What is the purpose of this notice? 

The joint permits process means your personal information will be dealt with by both the Great Barrier Reef Marine Park Authority (Reef Authority) and the Queensland Department of the Environment, Tourism, Science and Innovation (DETSI) through the Queensland Parks and Wildlife Service (QPWS) (together, the Managing Agencies). The Managing Agencies are committed to protecting your personal information in accordance with the Privacy Act 1988 (Cth) (Privacy Act) (when in the possession and/or control of the Reef Authority) and the Information Privacy Act 2009 (Qld) (IP Act) (when in the possession and/or control of QPWS). We also comply with the European Union’s General Data Protection Regulation (EU’s GDPR) and other privacy laws to the extent that they apply.

This Privacy Collection Notice is provided by the Reef Authority pursuant to Australian Privacy Principle 5 of the Privacy Act and describes how your personal information is collected, used, and disclosed by the Managing Agencies in connection with your registration for a Permits Online account and any permit application made by you. 

Why is your personal information being collected?

The Reef Authority collects personal information (which may include sensitive information) as part of your registration for a Permits Online account and any permit application made by you. This information is collected for the following purposes: 

  • to facilitate account registration and management for, and correspondence relating to, Permits Online and its associated platforms (Bookings Online and EMC Online);
  • to assess any permit application made by you, and to assist the Managing Agencies to make a decision whether to grant the relevant permission; and
  • to enable the Managing Agencies to perform their respective statutory functions and activities, including:

Your personal information may also be used to notify you of any subsequent matters which may impact you or any permission granted to you, including:

  • any changes to your permission, permit requirements generally, or Environmental Management Charge fees;
  • information about management arrangements for the Great Barrier Reef Marine Park and/or Great Barrier Reef Coast Marine Park (Marine Parks) and relevant policies implemented by the Managing Agencies;
  • general educational updates, including invitations to relevant workshops and forums, about the Marine Parks; and
  • any temporary authorisations issued in the Marine Parks (eg, following extreme weather events).

The Managing Agencies collect your personal information pursuant to our respective statutory functions and activities. Consistent with the requirements in the EU’s GDPR the collection is therefore for a lawful basis. 

What happens if you do not provide this information?

If you do not provide the requested personal information, the Managing Agencies may not be able to facilitate your account registration, assess any permit application or grant the requested permission (as applicable).

How do we collect personal information?

Generally, the Managing Agencies will collect your personal information directly from you or any person authorised to act on your behalf. This may occur via Permits Online and its associated platforms (Bookings Online and EMC Online), or by email as part of the further information ‘FINFO’ process for permit applications. The Managing Agencies may also collect personal information (which may include sensitive information) about you from third parties or publicly available sources to assist in assessing any permit application made by you. This may be through information obtained from agencies such as the Australian Maritime Safety Authority, Maritime Safety Queensland, the Queensland Department of the Environment, Tourism, Science and Innovation, the Queensland Department of State Development, Infrastructure and Planning, recognised environmental eco-certification bodies, and Native Title and Traditional Use of Marine Resources Agreement (TUMRA) groups. By submitting a permit application, you consent to this collection of your personal information (which may include sensitive information). You will be given an opportunity to comment on any information that may result in adverse findings.

Who will your personal information be disclosed to?

As noted above, the permit application form is a joint application form that may be used by both the Reef Authority and QPWS to assess your application for a permission. A copy of the application form and the information you provide will be shared with QPWS for this purpose. If the Managing Agencies consider that granting the permission may restrict the public’s reasonable use of the Marine Parks or may result in a significant impact on the values of the Marine Parks, you may be required to publish an advertisement containing information about your application as reasonably required by the Managing Agencies. In this case, the public will also be able to consider your application and provide comment on it.

If your permit application is successful, the Managing Agencies are required, by law, to include certain personal information on the permit itself (see section 24 of the Qld Regulations). Further, the Reef Authority is required, by law, to maintain a public Register of permissions (see Part 7 of the GBRMP Regulations). This means a copy of the permit document, which may include some identifying information such as your name and address, will be publicly available via the Reef Authority’s website.  

Please note that your personal information being published on the Internet means it will be accessible to third parties both within Australia and overseas. The Managing Agencies are not accountable under the Privacy Act, the IP Act, or the EU’s GDPR for any use or disclosure by a third party that accesses your personal information via the Internet.

The Managing Agencies will not otherwise disclose your personal information unless it is in accordance with the Privacy Act, the IP Act, the EU’s GDPR, or other relevant Commonwealth or State legislation.

Potential disclosure by the Reef Authority
The Reef Authority may also disclose your personal information (limited to your name) when it formally refers your permit application to a relevant TUMRA group for comment as part of the Reef Authority’s cultural referrals process. The Reef Authority will also disclose your personal information (limited to your name) where it is required to issue a Future Act Notification to relevant registered native title holders or claimants under the Native Title Act 1993 (Cth).  

Potential disclosure by QPWS
QPWS may have entered into an Indigenous Management Agreement or Indigenous Land Use Agreement relating to adjacent National Parks under the Nature Conservation Act 1992 (Qld) or State Marine Parks under the Marine Parks Act 2004 (Qld). In such cases, your completed application form and relevant supporting documentation may be disclosed to the relevant Indigenous organisations (including any relevant Native Title Body Corporates) for the purpose of consultation or obtaining consent. Your information may only be used for this purpose and will not be disclosed to any other person. 

Will your personal information be disclosed overseas?

The Reef Authority does not generally disclose personal information to overseas entities. If we were required to disclose your personal information overseas, we would take reasonable steps to ensure that the overseas recipients of your personal information had sufficient processes in place to ensure that there was no breach of the obligations under the Privacy Act or GDPR. We would also inform you of the overseas disclosure and, where possible, the countries to which your personal information was disclosed. 

What are your rights regarding your personal information?

For information about how the Managing Agencies handle your personal information, and how to make a complaint, access your personal information, or seek correction/ amendment of your personal information, please refer to: 

The Reef Authority’s Privacy Policy also includes information about storage of information and your rights under the EU’s GDPR (to the extent they apply).

For general information regarding your privacy rights under the relevant statutory framework, please visit: 

  • for the Privacy Act which applies to the Reef Authority, the Office of the Australian Information Commissioner’s website at www.oaic.gov.au; and/or
  • for the IP Act which applies to QPWS, the Office of the Information Commissioner Queensland’s website at www.oic.qld.gov.au.

Contact details 

If you have any questions or concerns about this Privacy Collection Notice or the Reef Authority’s management of your personal information, please contact our Privacy Officer via: 

Email: privacy@gbrmpa.gov.au   
Phone: +61 7 4750 0700 
Post: PO Box 1379, Townsville QLD 4810 AUSTRALIA 

For any questions or concerns about the management of your personal information by QPWS, please refer to the contact information in the Privacy and security statement located on DETSI’s website.

Confirmation and consent 

By providing your personal information to register for Permits Online and for the purposes of any permit application, you consent to the Reef Authority collecting and handling your personal information (including any sensitive information) in accordance with this Privacy Collection Notice. 

Created
Updated 25 Feb 2026
Was this page helpful?
Your rating will help us improve the website.
CAPTCHA
This question is for testing whether or not you are a human visitor and to prevent automated spam submissions.