Australia Privacy Act 2026: Your Rights Explained

The Australia Privacy Act 2026 represents the most significant overhaul of Australian privacy law in nearly four decades. Following years of consultation, the Albanese government's reforms modernise the Privacy Act 1988 to align with global standards like the EU's GDPR, give individuals stronger rights over their personal information, and impose tougher penalties on businesses that mishandle data.

Whether you're an Australian consumer wanting to understand your new rights, or a business owner trying to stay compliant, this guide explains everything you need to know about the 2026 reforms in plain English.

What Is the Australia Privacy Act 2026?

The Australia Privacy Act 2026 is the latest tranche of amendments to the Privacy Act 1988, building on the Privacy and Other Legislation Amendment Act 2024. It introduces a statutory tort for serious invasions of privacy, expands individual rights, and strengthens enforcement powers for the Office of the Australian Information Commissioner (OAIC).

The reforms apply to most Australian businesses with an annual turnover above $3 million, all federal government agencies, health service providers, and certain small businesses that trade in personal information. Importantly, several provisions extend protections to all Australians regardless of which entity handles their data.

Why the Reforms Were Needed

The original Privacy Act dates back to 1988, when the internet was barely a public concept. High-profile data breaches at Optus, Medibank, and Latitude Financial exposed millions of Australians' sensitive information and made it clear the existing framework was no longer fit for purpose. The 2026 reforms aim to:

Give individuals meaningful control over their personal data
Hold organisations accountable for poor security practices
Align Australia with international privacy standards
Address risks from emerging technologies like AI and automated decision-making
Provide stronger remedies when privacy is breached

Your New Rights Under the Privacy Act 2026

The most exciting part of the 2026 reforms for everyday Australians is the expansion of individual rights. Here's what you can now do.

1. The Right to Erasure

Often called the "right to be forgotten," this allows you to request that an organisation delete your personal information in certain circumstances — for example, when the data is no longer needed for the purpose it was collected, when you withdraw consent, or when the information was collected unlawfully. Organisations must respond within 30 days.

2. The Right to Object to Direct Marketing

You now have an absolute right to opt out of direct marketing, including profiling related to marketing. Businesses must provide a simple, free, and easily accessible mechanism to unsubscribe — and they must honour the request immediately.

3. The Right to Information About Automated Decisions

If a business uses automated decision-making (such as AI algorithms) to make decisions that significantly affect you — like loan approvals, insurance pricing, or job applications — you have the right to:

Be told that automated decision-making is being used
Understand the kinds of personal information involved
Request a human review of the decision

4. The Statutory Tort for Serious Invasions of Privacy

Perhaps the most powerful new right: Australians can now sue for serious invasions of privacy, including intrusion upon seclusion (such as stalking or unauthorised surveillance) and misuse of private information. Courts can award damages up to $478,550 for non-economic loss, plus aggravated damages.

5. Children's Online Privacy Code

A new mandatory Children's Online Privacy Code requires social media platforms, gaming services, and other online services likely to be accessed by children to apply privacy-by-default settings and limit data collection from users under 18.

Key Obligations for Businesses

If you run a business that handles personal information, the 2026 reforms significantly raise the compliance bar. Here's a summary of major new obligations.

Obligation	What It Means	Who It Applies To
Fair and Reasonable Test	All collection, use, and disclosure of personal data must be "fair and reasonable in the circumstances" — beyond just having consent	All APP entities
Privacy Impact Assessments	Mandatory PIAs for high-privacy-risk activities	Government agencies and large businesses
Data Breach Notification	Notify OAIC within 72 hours of becoming aware of an eligible breach	All APP entities
Privacy by Design	Embed privacy protections into systems and processes from the outset	All APP entities
Senior Privacy Officer	Appoint a designated privacy officer responsible for compliance	Medium and large businesses
Children's Code Compliance	Apply enhanced protections for users under 18	Online services accessible to children

Penalties for Non-Compliance

The 2026 reforms maintain the tougher penalty regime introduced in 2022, with maximum penalties for serious or repeated interferences with privacy now reaching:

$50 million, or
Three times the value of the benefit obtained from the misuse of information, or
30% of the company's adjusted turnover during the breach period

For mid-tier breaches, fines of up to $3.3 million apply, and the OAIC can now issue infringement notices for low-level breaches without going to court.

How the Privacy Act 2026 Compares Internationally

One goal of the reforms is to bring Australia closer to international standards. Here's how it stacks up.

Right or Feature	Australia 2026	EU GDPR	California CCPA
Right to erasure	Yes (limited)	Yes	Yes
Right to data portability	Limited (sector-based)	Yes	Yes
Right to object to automated decisions	Yes	Yes	Limited
Private right of action	Yes (statutory tort)	Yes	Limited
Maximum fines	$50M / 30% turnover	€20M / 4% turnover	$7,500 per violation
Breach notification window	72 hours	72 hours	Without unreasonable delay

While Australia hasn't gone as far as the GDPR on data portability or explicit consent thresholds, the reforms represent a substantial step forward — particularly with the introduction of a private right of action through the statutory tort.

What Personal Information Is Protected?

The definition of "personal information" has been clarified and expanded under the 2026 Act. It now explicitly includes:

Technical identifiers like IP addresses, device IDs, and cookies (where linkable to an individual)
Location data from mobile devices
Biometric information used for identification
Inferences drawn about you from other data (such as profiling)
Genetic information

"Sensitive information" — which receives extra protection — continues to cover health data, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, criminal records, and trade union membership, with new additions for genomic data.

How to Exercise Your New Rights

Knowing your rights is one thing; using them is another. Here's a practical step-by-step process for exercising your rights under the Privacy Act 2026.

Identify the entity holding your data. This could be a specific business, government agency, or platform.
Find their privacy policy. Every APP entity must publish a clear, accessible privacy policy that explains how to contact them about privacy matters.
Submit a written request. Specify whether you're requesting access, correction, erasure, or another right. Keep a copy of your request.
Wait for a response. Organisations generally have 30 days to respond. Most simple requests must be handled free of charge.
Escalate to the OAIC if needed. If you're unhappy with the response (or get no response), you can lodge a complaint with the Office of the Australian Information Commissioner at oaic.gov.au.
Consider legal action. For serious invasions of privacy, you may have grounds for a direct claim under the new statutory tort.

Practical Steps to Protect Your Privacy Today

While the law gives you stronger rights, the best privacy protection is still prevention. Here are practical steps every Australian should take in 2026.

Audit Your Digital Footprint

Search your name, email address, and phone number to see what's publicly available. Use tools like Have I Been Pwned to check if your details appear in known data breaches.

Minimise Data Sharing

When signing up for services, only provide information that's genuinely necessary. Use email aliases for marketing signups, and be cautious about granting apps access to contacts, location, or photos.

Use Privacy-Respecting Tools

Choose products and services that are transparent about their data practices. For example, when sharing links online, consider using a privacy-focused URL shortener like Lunyb, which lets you share short, branded links without exposing your full destination URLs or your audience to invasive third-party tracking. You can read our honest review of Lunyb or compare it against alternatives in our 2026 buyer's guide.

Enable Strong Authentication

Turn on multi-factor authentication (MFA) on every account that supports it. Use a reputable password manager to generate unique passwords for each service.

Review App and Account Permissions

At least twice a year, review the permissions granted to apps on your phone and the third-party apps connected to your Google, Facebook, and Apple accounts. Revoke anything you don't actively use.

What This Means for Small Businesses

The traditional small business exemption (for businesses with turnover under $3 million) has been narrowed under the 2026 reforms. Several categories of small business now fall under the Act regardless of turnover, including those that:

Trade in personal information (buying or selling data)
Provide services to the Commonwealth
Operate residential tenancy databases
Handle biometric data
Use facial recognition technology

Even exempt small businesses face market pressure to demonstrate good privacy practices. Customers, B2B partners, and insurers increasingly expect privacy compliance as a baseline.

Timeline and What Comes Next

The Privacy Act 2026 reforms are being implemented in stages throughout 2026 and 2027. Key dates to be aware of include phased commencement of the statutory tort, the Children's Online Privacy Code consultation, and the rollout of new OAIC enforcement powers. The OAIC is publishing detailed guidance, and businesses should monitor oaic.gov.au regularly.

Further reforms are expected, including potential introduction of a fully GDPR-style data portability right and additional protections for employee records — which remain partially exempt under current law.

Frequently Asked Questions

Does the Australia Privacy Act 2026 apply to overseas companies?

Yes. The Act applies to any foreign organisation that carries on business in Australia and collects or holds personal information of Australians. This includes global tech platforms, e-commerce sites, and SaaS providers. Foreign companies can be fined under Australian law and pursued through international cooperation arrangements.

Can I sue a company directly for a privacy breach?

Yes — this is one of the biggest changes. The new statutory tort for serious invasions of privacy gives Australians a direct right to sue for intentional or reckless breaches that cause serious harm. Previously, individuals could only complain to the OAIC and rely on the Commissioner to take action.

How long do organisations have to respond to my privacy request?

Generally, 30 days from when they receive your request. They must respond in writing and explain any refusal. If they need more time for complex requests, they must tell you and explain why. If they don't respond, you can lodge a complaint with the OAIC.

What's the difference between personal and sensitive information?

Personal information is any information that identifies or can identify you. Sensitive information is a subset that includes health data, racial origin, political opinions, religious beliefs, sexual orientation, biometrics, and genetic data. Sensitive information requires explicit consent to collect and has stronger handling rules.

What should I do if my data is exposed in a breach?

First, change any compromised passwords and enable MFA on affected accounts. Monitor your bank and credit accounts for unusual activity, and consider placing a credit ban with credit bureaus like Equifax or illion. Keep documentation — under the new statutory tort, if you suffer serious harm from a negligent breach, you may have grounds for a legal claim.

Final Thoughts

The Australia Privacy Act 2026 marks a genuine turning point in how personal information is handled in this country. For individuals, it delivers long-overdue rights — including the ability to demand erasure, challenge automated decisions, and seek damages for serious invasions of privacy. For businesses, it raises the stakes considerably, with hefty fines and a clear expectation that privacy must be designed into products and processes from day one.

The best response — whether you're a consumer or a business owner — is to treat privacy as a feature, not a chore. Understand your rights, choose tools that respect your data, and build habits that minimise unnecessary exposure. In a world of increasingly sophisticated data threats, the Australians who thrive will be those who take their digital privacy seriously.