Which act places limits on how data must be used for its primary purpose?

The Privacy Act 1988 is the correct choice as it specifically governs how personal information can be handled and mandates that data collected for one purpose should not be used for another without the individual's consent. This legislation establishes principles relating to the collection, use, and disclosure of personal data, emphasizing that organizations must adhere to the purpose for which the data was originally collected, thereby ensuring that individuals' privacy is respected.

While other acts, such as the Health Records Act 2001 or the Privacy and Data Protection Act 2014, also contain provisions relevant to data privacy, they address more specialized areas or provide additional protections that may focus on specific sectors or types of information. However, the Privacy Act 1988 serves as a foundational framework for data privacy in Australia, effectively placing limitations on the use of data to uphold the rights of individuals in relation to their personal information.