Australia Privacy Act 2026: Your Rights Explained

The Australia Privacy Act 2026 marks the most significant shake-up of Australian data protection law in more than three decades. After years of consultation following the Attorney-General's Privacy Act Review Report, Australians now have stronger rights over their personal information, and organisations face tougher obligations and steeper penalties. This guide explains what has changed, what rights you have as an individual, and what businesses need to do to stay compliant.

What Is the Australia Privacy Act 2026?

The Australia Privacy Act 2026 is the updated version of the Privacy Act 1988, incorporating the second and third tranches of reforms passed by Federal Parliament. It modernises how personal information is collected, used, stored, disclosed, and destroyed by Australian government agencies and most private-sector organisations with an annual turnover above the small business threshold.

The reforms respond to a wave of high-profile Australian data breaches, evolving international standards such as the EU GDPR, and growing public concern about targeted advertising, artificial intelligence, and the trade in personal data. The Office of the Australian Information Commissioner (OAIC) has been given expanded enforcement powers and additional funding to police compliance.

Why the Act Was Updated

The original 1988 Act was written before smartphones, social media, biometric scanning, and generative AI existed. Key drivers behind the 2026 reforms include:

• Major breaches affecting millions of Australians across telecommunications, health, and financial services
• The rise of automated decision-making and AI profiling
• Alignment with global standards to support cross-border trade
• Public demand for meaningful control over personal data
• The removal of long-standing exemptions that left gaps in protection

Key Changes at a Glance

The Privacy Act 2026 introduces a broader definition of personal information, new individual rights, a statutory tort for serious invasions of privacy, and significantly higher penalties. Here is a quick comparison of the old and new frameworks.

Area	Privacy Act 1988 (pre-reform)	Privacy Act 2026
Definition of personal information	Information "about" an identified individual	Information "relating to" an identified or reasonably identifiable individual, expressly including technical data such as IP addresses and device IDs
Small business exemption	Applied to most businesses under $3m turnover	Phased out; most small businesses now covered
Right to erasure	No general right	Yes, with limited exceptions
Right to object to direct marketing	Limited	Strengthened, including a right to opt out of targeted advertising
Automated decision-making	Not specifically addressed	Transparency and contestation rights
Statutory tort for privacy invasion	None	Yes
Maximum civil penalty (serious breach)	$2.22m	Greater of $50m, 3x benefit obtained, or 30% of adjusted turnover

Your New Rights Under the Privacy Act 2026

Individuals now have a clearer, enforceable set of rights that closely resemble those found in the European Union's General Data Protection Regulation, but tailored to Australian conditions. Here is what you can now do.

1. Right to Access Your Information

You can ask any covered organisation what personal information it holds about you, why it holds it, who it has shared the information with, and how long it will keep it. Organisations must respond within 30 days and generally cannot charge a fee for a standard request.

2. Right to Correction

If your personal information is inaccurate, out-of-date, incomplete, irrelevant, or misleading, you can require the organisation to correct it. Where the information has been disclosed to third parties, the organisation must take reasonable steps to notify those recipients of the correction.

3. Right to Erasure (Right to Be Forgotten)

For the first time, Australians have a general right to have their personal information deleted. You can request erasure when:

1. The information is no longer necessary for the purpose it was collected
2. You withdraw consent that was the basis for processing
3. The information was collected or used unlawfully
4. You are a child (or the information was collected when you were a child) and you request removal

Exceptions apply for freedom of expression, legal claims, public health, and archival purposes.

4. Right to Object to Direct Marketing and Targeted Advertising

Organisations must offer a simple, free way to opt out of direct marketing. The reforms go further by giving Australians a specific right to object to targeted advertising based on tracking, profiling, or inferred characteristics. Trading in personal information for the purposes of targeted advertising to children is prohibited outright.

5. Rights Around Automated Decisions

If a decision that significantly affects you is made solely or substantially by an automated system, for example a loan approval, insurance quote, or job-application screener, you have the right to:

• Be told, upfront, that automated decision-making is being used
• Understand the kinds of information used and the logic involved
• Request human review of the decision

6. Right to Sue for Serious Invasions of Privacy

The new statutory tort allows individuals to sue directly for serious invasions of privacy, whether by intrusion upon seclusion (such as unlawful surveillance) or misuse of information. The plaintiff must show the invasion was intentional or reckless, serious, and that the public interest in privacy outweighs any countervailing interest such as journalism.

Who the Act Applies To

The Privacy Act 2026 applies to "APP entities", which now covers a much wider range of organisations than before. This includes:

• All Australian Government agencies
• Private-sector organisations with turnover above the threshold (which continues to be lowered)
• Health service providers of any size
• Businesses that trade in personal information
• Credit reporting bodies and credit providers
• Contracted service providers to the Commonwealth
• Foreign organisations that carry on business in Australia and collect personal information from Australians

The long-standing small business exemption is being phased out, meaning cafes, tradies, and single-operator online stores will progressively be brought within scope. The employee records exemption is also being narrowed so that workers gain most of the same rights as consumers.

Business Obligations Under the New Act

If you run an organisation covered by the Act, the 2026 reforms require you to move from a compliance mindset to a genuine accountability model. The key obligations are outlined below.

Fair and Reasonable Test

Every collection, use, and disclosure of personal information must now be "fair and reasonable in the circumstances", not just consented to. Consent alone is no longer enough if the underlying practice is unfair. Regulators will consider whether the individual would reasonably expect the handling, whether it is proportionate, and whether it causes harm.

Privacy Impact Assessments

PIAs are now mandatory for high-risk activities, including large-scale processing of sensitive information, use of biometrics, systematic monitoring, and deployment of AI systems that make significant decisions about individuals.

Data Breach Notification

The Notifiable Data Breaches scheme has been tightened. Organisations must notify the OAIC within 72 hours of becoming aware of an eligible data breach and notify affected individuals as soon as practicable. Failure to notify is itself a breach that can attract civil penalties.

Data Minimisation and Retention Limits

You must only collect what you actually need, and you must destroy or de-identify personal information once you no longer need it for a permitted purpose. Indefinite retention "just in case" is no longer defensible.

Cross-Border Disclosures

Sending personal information overseas now requires either the recipient to be subject to a law substantially similar to the Act, standard contractual clauses, or explicit informed consent. The OAIC will maintain a list of countries with recognised equivalent protection.

Penalties and Enforcement

The reforms give the Information Commissioner a proper enforcement toolkit for the first time. Penalties now sit at levels comparable to the ACCC's consumer law penalties.

Breach category	Maximum penalty (body corporate)
Serious or repeated interferences with privacy	Greater of $50m, 3x benefit, or 30% of adjusted turnover
Mid-tier interferences	Up to $3.3m
Administrative breaches (e.g. missed notification)	Up to $660,000 per breach
Infringement notices	Up to $66,000 per notice

The Commissioner can also issue compliance notices, accept enforceable undertakings, order compensation, and publish public warnings about non-compliant organisations.

How to Exercise Your Rights as an Individual

Enforcing your rights under the Privacy Act 2026 is designed to be free and relatively straightforward. Here is a practical process to follow.

1. Identify the organisation. Confirm who actually holds your information. Check privacy policies, receipts, and account settings.
2. Make a written request. Email or use the organisation's privacy portal. Specify which right you are exercising (access, correction, erasure, objection).
3. Wait up to 30 days. The organisation must respond, and any refusal must be justified with reference to a specific exception in the Act.
4. Escalate to the OAIC. If you are dissatisfied, lodge a complaint at oaic.gov.au. The Commissioner can conciliate, investigate, and make determinations, including awarding compensation.
5. Consider court action. For serious invasions of privacy, you can now sue directly under the new statutory tort.

Practical Steps to Protect Your Own Privacy

The Act gives you rights, but good digital hygiene remains your first line of defence. Consider adopting the following habits.

• Audit your accounts. Delete services you no longer use and request erasure of the underlying data.
• Use a password manager and multi-factor authentication. These dramatically reduce your exposure to credential-based breaches.
• Turn on encrypted DNS in your browser or operating system to reduce passive tracking by network operators.
• Use privacy-focused browsers that block cross-site trackers by default.
• Be careful with links. When sharing URLs on social media, forums, or in email campaigns, use a reputable link management tool such as Lunyb so that you control the destination, monitor for abuse, and avoid leaking sensitive query strings. For an honest look at how the platform handles data, see our Lunyb review.
• Read the collection notice. Under the new Act, notices must be genuinely clear. If you cannot understand it, that is a warning sign.

What the Act Means for Small Businesses

Small business owners are often the most anxious about the reforms. The good news is that the OAIC has committed to a staged rollout, guidance material, and a proportionate enforcement approach for genuine attempts to comply. Priorities for small operators should be:

1. Map what personal information you collect and why
2. Publish a plain-English privacy policy
3. Secure your systems (patching, backups, MFA)
4. Have a written data breach response plan
5. Train staff on handling access and deletion requests

Marketers running short links, QR codes, and campaign tracking should also review how much personal or device-level data their tools capture. Choosing platforms that publish clear data practices, and comparing them properly, matters more than ever. Our 2026 buyer's guide to URL shorteners and our Rebrandly review both examine data-handling questions in detail.

Children and the Privacy Act 2026

Children receive enhanced protection under the reforms. A binding Children's Online Privacy Code applies to online services likely to be accessed by minors. Key requirements include:

• Highest privacy settings on by default
• No targeted advertising to children based on profiling
• Age-appropriate transparency notices
• Restrictions on trading in children's personal information
• Special care with location data and biometrics

How Australia Compares Globally

With the 2026 reforms, Australia sits closer to Europe's GDPR than to the sector-by-sector approach used in the United States. Businesses that already comply with the GDPR, the UK Data Protection Act, or New Zealand's Privacy Act will find the transition relatively smooth. However, Australian-specific requirements around notifiable data breaches, the fair and reasonable test, and the statutory tort mean copy-paste compliance from another jurisdiction is not enough.

Frequently Asked Questions

When does the Australia Privacy Act 2026 take effect?

The reforms are being rolled out in stages, with core individual rights (access, correction, erasure, objection) and the higher penalty regime already in force. The full phase-out of the small business exemption and the Children's Online Privacy Code continue to be implemented across 2026 and into 2027. Check the OAIC website for the current commencement schedule.

Does the Privacy Act 2026 apply to overseas companies?

Yes. Any foreign organisation that carries on business in Australia and collects or holds personal information about Australians must comply, regardless of where its servers are located. This includes many global social media platforms, cloud providers, and e-commerce sites.

Can I be compensated if my data is misused?

Yes. The Information Commissioner can order organisations to pay compensation to individuals for financial loss and non-economic harm such as distress or humiliation. For serious invasions of privacy, you can also sue directly in court under the new statutory tort.

What is the difference between the Privacy Act and the Notifiable Data Breaches scheme?

The Notifiable Data Breaches scheme is part of the Privacy Act. It requires covered organisations to notify the OAIC and affected individuals when a data breach is likely to result in serious harm. The 2026 reforms tightened the timeframe to 72 hours and increased the penalties for failing to report.

Do employees have privacy rights against their employer?

Increasingly, yes. The broad employee records exemption is being narrowed, so workers now enjoy most of the same rights as consumers, including access, correction, and protections around workplace surveillance and automated decision-making. Employers should review their monitoring, HR analytics, and background-check practices.

Final Thoughts

The Australia Privacy Act 2026 rebalances the relationship between individuals and the organisations that hold their data. For Australians, that means real, enforceable rights and meaningful remedies. For organisations, it means treating personal information as a genuine responsibility rather than a free resource. Whether you are exercising your new right to erasure, redesigning a marketing funnel, or simply choosing safer tools to share links and content, the direction of travel is clear: privacy is now a first-class consideration in Australian digital life.