GDPR and Australian Privacy Act Obligations for Wedding Couples

Australian wedding couples generally do not need to comply with the GDPR or the Privacy Act when collecting details for their own private wedding. The household exemption covers that personal activity. But it does not cover a commercial platform simply because a couple uses it. Couples should therefore assess whether the chosen platform deserves guests’ trust.

Why Australian wedding couples are asking the wrong privacy question

A couple sets up a digital RSVP form with fields for names, emails and dietary needs, then wonders whether it needs a privacy policy. That worry starts with the wrong legal framework. Collecting information for a private wedding is not the same as collecting it for a business. The couple’s personal use sits outside the obligations they are worrying about.

The real question concerns where those answers go. Guests give information to help their hosts plan a wedding, but a commercial service may collect and store it. Choosing that service puts guests’ information in another entity’s hands.

What the household exemption actually says, and why it covers most couples

The GDPR excludes processing by individuals for purely personal or household purposes under Article 2(2)(c) and Recital 18. That means activity with no connection to a professional or commercial purpose. The Privacy Act 1988 similarly exempts an individual’s collection, use or disclosure of personal information solely for personal, family or household affairs. It also exempts acts by an individual outside the course of business. A couple collecting RSVPs for its own private wedding fits squarely within those exclusions.

The reassurance here is straightforward and well established. Names, contact details and dietary requirements do not turn private wedding planning into a regulated business activity. The OAIC’s GDPR guidance explains that Australian businesses of any size may fall within the GDPR if they have an EU establishment, offer goods or services in the EU, or monitor individuals’ behaviour there. A private wedding couple does not meet those business conditions. Having guests who live in Europe does not, on its own, make the hosts a commercial service.

Where the exemption stops — the platform is a separate legal entity

The household exemption belongs to the individual’s personal activity. A commercial platform does not inherit that exemption from its customers. When it collects and stores RSVP information as part of its business, its own legal position determines its obligations. Depending on which regime applies, those obligations may be those of an APP entity under Australian law or a data controller under the GDPR.

The distinction is between two uses of the same information. The couple needs a guest’s email address to plan who will attend, while the platform processes that address as part of its commercial service. The first purpose does not exempt the second activity. Nor does the couple’s household exemption establish that the platform handles information lawfully. Its compliance has to stand on its own.

In practice, the couple entrusts the work to another entity. That entity has obligations in its own right, rather than obligations created by the couple’s choice. Guests still face the risks that come with the service their hosts choose. They may be comfortable giving their hosts a dietary requirement without expecting a platform to use it for advertising. The couple’s legal exemption does not close that gap in expectations.

Why dietary requirements and accessibility needs deserve particular attention

“Do you have dietary requirements?” looks like an ordinary planning question. Its answer helps organise catering, but it can reveal more than a meal preference. Dietary requirements and accessibility needs can include health-related information, which attracts stricter handling standards under both regimes. Not every meal choice reveals a health condition or religious belief. The concern is what a particular answer discloses, or what a platform derives from it.

That distinction becomes sharper when information is reused. When a platform uses dietary answers for behavioural advertising or profiling, it may work out sensitive information about a guest’s health or religious beliefs without their consent. That is a different and more serious issue than simply collecting an RSVP. Couples choosing a service should check whether it uses that field only to help plan the wedding.

How the GDPR and the Privacy Act differ in ways that affect platform selection

The GDPR and the Privacy Act share a broad architecture, but they are not interchangeable. A claim that a platform follows privacy law does not explain which rights guests have. For platform selection, two especially practical points are the right-to-erasure gap and the threshold for breach notification. These rules affect what happens when someone wants their information removed or when it is no longer secure. A general compliance statement is not an answer to either question.

The erasure gap makes a platform’s deletion policy particularly important. Australia has proposed a right to erasure, so couples cannot yet assume that every service must honour it. Couples should therefore check how long a platform says it keeps information and what options it offers to delete it. Breach notification also needs a separate answer. The two regimes’ thresholds differ, so compliance under one should not be read as a promise of identical notification under the other.

The GDPR, read with the ePrivacy Directive, generally requires express consent for electronic direct marketing, although the GDPR alone allows legitimate interests in some circumstances. The Privacy Act permits implied consent for direct marketing in some circumstances. As a result, a service operating only under Australian law may be able to contact guests in ways a GDPR-compliant service may not. The important distinction is between permission to manage an RSVP and permission to market to the person submitting it.

International transfers create a separate issue for European guests. The OAIC’s guidance notes that Australia does not hold an EU adequacy decision. Transfers from the EU to Australian platforms therefore require appropriate safeguards, such as Standard Contractual Clauses. Those safeguards concern the platform’s arrangements. A service accepting information from EU residents should be able to explain the safeguards relevant to those transfers.

Australia's new statutory privacy tort and what the first wedding-related ruling signals

Australia’s Privacy and Other Legislation Amendment Act 2024 introduced a statutory tort for serious invasions of privacy, in force from 10 June 2025. It gives individuals a direct legal action for intentional or reckless intrusion into personal seclusion or misuse of personal information. Compensation is capped at a statutory maximum. This is not simply another platform policy requirement. It provides a route to court for serious conduct.

The NSW District Court granted urgent interlocutory injunctions in Kurraba Group Pty Ltd & Anor v Williams NSWDC 396 on 7 October 2025. Private wedding photographs had been published online during an extortion campaign. The proceedings were heard urgently without the defendant present, and the court found serious questions to be tried. Its orders included removal of online content and restraints on further publication. This was the first published application of the new tort.

The ruling was interim relief. It should not be treated as settled authority on liability or compensation for every misuse of wedding information. Its significance is more immediate than that. The new cause of action is being used, and wedding photographs were involved in its first published application. Platforms can face legal action for serious intentional or reckless misuse of wedding information, and guests harmed by it have a remedy that was unavailable before June 2025.

What the proposed second tranche of Privacy Act reform would change for platforms couples use

Australia’s reform programme has two tranches, with the first now in force and the second not yet passed. The Australian Government put out a Privacy Reform Consultation Paper and an exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026 on 31 August 2026. The Attorney-General’s Department states that submissions closed on 18 September 2026. The Government has signalled its intention to introduce the Bill to Parliament. These remain proposals, and their provisions could change.

The proposed changes include a “fair and reasonable” requirement for collection, use and disclosure. They would also refine what counts as consent. Passive or pre-selected mechanisms would generally not satisfy the proposed requirements, which call for consent to be voluntary, informed, current, specific and unambiguous. Implied consent could survive where it can be clearly inferred from someone’s conduct. Bundled permissions, pre-ticked boxes and broad consents would be unlikely to meet the specificity requirement.

Proposed APP 14 would introduce a right to erasure for information held by large digital platforms. Subject to defined exceptions, those platforms would have to destroy personal information on request and confirm the outcome in writing. That is not a current universal deletion right. But when a couple plans a wedding 12–18 months ahead, the rules may change while they are planning it. Specific, affirmative, per-purpose consent flows are a more future-proof choice than defaults whose acceptability may disappear if the proposed rules pass.

What couples should actually check before choosing a wedding platform to collect guest data

For couples choosing a platform, the practical test is simple. Does it handle guest information in a way they would be comfortable explaining to the people submitting it? The first checks are whether it uses encrypted connections through HTTPS and clearly states that guest data is not shared with third parties for marketing. Those address different concerns, so one does not replace the other.

Retention and deletion need equally clear answers from the service. Its privacy policy should explain how long information is stored and when it is deleted after the event. Couples should also check whether they can export all guest data and delete their account after the wedding. Account deletion should not be assumed to answer every question about retained information. The policy needs to say whether guest details stay on file indefinitely after the account is deleted.

Consent is the next part of that practical assessment. Couples should check for specific, affirmative permission for any use beyond the RSVP function and ensure that pre-ticked boxes or opt-out defaults are excluded. If guests are EU residents, the platform should explain its safeguards for international transfers. Dietary requirements deserve their own question about whether they are treated as sensitive information and used only for seating and catering logistics. A broad statement about protecting guest data does not explain what happens to that particular field.

The distinction that actually matters — couples are data custodians, not data controllers

“Data custodian” is a useful description of the couple’s role. The household exemption keeps private wedding planning outside the APP-entity and GDPR-controller obligations at issue here. Trust remains part of hosting, even without those duties. Guests give details for a specific purpose, and the hosts choose which service gets them. That makes purpose limitation a practical standard for the choice.

A platform selling dietary information to advertisers would violate the reasonable expectation behind an RSVP, even though choosing it would not itself make the couple liable under the Privacy Act. The lesson for couples is to choose a platform as carefully as a venue, by looking at how its operators treat the people entrusted to them. Calm, organised planning includes knowing who will hold guest information, why they need it and when they will delete it.