mean for security under APP 11
- How cross-border disclosures work without a statutory SCC framework
- Why a global privacy policy alone does not satisfy APP 5
- How Australian Consumer Law affects privacy-related contracts and representations
- Australian-specific rules concerning automated decision-making, government identifiers, unsolicited information, and anonymity
Tanvi Mehta Krensel is a Partner in the Sydney office of Squire Patton Boggs, where she practices in the firm's data privacy, cybersecurity, and digital assets practice. Before returning to private practice, she spent nearly two years as the lead product privacy lawyer for APAC and emerging markets at TikTok, advising on product privacy, children's online safety, AI and emerging technologies.
Connect with Tanvi Mehta Krensel here: LinkedIn
Connect with Kellie du Preez here: LinkedIn
Connect with Danie Strachan here: LinkedIn
If you enjoyed this episode, make sure to subscribe, rate, and review it.
Episode Highlights:
- [00:00] Australia Isn’t GDPR
Australian privacy law is principles-based by design, and global teams that default to a GDPR lens may overlook important differences. Those differences include Australia’s automated decision-making requirement, which, from December 10, 2026, will extend to computer programs substantially and directly linked to a decision, and APP 9’s heightened treatment of government identifiers.
- [17:29] Redlining Contracts Without Controller/Processor Roles
Under the Privacy Act, APP entities are subject to the same Privacy Act provisions regardless of how they handle personal information. Recent OAIC guidance identifies contracts as an important way to determine which party holds control. Without mandatory contractual content like that required by Article 28 of the GDPR, bargaining power may influence how control and responsibilities are allocated. Processors may also have flexibility to negotiate matters such as audit rights and how notification and breach responsibilities are handled.
- [26:36] Should You Scrap a GDPR DPA for Australia?
A standalone GDPR DPA imported wholesale into an Australian deal may not be the right vehicle. Liability caps or data-loss exclusions in the main agreement may limit the practical effect of separate privacy protections. Consider addressing privacy as part of the broader commercial negotiation.
- [30:27] APP 11 and Reasonable Security
APP 11 (security), APP 8 (transfers), and APP 5 (notification) all turn on reasonableness rather than prescribed measures. Published decisions can provide practical indications of the Privacy Commissioner’s approach, including her recent statement on the Qantas breach and, just as valuably, her decisions not to pursue enforcement. Treat them as de facto compliance roadmaps.
- [45:18] Privacy Policies vs. APP 5 Collection Notices
Australia imposes a double notification requirement: a publicly available privacy policy and a separate APP 5 collection notice given at the point data is collected. Recent OAIC decisions on pixels confirm a website privacy policy alone won’t suffice. Practical solutions include pop-ups, upgraded cookie banners, QR codes in physical spaces, and verbal notices where appropriate.