Australia Privacy Act 2026: Your Rights Explained

The Australia Privacy Act 2026 represents the most significant overhaul of Australian privacy law in over three decades. Following years of consultation, the Albanese Government's reforms to the Privacy Act 1988 are now reshaping how organisations collect, use, store, and share personal information about Australians. Whether you're a consumer wanting to understand your new rights or a business trying to stay compliant, this guide explains what's changed, what's coming next, and what it means for you.

What Is the Australia Privacy Act 2026?

The Australia Privacy Act 2026 refers to the suite of amendments introduced through the Privacy and Other Legislation Amendment Act 2024 and subsequent tranches that took effect through 2025 and into 2026. These reforms modernise the original Privacy Act 1988 to address the realities of cloud computing, artificial intelligence, large-scale data breaches, and cross-border data flows.

The reforms were largely driven by a series of high-profile incidents — including the Optus, Medibank, and Latitude Financial breaches — that exposed the personal data of millions of Australians and revealed significant gaps in the existing framework. Recommendations from the Attorney-General's Privacy Act Review Report (2022) form the backbone of the changes.

Who the Act Applies To

The Privacy Act 2026 applies to:

• Australian Government agencies
• Private sector organisations with an annual turnover of more than $3 million (the small business exemption is being phased out under later tranches)
• Health service providers of all sizes
• Organisations that trade in personal information
• Credit reporting bodies and credit providers
• Foreign entities that carry on business in Australia and collect personal information from Australians

Key Changes Introduced in 2026

The reforms are being rolled out in tranches. The 2026 landscape reflects measures that are now in force, along with several that organisations must prepare for over the following 12 to 24 months.

1. A New Statutory Tort for Serious Invasions of Privacy

For the first time, Australians can sue directly for serious invasions of privacy. This statutory tort covers both intrusion upon seclusion (such as unauthorised surveillance) and misuse of private information. To succeed, a claimant must show the invasion was intentional or reckless, serious, and that the public interest in privacy outweighs any countervailing public interest.

2. Children's Online Privacy Code

A mandatory Children's Online Privacy Code is being developed by the Office of the Australian Information Commissioner (OAIC). Platforms likely to be accessed by children must implement age-appropriate design, default high-privacy settings, and restrictions on profiling minors.

3. Automated Decision-Making Transparency

Organisations using automated systems — including AI — to make decisions that significantly affect individuals must disclose this in their privacy policies. From 2026, privacy policies must explain the kinds of personal information used and the nature of decisions made.

4. Higher Penalties and Enforcement Powers

Maximum penalties for serious or repeated interferences with privacy have increased dramatically. Corporations now face fines of up to the greater of $50 million, three times the benefit obtained, or 30% of adjusted turnover during the breach period. The OAIC has also been granted new infringement notice powers for less serious breaches.

5. Mandatory Notifiable Data Breach Improvements

The Notifiable Data Breaches (NDB) scheme has been strengthened with tighter notification timeframes and clearer guidance on what constitutes serious harm. Entities must also publish information about breaches to affected individuals in plain language.

Your Rights as an Australian Under the New Act

The reforms significantly expand the rights Australians can exercise over their personal information. Understanding these rights is the first step to protecting your data.

The Right to Access Your Data

You can request access to the personal information an organisation holds about you. Organisations must respond within 30 days and generally cannot charge for the request. Refusals must be justified under specific exemptions.

The Right to Correction

If your personal information is inaccurate, out of date, incomplete, irrelevant, or misleading, you can demand it be corrected. Organisations must take reasonable steps to notify third parties they've shared the information with.

The Right to Erasure (Emerging)

The introduction of a broader "right to erasure" — similar to the GDPR's right to be forgotten — is part of the reform agenda for 2026 and beyond. While not yet fully in force as a general right, individuals can already request deletion in specific circumstances, particularly when information was collected unlawfully or is no longer needed.

The Right to De-Index

You can request that search engines remove links to information about you that is inaccurate, out of date, irrelevant, or otherwise excessive — particularly if it relates to a sensitive matter.

The Right to Object to Direct Marketing

Australians can opt out of direct marketing at any time, including profiling for marketing purposes. Organisations must make opt-out mechanisms simple and prominent.

The Right to Sue

Through the new statutory tort, you can take direct legal action when your privacy has been seriously invaded — without needing to wait for the OAIC to act.

Comparing the Old and New Privacy Frameworks

The table below summarises the most important differences between the pre-reform Privacy Act and the 2026 landscape.

Area	Pre-Reform Privacy Act	Privacy Act 2026
Maximum corporate penalty	$2.22 million	Up to $50M / 3x benefit / 30% turnover
Right to sue	No direct cause of action	Statutory tort for serious invasions
Children's privacy	General principles only	Dedicated Children's Online Privacy Code
Automated decision-making	No specific rules	Mandatory transparency in policies
Small business exemption	Broad exemption under $3M turnover	Being phased out
OAIC powers	Limited enforcement tools	Infringement notices, expanded audits
Right to erasure	Not recognised	Emerging in specific cases

What Businesses Must Do to Comply

Compliance under the new Act requires more than a refreshed privacy policy. Here's a practical roadmap for organisations operating in Australia.

1. Map your data. Identify what personal information you collect, where it's stored, who has access, and how long you keep it.
2. Update your privacy policy. Include details about automated decision-making, overseas disclosures, and how individuals can exercise their new rights.
3. Strengthen security. Implement multi-factor authentication, encryption at rest and in transit, role-based access, and continuous monitoring.
4. Review third-party arrangements. Audit vendors, processors, and overseas recipients for compliance with Australian Privacy Principles (APPs).
5. Train staff. Privacy awareness training is now an expectation, not a nice-to-have.
6. Prepare a breach response plan. Document who does what within the first 72 hours of detecting an incident.
7. Conduct Privacy Impact Assessments (PIAs). Especially for high-risk processing, including AI and large-scale profiling.

Special Considerations for Marketers and Link Sharing

Marketers should be especially careful about tracking, profiling, and link-based analytics. If you use shortened URLs in campaigns, choose a provider that is transparent about analytics, doesn't sell click data, and provides clear privacy controls. Privacy-respecting tools like Lunyb let you shorten and share links with sensible defaults — useful when complying with the new transparency expectations. For a deeper look at how Lunyb compares with alternatives, see our Best URL Shorteners Reviewed and Compared: 2026 Buyer's Guide.

How the Act Affects Everyday Australians

Beyond the legal text, the reforms produce tangible benefits in daily life.

More Control Over Your Digital Footprint

You'll find it easier to request data, correct inaccuracies, and remove yourself from marketing lists. Privacy notices must be clearer, shorter, and more accessible — including in mobile-first contexts.

Better Protection from Data Breaches

Stronger penalties and OAIC enforcement create real incentives for organisations to invest in cyber security. You should receive faster, clearer breach notifications when something goes wrong.

Greater Protection for Children

Children using social media, gaming, and educational platforms benefit from default privacy settings, restrictions on targeted advertising, and stricter consent rules.

Recourse When Things Go Wrong

If a stalker tracks you online, a former partner posts intimate images, or a company misuses your data, you now have a direct path to the courts through the statutory tort — in addition to OAIC complaints.

Cross-Border Data Transfers Under the 2026 Reforms

APP 8 has been clarified to make organisations more accountable for what happens to personal information sent overseas. Before transferring data internationally, you must take reasonable steps to ensure the recipient handles it consistently with Australian standards — or rely on a narrow exception. The OAIC is also working on a mechanism to whitelist countries with substantially similar privacy protections, which would simplify compliance.

Practical Steps for Australian Consumers

• Use encrypted messaging apps for sensitive conversations.
• Enable two-factor authentication on important accounts.
• Review the permissions you've granted to apps and revoke unnecessary access.
• Request a copy of your data from key service providers once a year.
• Be cautious about which links you click and use trustworthy link shorteners — read our review on whether Lunyb is legit for an example of evaluating providers.
• Use a private DNS resolver and privacy-focused browser settings to limit tracking.

Enforcement: How the OAIC Will Act

The OAIC has signalled a more assertive enforcement posture. Expect to see:

1. More own-motion investigations triggered by media reports or breach notifications.
2. Greater use of civil penalty proceedings in the Federal Court.
3. Public determinations naming non-compliant organisations.
4. Closer co-operation with the ACCC, ASIC, and overseas regulators.
5. Targeted compliance reviews of high-risk sectors such as health, financial services, and online platforms.

Timeline: When Each Change Takes Effect

Timeframe	Reform
Late 2024	Initial tranche: higher penalties, OAIC powers, statutory tort framework
2025	Children's Online Privacy Code consultation; automated decision-making rules
2026	Statutory tort fully operational; transparency for ADM in privacy policies
2026–2027	Further tranches: small business exemption phase-out, expanded right to erasure

Frequently Asked Questions

1. Does the Privacy Act 2026 apply to small businesses?

For now, most businesses with an annual turnover under $3 million remain exempt, but this exemption is being phased out. Small businesses dealing in health information, trading personal data, or providing services to government already need to comply. All small businesses should start preparing now.

2. How do I make a privacy complaint?

First, raise the issue directly with the organisation. If you're unsatisfied with the response after 30 days, you can lodge a complaint with the Office of the Australian Information Commissioner (OAIC) via oaic.gov.au. Under the new statutory tort, you can also commence civil proceedings in the Federal Court.

3. What counts as a "serious invasion of privacy" under the new tort?

Examples include unauthorised surveillance, doxxing, publishing intimate images without consent, hacking into private accounts, and the large-scale misuse of personal information. The court considers seriousness, intent, distress caused, and whether public interest outweighs the privacy harm.

4. Will the new law affect how Australian websites use cookies and tracking?

Yes. While Australia doesn't yet require GDPR-style cookie banners, the reforms emphasise transparency, meaningful consent, and limits on profiling — especially of minors. Expect Australian websites to adopt clearer cookie controls and reduce reliance on opaque tracking technologies.

5. What penalties can my business face for non-compliance?

For serious or repeated interferences with privacy, corporate penalties can reach the greater of $50 million, three times the benefit gained, or 30% of adjusted turnover during the breach period. Individuals can also face penalties, and the OAIC can issue infringement notices for less serious contraventions.

Final Thoughts

The Australia Privacy Act 2026 marks a genuine shift in the balance of power between individuals and the organisations that hold their data. For consumers, it delivers stronger rights, clearer protections, and meaningful avenues for redress. For businesses, it raises the stakes — but also provides a much-needed framework for building trust in an increasingly data-driven economy.

The organisations that thrive will be those that treat privacy not as a compliance burden but as a competitive advantage. And for Australians, the message is clear: your data is yours, and the law now gives you more tools than ever to keep it that way.