Australian Privacy Law for Direct Mail Campaigns

Direct mail to existing customers is generally well within Australian law — but there are specific obligations around data handling, opt-out mechanisms, and what you can send to whom. This guide covers the key requirements for Shopify brands using direct mail in Australia.

Not legal advice. This guide summarises publicly available information for educational purposes. It is not a substitute for legal advice from a qualified Australian privacy or marketing law practitioner. Laws and regulations change — verify current requirements with a lawyer.

The Privacy Act 1988 and direct mail

The Australian Privacy Act 1988, administered by the Office of the Australian Information Commissioner (OAIC), governs how organisations collect, use, store, and disclose personal information. For direct mail, the key obligations are:

Collection limitation — Only collect personal information (including postal addresses) that you need for a stated purpose. Shopify addresses collected for order delivery can generally be used for marketing to existing customers, provided your Privacy Policy discloses this use.
Use and disclosure limitation — Don't share customer addresses with third parties without consent, or use them for purposes beyond what's disclosed in your Privacy Policy.
Access and correction — Customers have the right to request access to their personal information and to correct inaccuracies.
Opt-out mechanism — Marketing communications should provide a way for the recipient to opt out of future direct mail.

APP 7: the privacy principle for direct marketing

Australian Privacy Principle 7 governs direct marketing, and the OAIC's APP 7 guidelines list a catalogue mailed to someone by name as an example, so addressed postcards are in scope. An organisation may use personal information it collected from the individual for direct marketing when:

the individual would reasonably expect it to be used that way
there is a simple way to ask not to receive direct marketing
the individual hasn't already made that request

If the person wouldn't reasonably expect it, or the information came from someone else, you need their consent unless that's impracticable, and every mailing has to carry a prominent opt-out statement. Once someone opts out, the OAIC says a reasonable period to stop would generally be no more than 30 days. On request, you also have to tell the person where you got their information, unless that's impracticable or unreasonable.

The Privacy Act doesn't reach every business. Under the OAIC's small business guidance, most businesses with an annual turnover of $3 million or less are not covered, though some are covered at any size, including health service providers and businesses that trade in personal information. Checked 26 September 2026.

The SPAM Act 2003 — does it apply to direct mail?

The Spam Act 2003 regulates electronic commercial messages — specifically email, SMS, and instant messages. Physical postal mail is not covered by the Spam Act. Direct mail postcards sent to customer addresses are governed by the Privacy Act and general consumer law, not the Spam Act.

This means the Spam Act's consent requirements (opt-in, unsubscribe mechanism within 5 days) don't apply to your postcard campaigns. However, best practice is to include an opt-out mechanism and honour opt-out requests regardless.

Do Not Mail registers in Australia

Australia does not have a statutory Do Not Mail register equivalent to the Do Not Call Register (which covers telemarketing). There is no government-operated list of consumers who have opted out of direct mail that you're legally required to screen against.

The Association for Data-driven Marketing and Advertising (ADMA), the industry body, runs a voluntary Do Not Mail Register: an industry suppression list for unwanted addressed mail. It binds ADMA members and participating non-members only, and it does not cover unaddressed letterbox drops or business-to-business mail. If your business is an ADMA member, check your obligations with ADMA.

Mailing to existing customers vs prospects

For Shopify brands using TouchDrop, the vast majority of postcard sends are to existing customers — people who have previously purchased and provided their address for order delivery. This is the most straightforward scenario from a privacy standpoint:

The customer has an existing relationship with your brand
Their address was collected for a legitimate purpose (order delivery)
Marketing to existing customers is within the reasonable expectations of the relationship
Your Privacy Policy should disclose that you may use contact information for marketing communications

Mailing to purchased lists or prospects who haven't interacted with your brand carries higher privacy risk and requires more careful legal review.

Best practices for compliant direct mail

Include your business name and a contact address on every postcard
Include an opt-out mechanism (e.g. "To stop receiving mail from us, email [address] or go to [URL]")
Honour opt-out requests promptly — add opted-out customers to your TouchDrop suppression list
Keep your Privacy Policy up to date to disclose direct mail marketing use of customer data
Don't mail to customers who have explicitly asked not to be contacted
Retain records of your audience selection and suppression logic in case of a complaint

Suppression and opt-out management built in.

TouchDrop handles suppression automatically — protecting you and your customers.

Get started free