Australia Privacy Act 2026: Your Rights Explained

The Australia Privacy Act 2026 represents the most significant overhaul of Australian privacy law since the Act was first introduced in 1988. After years of consultation following the 2020 Privacy Act Review, the latest tranche of reforms expands individual rights, tightens obligations on businesses, and brings Australian privacy standards closer in line with the EU's General Data Protection Regulation (GDPR). If you live in Australia, work for an organisation that handles personal information, or simply want to understand what the new rules mean for your digital life, this guide explains everything you need to know.

What Is the Australia Privacy Act 2026?

The Australia Privacy Act 2026 is the updated version of the Privacy Act 1988, incorporating reforms passed by the Australian Parliament to modernise how personal information is collected, stored, used, and disclosed. It applies to most Australian government agencies and private sector organisations with an annual turnover of more than A$3 million, along with certain small businesses that handle sensitive information such as health records.

The reforms are being rolled out in tranches, with the second tranche taking effect progressively through 2025 and 2026. Key changes include a new statutory tort for serious invasions of privacy, expanded rights for individuals, stricter requirements around automated decision-making, and significantly higher penalties for non-compliance.

Why the 2026 Reforms Matter

Australia has experienced a wave of high-profile data breaches in recent years, including the Optus, Medibank, and Latitude Financial incidents that collectively exposed the personal details of tens of millions of Australians. These events accelerated the political appetite for reform and shaped many of the provisions now in force.

The 2026 Act aims to:

1. Give individuals greater control over their personal information.
2. Hold organisations accountable with meaningful penalties.
3. Address the risks of artificial intelligence and automated profiling.
4. Align Australia with international privacy frameworks to support cross-border trade.
5. Protect children and other vulnerable groups online.

Your New Rights Under the Privacy Act 2026

The reforms introduce or strengthen a range of individual rights. Below is a breakdown of the most important ones.

1. The Right to Erasure

Often referred to as the "right to be forgotten," this right allows individuals to request that an organisation delete personal information it holds about them. There are exceptions — for example, where the information must be retained to comply with a legal obligation or is necessary for exercising freedom of expression — but the default is that reasonable requests should be honoured.

2. The Right to Object to Direct Marketing

You can now unambiguously opt out of having your personal information used for direct marketing, including targeted online advertising. Organisations must provide a simple, free mechanism to opt out and must stop processing your data for marketing purposes once a request is made.

3. The Right to Information About Automated Decisions

If an organisation uses automated systems — including AI — to make decisions that significantly affect you (such as credit scoring, insurance pricing, or job applications), you have the right to be told. You can also request meaningful information about how the decision was made and, in many cases, request human review.

4. The Right to Sue for Serious Invasions of Privacy

Perhaps the most significant reform is the new statutory tort for serious invasions of privacy. Individuals can now bring civil action directly in court for intrusions such as unauthorised surveillance, doxxing, or misuse of intimate images, without having to rely on patchy state-based laws.

5. Enhanced Protections for Children

A new Children's Online Privacy Code imposes additional obligations on services likely to be accessed by children under 18. These include prohibitions on targeted advertising, default high-privacy settings, and age-appropriate design standards.

6. The Right to Access and Correct Your Information

While access and correction rights have existed since 1988, the 2026 reforms strengthen them. Organisations must respond faster, provide information in a usable format, and justify any refusal in writing.

Key Obligations for Businesses

If you run a business in Australia or handle Australian customers' data, the 2026 Act introduces several obligations you cannot afford to ignore.

Fair and Reasonable Test

All collection, use, and disclosure of personal information must now be "fair and reasonable in the circumstances," even where the individual has consented. This is a substantive test, not just a procedural one, and shifts the burden onto organisations to justify their data practices.

Privacy Impact Assessments

High-risk activities — such as large-scale biometric processing, surveillance, or AI-driven decision-making — require documented Privacy Impact Assessments (PIAs) before they can proceed.

Mandatory Breach Notification

The notifiable data breach scheme has been expanded. Breaches must be reported to the Office of the Australian Information Commissioner (OAIC) within 72 hours of becoming aware, with affected individuals notified promptly thereafter.

Small Business Exemption Narrowed

The long-standing exemption for small businesses with turnover under A$3 million is being progressively wound back. Businesses that trade in personal information, provide services to government, or handle sensitive data are now covered regardless of size.

Penalties Under the New Act

The penalty regime has been significantly strengthened to deter poor privacy practices.

Breach Type	Maximum Penalty (Corporations)	Maximum Penalty (Individuals)
Serious or repeated interference with privacy	Greater of A$50 million, 3x benefit obtained, or 30% of adjusted turnover	A$2.5 million
Mid-tier contraventions	Up to A$3.3 million	A$660,000
Administrative breaches	Up to A$330,000	A$66,000
Failure to notify eligible data breach	Up to A$660,000	A$132,000

These penalties are among the highest in the Asia-Pacific region and signal that regulators expect privacy compliance to be taken seriously at board level.

How the Act Compares to GDPR

Many Australian businesses already deal with the European GDPR when serving overseas customers. The 2026 reforms narrow the gap between the two frameworks, though important differences remain.

Feature	Australia Privacy Act 2026	EU GDPR
Right to erasure	Yes (with exceptions)	Yes
Right to data portability	Limited (sector-specific via CDR)	Yes (general right)
Fair and reasonable test	Yes	Lawful basis required
Max fine (corporate)	A$50M / 30% turnover	€20M / 4% turnover
Statutory tort for privacy breach	Yes	Via national laws
Small business exemption	Being phased out	No exemption

Practical Steps to Protect Your Privacy

Even with stronger laws, personal responsibility for digital hygiene remains important. Here are practical actions every Australian can take.

1. Audit Your Digital Footprint

Request copies of the personal information held by major services you use. Delete accounts you no longer need and remove unnecessary data from active accounts.

2. Use Privacy-Respecting Tools

Choose services that minimise data collection by design. For example, when sharing links on social media, email, or messaging apps, use a privacy-first URL shortener like Lunyb that doesn't harvest click data or build advertising profiles from your audience. You can read more in our honest review of Lunyb.

3. Enable Strong Authentication

Turn on multi-factor authentication on every account that supports it. Use a reputable password manager so each service has a unique, strong password.

4. Review App Permissions Regularly

Mobile apps often request far more access than they need. Revoke permissions for location, contacts, microphone, and camera where they aren't essential.

5. Encrypt Where Possible

Use encrypted messaging apps, enable full-disk encryption on your devices, and consider encrypted DNS services to prevent your internet service provider from logging your browsing history.

6. Exercise Your Rights

If you suspect an organisation has mishandled your information, submit a formal complaint to them first. If unresolved after 30 days, escalate to the OAIC.

How to Make a Privacy Complaint

The OAIC provides a free complaints process. The typical path is:

1. Contact the organisation in writing and ask them to resolve the issue.
2. Allow them 30 days to respond substantively.
3. If unsatisfied, lodge a complaint via the OAIC's online form at oaic.gov.au.
4. The OAIC may conciliate, investigate, or make a determination that includes compensation.
5. If the matter involves a serious invasion of privacy, you may also commence civil proceedings in the Federal Court.

What Businesses Should Do Now

Compliance is not a one-off project. Organisations should treat privacy as an ongoing governance function.

• Appoint a Privacy Officer with real authority and board-level reporting.
• Map your data flows so you know what you collect, where it is stored, and who has access.
• Update your privacy policy to reflect the new rights and the fair-and-reasonable test.
• Train staff on the new obligations, especially customer-facing teams who handle access and deletion requests.
• Review vendor contracts to ensure third parties meet their obligations under the Act.
• Test your breach response plan against the 72-hour notification clock.

The Bigger Picture: Privacy as a Human Right

The Australia Privacy Act 2026 reflects a broader global recognition that privacy is not a luxury but a fundamental human right in the digital age. As AI, biometrics, and ubiquitous surveillance become more entrenched, having a legal framework that empowers individuals and constrains the powerful matters more than ever. The reforms won't solve every privacy problem overnight, but they give Australians real tools — and real remedies — for the first time in a generation.

Frequently Asked Questions

When does the Australia Privacy Act 2026 fully take effect?

The reforms are being implemented in tranches. Some provisions, including increased penalties, took effect in late 2022. The second tranche — covering the statutory tort, children's code, automated decision rights, and the fair-and-reasonable test — is rolling out through 2025 and 2026, with certain obligations having transitional periods of up to 24 months for businesses to prepare.

Does the Privacy Act apply to overseas companies serving Australians?

Yes. The Act has extraterritorial reach. Any organisation with an "Australian link" — including overseas businesses that collect or hold personal information of Australians — must comply, even if they have no physical presence in Australia.

Can I sue someone directly for invading my privacy?

Under the new statutory tort, yes. If you can show a serious invasion of privacy committed intentionally or recklessly, and that your interest in privacy outweighs any countervailing public interest, you can bring an action in the Federal Court or state supreme courts without needing to go through the OAIC first.

What counts as "personal information" under the Act?

Personal information is any information or opinion about an identified individual, or an individual who is reasonably identifiable. The 2026 reforms clarify that this includes technical identifiers such as IP addresses, device IDs, and inferred data (like interest profiles), bringing Australia closer to the GDPR definition.

How can small businesses prepare if the exemption is being phased out?

Small businesses should start by appointing someone responsible for privacy, mapping what personal information they collect, updating privacy policies, and reviewing cybersecurity basics like MFA, encrypted backups, and staff training. The OAIC publishes free compliance guides tailored for small businesses, and starting early will avoid a rushed response when the exemption is removed.