Privacy Act 1988 (Cth), incorporating the Australian Privacy Principles

Australia does not use the established-presence/offering/monitoring model — forcing it into that shape would be imprecise, so it's flagged here. The Act applies only to an 'APP entity' with an 'Australian link' (s5B): Australian citizens/residents, entities formed in Australia, or — for foreign entities — one that 'carries on business in Australia' (real, repeated, profit-directed activity; a mere accessible website is not enough) AND collected/held the information in Australia. Modeled here as an established-presence trigger only. Small business operators (annual turnover ≤ AUD 3 million) are generally exempt under s6D, unless an exception applies (health-service providers holding health information, entities trading in personal information, or Commonwealth-contracted providers) — reform to remove this exemption has been proposed but not yet legislated.