Market research in Australia and the legal obligations to know

Market research is how Australian businesses pressure-test a product, a price or a message before spending real money on it. A survey, a round of customer interviews or a focus group can give you the confidence to launch, or save you from launching something nobody wants. But the same activities also switch on legal obligations that many businesses never think about. Every questionnaire that collects a name and an email address, every recorded interview, every recruitment message and every advertising claim built on the findings engages a law you need to manage.

The obligations cluster around five areas: privacy under the Privacy Act 1988 (Cth), electronic messaging under the Spam Act 2003 (Cth), recording consent under state and territory surveillance laws, the claims you make under the Australian Consumer Law (Cth), and the protection of your own and other people's intellectual property. This guide explains who each obligation applies to, what you must do to comply, what getting it wrong can cost, and the documents that keep a research project on the right side of the law.

Who each obligation applies to

The first question is whether you are caught at all, because the thresholds differ from law to law.

Privacy Act: The Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) apply to businesses whose annual turnover was more than $3 million in the previous financial year. The small business exemption is narrower than it sounds. Under s 6D(4) of the Act, the APPs also apply to health service providers that hold health information, businesses that disclose personal information for a benefit, service or advantage, businesses that are paid to collect personal information, contracted service providers for Commonwealth contracts, and credit reporting bodies. A research agency that sells the data it collects can fall in through the disclosure category even at well under $3 million in turnover.
Spam Act: The Spam Act 2003 (Cth) applies to every business regardless of size. If you send a commercial electronic message with an Australian link, you are in scope.
Australian Consumer Law: The ACL is Schedule 2 of the Competition and Consumer Act 2010 (Cth) and applies to conduct in trade or commerce. Nearly any business promoting a product or recruiting participants is acting in trade or commerce, so there is effectively no size threshold.
Surveillance laws: Recording rules are set by each state and territory. The law that applies depends on where the conversation happens and where the parties are, not on your business size.

Privacy and the Australian Privacy Principles

If the APPs apply to you, the obligations start before you ask your first survey question. You need a privacy policy that is current and available (APP 1), and you need to give participants a collection notice at the point of collection that explains what you are collecting, why, how it will be used and stored, who it might be disclosed to (including overseas), and how they can complain or opt out (APP 5).

The APPs also shape what you can collect and do with it. Collect only what is reasonably necessary for the research purpose (APP 3), use and disclose the information consistently with the purpose you told participants about (APP 6), and take reasonable steps to keep it secure (APP 11). If you collect sensitive information such as health details, political opinions or ethnicity, you generally need consent. Two practical documents carry most of this load: a plain-English privacy policy and a short collection notice on the survey introduction screen or consent form.

Even if you fall within the small business exemption, adopting APP-style practices is usually worth it. Research platforms and participant panels often require it, and a clear privacy promise is what makes strangers willing to answer your questions. If a data breach occurs and the APPs apply to you, the notifiable data breach scheme in the Privacy Act requires you to notify the Office of the Australian Information Commissioner (OAIC) and affected individuals where the breach is likely to result in serious harm.

Email, SMS and the Spam Act

The Spam Act applies to commercial electronic messages: email, SMS, instant messaging and social media messages sent to an Australian address. Two messages in the research lifecycle usually trigger it: the recruitment or follow-up messages you send to participants, and any marketing you send them afterwards using the details they gave you.

Under s 16 of the Act you must not send an unsolicited commercial electronic message unless the recipient consented, either expressly or by reasonable inference from their conduct and relationship with you. The message must identify the sender and include a functional unsubscribe facility that works for at least 30 days after sending (s 18). When someone unsubscribes, the withdrawal of consent takes effect five business days later under Schedule 2 of the Act, and you must stop sending to them. The Australian Communications and Media Authority (ACMA) enforces the regime and can issue formal warnings, infringement notices and court-enforced penalties.

The practical point: get consent that is specific to the type of message you will send, keep a record of when and how consent was given, and make sure every campaign message carries your details and a working unsubscribe.

Recording interviews and focus groups

Recording an interview or focus group is convenient, but it can be a criminal offence if done without the right consent. The rules are set by state and territory surveillance legislation, and they differ. Under s 7 of the Surveillance Devices Act 2007 (NSW), for example, using a listening device to record a private conversation is an offence unless an exception applies, with a maximum penalty of 500 penalty units for a corporation and 100 penalty units or five years' imprisonment for an individual. The Act also prohibits publishing or communicating a recording made in breach of it (s 11).

Other states and territories take different approaches: some require the consent of all parties to the conversation, while others allow a participant to record without the other parties knowing. The safest approach for research anywhere in Australia is to tell participants in advance that the session will be recorded, get their written consent, and keep that consent on file. A lawyer can confirm which state's rules apply to your recordings and whether any exceptions are available.

Consumer law and the claims you make

The ACL casts a long shadow over research. Under s 18 of the ACL, a person must not, in trade or commerce, engage in conduct that is misleading or deceptive or is likely to mislead or deceive. That provision bites twice in a research project: in the materials you use to recruit participants, for example what an incentive involves or how long a session will take, and in the advertising and product claims you build from the findings.

If a claim amounts to a false or misleading representation about goods or services, the ACL's specific representation provisions also apply (s 29 and related provisions in Part 3-1 of the ACL). Pecuniary penalties for a body corporate are the greater of $100 million, three times the benefit obtained from the conduct, or 30% of adjusted turnover, under s 224 of the Competition and Consumer Act 2010 (Cth), with a maximum of $2.5 million for an individual. For s 18 itself the usual remedies are court orders such as injunctions and damages, but the exposure is still real: the ACCC can investigate, and damages and corrective orders can be ordered.

The practical habit is to stress-test every claim before it is published: can you substantiate it, is it qualified so it cannot mislead, and does it match what participants actually told you?

Confidentiality, intellectual property and other people's content

Research exposes your early-stage ideas. When you share prototypes, concepts, roadmaps or draft branding with testers, agencies or freelancers, a non-disclosure agreement (NDA) keeps the material confidential and clarifies who owns what. IP ownership should also be addressed in the agreement with any agency or panel you engage: who owns the outputs, the data and any improvements.

The other direction matters just as much. Under the Copyright Act 1968 (Cth), copying or republishing someone else's images, reports, survey instruments or frameworks without a licence can infringe their copyright, and scraping or repurposing third-party content can also breach website terms of use. Use licensed images and datasets, and check the terms of any tool or panel you rely on. If research confirms your brand is worth protecting, lodge a trade mark application with IP Australia before you commit to a full launch.

Data security and research partners

Personal information collected in research should be held securely, accessed only by people who need it, and retained only for as long as the research purpose requires. Under APP 11 of the Privacy Act, if it applies to you, you must take reasonable steps to protect the information from misuse, interference, loss and unauthorised access, modification or disclosure, and to destroy or de-identify it once it is no longer needed.

If you use overseas tools or contractors, APP 8 requires you to take reasonable steps to ensure the recipient handles the information in line with the APPs, or the participant must be informed and consent. Cross-border disclosure should also be disclosed in your collection notice.

When an agency or panel recruits participants or runs sessions for you, put the arrangement in writing. A research services agreement should cover deliverables, timelines, fees, data handling and security, IP ownership, confidentiality and termination. The same goes for any incentive program: be clear about what participants receive and what is expected in return, so the arrangement is not misleading.

What non-compliance can cost

Penalties are the sharp end of these obligations, and several are large.

Privacy: For a serious or repeated interference with privacy, a body corporate faces a maximum civil penalty of the greater of $50 million, three times the benefit obtained, or 30% of adjusted turnover, and an individual faces up to $2.5 million (s 13G of the Privacy Act 1988 (Cth)). The OAIC investigates and can seek civil penalties through the courts.
Spam Act: A body corporate with no prior record faces up to 100 penalty units per contravention, capped at 2,000 penalty units where the court finds multiple contraventions on the same day, with higher caps for repeat offenders (s 25 of the Act). Penalty units are indexed and are currently worth around $313 each.
ACL: False or misleading representations can attract penalties of up to $100 million for a company and $2.5 million for an individual for each act or omission (s 224 of the Competition and Consumer Act 2010 (Cth)). The ACCC is the enforcement agency.
Recording: As noted, recording without lawful consent can be a criminal offence carrying imprisonment in some states.

Beyond dollar figures, non-compliance can derail the research itself. Data collected without proper consent may not be usable, complaints to regulators consume time, and a public penalty notice is poor advertising.

A compliance checklist for your next research project

Before you field a survey, run an interview or launch with findings, work through this list:

Scope check: Confirm whether the Privacy Act applies to you, including through the limits on the small business exemption: turnover over $3 million, health information, trading in personal information, Commonwealth contracts and credit reporting.
Collection notice: Put a short notice at the start of every survey or session explaining what you collect, why, how it is used and stored, and how to opt out.
Consent records: Log when and how each participant consented, including consent to be recorded and to be quoted.
Recording: Confirm the recording rules for the state or territory where the conversation happens, and get written consent before you press record.
Messages: Ensure recruitment and follow-up messages identify you, state the purpose and carry a working unsubscribe, with consent recorded.
Claims: Substantiate every claim you plan to publish, and check it against the ACL's misleading conduct and representation rules.
IP: Have NDAs in place before sharing prototypes, and confirm licences for any third-party content you use.
Partners: Document the terms with any agency, panel or freelancer, covering data handling, IP ownership and confidentiality.
Security: Limit access to research data, set retention timeframes, and review any overseas tools or contractors.

When to get legal advice

You do not need a lawyer to run a small survey, but advice earns its keep at the edges. A commercial lawyer can review your survey instruments and consent forms, draft or update a privacy policy and collection notice, advise on which state's recording rules apply to your sessions, prepare NDAs and research services agreements, and stress-test your advertising claims against the ACL before you publish. If you are building a research panel, selling insights, or collecting sensitive information, tailored advice is worth the cost, because the small business exemption will not protect those models and the penalty figures above show what is at stake.

The compliance step that most research teams miss is not the privacy policy sitting on your website. It is the collection notice at the point of collection, and the record of consent behind it. A participant who ticks a box saying they agree to take part has not necessarily consented to their data being used, their session being recorded, or their details being added to a marketing list. Each of those uses needs its own clear notice and its own recorded consent.

The threshold that catches businesses by surprise is the small business exemption. It is easy to assume that under $3 million in turnover means privacy law does not touch you, until you realise you trade in personal information or hold health information, and the exemption falls away. Before your next survey, write the collection notice into the survey introduction, set up a simple consent log, and check which of the exemption's limits apply to you. That is the cheapest insurance a research program can buy, and it is the difference between insights you can act on and data you cannot use.