What is a collection notice?
An IPP entity that collects personal information must take reasonable steps to ensure individuals are given, or made aware of, certain key information. This obligation is set out in Information Privacy Principle (IPP) 1. IPP entities can make individuals aware of this information through a collection notice.
The purpose of a collection notice is to provide individuals with the information necessary for them to exercise a greater degree of control over the management of their personal information.
What should a collection notice contain?
A collection notice should not be drafted as a lengthy legal document. You should consider the best way to effectively communicate the information, taking into account the nature of the audience and most appropriate format. IPP 1 requires information provided to be up-to-date, clear, concise and expressed in plain language.
IPP 1.9 sets out the information to be included in a collection notice:
- the identity of the IPP entity and how to contact it;
- how the individual may access the information (if applicable);
- the purposes for which the information is collected and will be used or disclosed;
- whether the IPP entity usually discloses information of that kind and, if so, the persons or bodies or kinds of persons or bodies to which the information is usually disclosed;
- any law that requires the particular information be collected;
- the main consequences (if any) for the individual if all or part of the information is not provided.
Collection notices are different to privacy policies
A collection notice is not the same as a privacy policy. A collection notice is required each time personal information is collected to explain the factors set out in IPP 1.9 for that particular collection. In contrast, a privacy policy covers the full range of personal information handling practices across the entire regulated entity.
How and when to give a collection notice
A collection notice should be given before or at the time the personal information is collected. If this is not practicable, the collection notice should be given as soon as practicable after collection.
How an IPP entity chooses to communicate the matters set out in IPP 1.9 will depend on the circumstances of collection and the intended audience. Collection notices can be provided in a number of ways – for example, in hard copy, at the beginning of an online form, in a website banner, verbally using a telephone script or recorded message.
It is not always necessary to include a collection notice separately to a communication requesting information. Sometimes, the text of the communication itself will contain the information IPP 1.9 requires, in which case a separate collection notice is not required.
Collection notices must be specific to each collection of personal information. If personal information is collected for multiple purposes, all relevant purposes should be listed. A generic notice covering a range of potential purposes is not sufficient. For example, it is insufficient to provide a link to an entity’s privacy policy without also providing the information set out in IPP 1.9.
In some situations, it may be appropriate to provide a concise summary of key points that is supplemented by a longer notice made available online or in hard copy. For example, this approach may be used where the primary mode of notification is through signage or a voice recording.
When does the requirement to give a collection notice commence?
From 1 July 2026, IPP entities are required to provide individuals with notice of the information set out in IPP 1.9. This obligation applies to collection of personal information on or after 1 July 2026. It does not apply retrospectively to collections that took place before this date.
For more information, the OIC has published transitional guidance for IPP entities to explain how the IPPs and other provisions contained in the PRIS Act apply to personal information collected before and after 1 July 2026.
For more information about the IPPs, see our Information Privacy Principles Summary.
Print this page
