Skip to main content
Skip to secondary navigation
Australian Government - Office of the Australian Information Commissioner - Home

Can I use customer information for marketing purposes?

If I obtains information about my customers in the course of providing them with goods and services, can I use that information for marketing purposes?

Generally, organisations covered by the Australian Privacy Principles (APPs) must not use the personal information they hold for the purpose of direct marketing. See APP 7.1. However, there are some exceptions to APP 7.1 — see APP 7.2 and 7.3.


A restaurant uses customer information it collects for home deliveries for marketing purposes. The restaurant may use the personal information for marketing if it has collected the information directly from its customers, and the customers would reasonably expect the restaurant to use it for marketing (ie the restaurant has notified of that use). See APP 7.2. Where customers would not reasonably expect their information to be used for marketing purposes, the restaurant may also use the information if its customers have consented. See APP 7.3(b). The restaurant must provide its customers with a way to easily opt out of receiving marketing messages, and must stop sending marketing offers if a customer asks it to. See APP 7.2(c) and (d), and APP 7.3(c) and (d).

For more information about the coverage of the APPs, see the Who is covered by privacy page.

For more information about all the APPs, see the Australian Privacy Principles page, Privacy fact sheet 17: Australian Privacy Principles and the APP Guidelines. You may also wish to look through the Privacy fact sheets.

Back to Contents

Can a business build up personal profiles of business associates or clients as part of developing a relationship with them (for example by recording information they provide about their interests)?

The business can do this, even if it is subject to the APPs. But there are some restrictions:

  • The business cannot use unfair means to collect the information. So it cannot trick the person into giving the information or spy on them. See APP 3.5.
  • The business can use the information for building relationships with the clients but if it wants to use the information for some other purpose, it can only do so if the clients would reasonably expect that to happen (see APP 6.2) or if the clients have consented (see APP 6.1(a)).
  • If the business is collecting sensitive information (racial origin, political opinions, religion, philosophical beliefs, sexual preferences, criminal record, or health information) it will need the consent of the individual. See APP 3. Sometimes it may not be obvious whether the individual has consented to all the uses of personal information that the business has in mind. The Privacy Act only states that consent can be either 'express' or 'implied'. Please find tips for compliance and other commentary in the APP Guidelines.

 For more information about the coverage of the APPs, see the Who is covered by privacy page.

Back to Contents