Most people, asked to define "personal information," would say something like a name, an address, maybe a date of birth. Under the Privacy Act 1988, the definition is a good deal wider than that, and it's worth knowing where the line actually sits.
What the Act actually includes
Personal information is any information or opinion about an identified individual, or someone who could reasonably be identified from it, whether or not it's written down. That last part surprises people. A spoken opinion about someone, if it could identify them, can count. So can an email address, an IP address, or a photo, not just the details on a form.
It doesn't need to be written down, and it doesn't need to be your name, to count as personal information.
Why the wider definition matters
It changes what's actually worth protecting. A habit of thinking "it's just my email" or "it's just a photo" underestimates how identifiable those things can be, especially combined with other details a scammer might already have.
What it means day to day
Worth being a little more careful with details that don't feel sensitive on their own, an email address here, a workplace mentioned there, because collected together they can build a fuller picture of someone than any single piece would suggest.
Read it from the source
The Office of the Australian Information Commissioner explains your privacy rights in plain English. Read more at oaic.gov.au →