36Privacy obligations for non‑APP entities

36 Privacy obligations for non‑APP entities

(1) This section applies to an accredited entity that is not an APP entity.

Note: The obligations of accredited entities that are APP entities in relation to the handling of personal information are set out in the Privacy Act 1988.

(2) The accredited entity must not do an act or engage in a practice with respect to personal information unless: (a) the Privacy Act 1988 applies in relation to the act or practice as if the entity were an organisation within the meaning of that Act; or (b) a law of a State or Territory that provides for all of the following applies in relation to the act or practice: (i) protection of personal information comparable to that provided by the Australian Privacy Principles; (ii) monitoring of compliance with the law; (iii) a means for an individual to seek recourse if the individual’s personal information is dealt with in a way contrary to the law; or (c) all of the following apply: (i) neither paragraph (a) nor (b) apply to the acts or practices of the entity; (ii) the entity has an APP‑equivalent agreement with the Commonwealth; (iii) the agreement includes a term that prohibits the entity from collecting, holding, using or disclosing personal information in any way that would, if the entity were an organisation within the meaning of the Privacy Act 1988, breach an Australian Privacy Principle.