OAIC, De-identification and the Privacy Act: de-identified information is outside the Act, risk must be very low (Office of the Australian Information Commissioner, De-identification and the Privacy Act)
Properly de-identified records are not personal information and can be licensed without the APP 6 and APP 8 steps. The standard is a very low, context-dependent risk of re-identification, not zero risk.
Dated 18 Oct 2026Source checked 18 Oct 2026Basis: primary text
In the source's own words
“Information that has undergone an appropriate and robust de-identification process is not personal information, and is therefore not subject to the Privacy Act 1988 (Cth). ... The Privacy Act does not require de-identification to remove the risk of re-identification entirely. Rather, those sharing or releasing data must mitigate the risk until it is very low.”
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in these 2 guides