Running a dental practice means holding some of the most sensitive information Australians ever hand over, and the rules around it can feel like a moving target. Most owners can talk confidently about their obligations. The detail is what tends to nag: whether the privacy policy on your website is still current, whether you could show who opened a record and when, and what has to happen if a laptop goes missing.
The reassuring part is that the Privacy Act mostly asks for things your practice already has. Almost every obligation is discharged by producing a record: a current privacy policy, a collection notice at intake, an access log and, an answer for the patient who asks for their file. The work is knowing which records the Act asks for and being able to put your hand on them today. Dentally is built to keep those records as your team goes about its day, so they are there when you need them.
This guide sets out what you have to be able to show, works through the thirteen Australian Privacy Principles in practice terms, and finishes with a self-check you can run yourself.
Jump to what you have to show, the thirteen Australian Privacy Principles, or the self-check.
If you have ever been told that small businesses sit outside the Privacy Act, that holds for most of them and not for you. A business turning over $3 million or less normally falls outside the Act. Section 6D(4)(b) switches that exemption off for anyone providing a health service and holding health information, and a dental practice does both. Your obligations are the same whatever the practice turns over.
The Office of the Australian Information Commissioner (OAIC) names a dentist in its list of covered providers, and OAIC's guide to health privacy sets out what follows. There is nothing to register and no notification to receive, which is why practices miss it. Health information is also sensitive information under section 6(1), raising the bar in three places: consent to collect, a directly related purpose for any secondary use and consent before any marketing.
Wherever the Act bites, it asks you for something you can produce: the policy, the notice, the access log, the retention schedule or, the assessment record. Australian law treats your systems as part of the legal test, which is why this section comes before the principles themselves.
Three moments are where that gets tested. An access request needs everything you hold across every system, the dates in and out and your identity checks. A suspected breach needs the records that were touched, when you became aware, which records were touched and the assessment itself. A complaint needs the practices, procedures and systems you relied on.
The serious harm test in section 26WG of the Privacy Act itself asks whether information was protected by security measures, and how likely those were to be overcome. Section 13G(1B)(g) makes a failure to implement practices, procedures, and systems a factor in judging whether an interference was serious. Of the eight matters a court may weigh, it is the only one describing the practice rather than the incident.
The clearest examples sit outside the Privacy Act. The Healthcare Identifiers Act makes a provider record every access to the Healthcare Identifiers Service, keep it for seven years beyond the staff member's authorisation, and produce a copy within fourteen days of a written request, as OAIC's guidance on Individual Healthcare Identifiers sets out. Retention works the same way: a schedule, and in NSW, Victoria, and the ACT, a record of what was destroyed and when. Each of those states adds requirements the Commonwealth Act does not, so check the position wherever you work.
Run your privacy self-check now.
The thirteen Australian Privacy Principles govern how your practice handles patient information, from collection to destruction. OAIC's quick reference lists all thirteen. Each is below in practice terms, with the artefact that answers it.
A downloadable APP checklist will not make you compliant. OAIC's guidance on the analogous My Health Record security policy states that using a template does not guarantee compliance. Its APP 1 guidelines separately require a privacy policy tailored to your own information handling practices.
A privacy policy is a clearly expressed, up-to-date document explaining how an organisation manages personal information. It covers what is collected, why, how it is held, who it goes to and how to access, correct, or complain. OAIC requires every organisation the Privacy Act covers to have one.
Most practices have a privacy policy on the website and have not looked at it in a year or two. APP 1.3 requires a clearly expressed, up-to-date policy on how your practice manages personal information, and APP 1.4 sets a seven-item minimum. OAIC's guidelines on APP 1 treat it as a floor.
The seven items:
The policy also has to be true. OAIC expects it to reflect what the practice actually does, and to note when it was last reviewed. Section 13K makes a missing policy, or one missing the required contents, a civil penalty provision carrying up to 200 penalty units, with each shortfall a separate contravention.
One change is already dated. From 10 December 2026, APP 1.7 to 1.9 will require a privacy policy to state what personal information any computer program uses to make decisions about patients, and to name the kinds of decisions. The trigger is a decision that could significantly affect a patient.
Legislated but not in force as of August 2026, so if you run automated recall prioritisation or AI-assisted triage, expect to describe it.
Most practices are already doing more on security than they would give themselves credit for. APP 11.1 puts a name on it: a duty to take reasonable steps to protect the personal information you hold. The six harms are misuse, interference, loss, unauthorised access, modification and disclosure. OAIC's guidelines on APP 11 set out what reasonable means.
Read unauthorised access carefully. OAIC confirms it covers your own employee or contractor as well as an outsider, and calls it trusted insider risk. In a practice, that is a team member opening a neighbour's record.
APP 11.3, in force since 11 December 2024, spells out that reasonable steps run across both technical and organisational measures: software controls, encryption, and passwords on one side; policies, training, and procedures on the other. What counts as reasonable scales with your size, the sensitivity of what you hold, and the harm a breach would do. OAIC closes the cost door: you are not excused because a step is inconvenient or costly.
An audit trail sits on both sides of that line. A log tying every access to a named person answers who saw what, and OAIC tells entities to document the systems that protect it.
If you run more than one site, the same controls have to hold at each of them. The Act judges the practice that holds the information, so a permission model applied carefully at one location and loosely at another leaves the whole group exposed.
Information security is the practice of protecting the personal information you hold from misuse, interference and loss, and from unauthorised access, modification, or disclosure. Under APP 11 of the Privacy Act it means reasonable steps, technical and organisational, in proportion to how sensitive the information is.
Published cybersecurity best practices lists run to dozens of items and it is hard to know which ones matter. Five controls do most of the work in a practice, and all five come from OAIC's guidance. Every one is something a practice can turn on without an IT department.
Shared logins are the most common control failure in a practice, and the most expensive.
The first question most practices ask after something goes wrong is how long they have. There is no 72-hour deadline in Australia's data breach notification scheme. Suspect an eligible data breach and you have up to thirty calendar days to complete a reasonable and expeditious assessment. Once you have grounds to believe one happened, you notify OAIC and the patients affected as soon as practicable.
An eligible data breach under the Notifiable Data Breaches (NDB) scheme has three parts: unauthorised access to, disclosure of, or loss of personal information you hold; serious harm a reasonable person would think likely, meaning more probable than not; and remedial action that has not removed the likelihood. Unauthorised access covers a staff member browsing a record with no clinical reason.
The clock starts when you become aware of the grounds for suspicion. OAIC's guidance on assessing and notifying a breach treats thirty days as a ceiling to work well inside. Notification has no further fixed period.
The 72-hour figure comes from the European Union's General Data Protection Regulation (GDPR), which does not reach your practice. Australia has genuine 72-hour rules, but they bind critical infrastructure operators, banks, and insurers rather than dental practices.
Whichever deadline applies, the assessment turns on the same question: if you suspected a breach tomorrow, what would tell you which records were opened?
Here is the test, built on OAIC's privacy action plan for health practices. Each item names an artefact the Act can ask you to produce. Answer yes only where you could produce it today. Where the answer is no, the fix is usually a setting to change or a system to switch on.
See how Dentally supports every item on this list.
Most of that self-check answers itself when the system records things as it goes. In Dentally, the controls that answer APP 11 are how it works. Role-based permissions decide who can reach which patient information, an audit trail records who opened what and when, and two-factor authentication protects the account. The evidence a breach assessment needs is produced on the day, across every site on the account.
Dentally Pulse, the AI layer across the practice, is built to the same test: AI you can defend to the Privacy Commissioner. Where a practice records an appointment and keeps it, that recording is health information about an identifiable patient. The patient has to be told, and it sits inside the same retention, access, and security obligations as the written record.
Read how Dentally protects patient data for the detail. The legal duty stays with the practice whatever software you run. Good software makes the evidence easier to produce.
See how Dentally protects patient data.
What are the privacy policy requirements for a business in Australia?
Any organisation the Privacy Act covers must have one. APP 1.3 requires it to be clearly expressed and up to date, and APP 1.4 sets the minimum contents. APP 1.5 adds that it must be free, published in an appropriate form such as on your website, and supplied in whatever reasonable form a person requests.
Are there different types of privacy policy for a website?
Australian law recognises one: the APP privacy policy required by APP 1.3. What differs is what sits beside it. A collection notice given at intake is a separate document with a separate job. Website terms of use, cookie banners, and consent forms are not privacy policies and do not satisfy APP 1.
How long do you have to respond to a patient's request for their records?
Within a reasonable period, which the Office of the Australian Information Commissioner says should not exceed 30 calendar days for a private practice. The fixed 30-day period in the Privacy Act applies to government agencies. In New South Wales, the Health Records and Information Privacy Act 2002 sets an outer limit of 45 days.
How long do dental practices need to keep patient records in Australia?
Seven years from the last service for an adult patient, and until the age of 25 for anyone who was a minor when the record was made. The basis is state health records law in New South Wales, Victoria, and the ACT. Victoria applies whichever is later.
Can a patient ask you to delete their dental records?
No. A patient cannot require a dental practice to delete their clinical record. Health records law in New South Wales, Victoria, and the ACT requires you to keep it, and the Privacy Act's destruction duty falls away where another law requires retention. A patient can require a correction.
What are the new privacy laws in Australia in 2026?
The 2024 amendments commenced on 11 December 2024, bringing a new penalty structure. Since 10 June 2025, people can sue for a serious invasion of privacy, but only for intentional or reckless conduct. From 10 December 2026, privacy policies must describe software making significant decisions about people. A further tranche is flagged but not law as at August 2026.
Run the self-check, then close the gaps in the order that suits you. If you already use Dentally, you can set up two-factor authentication for your team, add or edit a team member's access, and add your practice's privacy policy to Portal.