What the rules actually say about direct mail in Australia

Written by Autopen Australia · Updated 23 August 2026

The Privacy Act and APP 7

Australian Privacy Principle 7 sets out when an organisation covered by the Privacy Act may use or disclose personal information for direct marketing. The structure that matters for a mail campaign:

• Information you collected from the individual: you may generally use it for direct marketing where they would reasonably expect it, and you must provide a simple means of opting out.
• Information collected from someone else: a stricter test applies — broadly, consent, or impracticability of obtaining it, plus a prominent opt-out statement in each communication.
• Sensitive information (health, racial or ethnic origin, political or religious affiliation, sexual orientation, criminal record and others): consent is required.
• Opt-out requests must be actioned, free of charge and within a reasonable period.

The OAIC’s APP 7 guidelines are the authoritative source and are written to be readable.

Note that many small businesses with annual turnover of $3 million or less are not covered by the Privacy Act at all, though there are important exceptions — health service providers among them. Whether you are covered is worth establishing rather than assuming, in either direction.

Why the Spam Act does not apply

The Spam Act 2003 governs commercial electronic messages. Its consent, identification and unsubscribe requirements — the ones most marketers know by heart — do not extend to a letter. This is a genuine and often-missed difference between the channels, and it is one reason addressed mail remains available for approaches that email cannot make.

It is not a licence to do whatever you like. Australian Consumer Law still prohibits misleading or deceptive conduct, and a letter designed to mislead about who sent it or what it is remains a problem regardless of the medium.

The Do Not Mail service

ADMA operates a Do Not Mail register for people who have opted out of receiving addressed marketing mail. Members are required to wash lists against it. Even if you are not a member, honouring it is sensible: someone on that register who receives your letter is not a prospect, and mailing them costs you money to generate irritation.

Practical checklist before a campaign

1. Confirm where the data came from, and that using it this way is consistent with what people were told.
2. Remove anyone who has previously opted out of marketing from you.
3. Wash against Do Not Mail if that applies to your organisation.
4. Include a plain way to opt out, and make sure someone actions it.
5. Make clear on the piece who sent it. Anonymity invites the wrong questions.
6. Do not put sensitive information on the outside — or, ideally, anywhere in it.
7. Keep a record of the list you mailed and when, so an opt-out can be traced.

Healthcare, specifically

Health service providers are covered by the Privacy Act regardless of turnover, and health information is sensitive information. A recall letter should name no condition, no medication, no test and no procedure — and doing so is both good compliance and good design, because someone other than the patient may open the envelope. More on healthcare mail.

What we do with your list

When you send us a mailing list, you remain the entity responsible for that personal information. We act as a processor: we use it to produce your mail and for nothing else, we never combine it with another client’s data, and we return or destroy it on request. Our data handling in full.

This page is general information about Australian direct marketing regulation, not legal advice, and it may not reflect changes made after the date shown above. Take advice on your specific circumstances.