Schedule 1 Part 8 creates a lower-tier civil penalty provision (maximum 200 penalty units, infringement notices of 200 units per contravention for listed corporations) for acts or practices that breach APP 1.3 (having an APP privacy policy), APP 1.4 (its contents), APP 2.1 (anonymity and pseudonymity), APP 6.5 (written note of certain uses or disclosures), APP 7.2(c) or 7.3(c) (a simple means to opt out of direct marketing), APP 7.3(d) (drawing attention to the opt-out), APP 7.7(a) (giving effect to an opt-out request in a reasonable period), APP 7.7(b) (notifying the source of information), APP 13.5 (dealing with correction requests), and any APP prescribed by regulations; from 10 December 2026 APP 1.7 (automated decisions in the privacy policy) is added. Conduct may also contravene s 13G or 13H.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.