Australia Privacy Act 2026: Your Rights Explained

The Australia Privacy Act 2026 represents the most significant overhaul of Australian data protection law in decades. Following the staged reforms introduced through the Privacy and Other Legislation Amendment Act 2024, Australians now enjoy stronger individual rights, tougher penalties for businesses that mishandle personal information, and clearer obligations around automated decision-making and children's data. This guide explains what has changed, what your rights are, and what organisations must do to comply.

What is the Australia Privacy Act 2026?

The Australia Privacy Act 2026 refers to the current form of the Privacy Act 1988 (Cth) as amended by the 2024 reforms and subsequent 2025-2026 implementation tranches. It regulates how Australian Government agencies and most private sector organisations with an annual turnover of more than $3 million handle personal information. Smaller businesses that trade in personal data, provide health services, or contract to the Commonwealth are also covered.

The reforms respond to years of pressure following high-profile data breaches at Optus, Medibank, and Latitude Financial. The Attorney-General's Department, together with the Office of the Australian Information Commissioner (OAIC), has moved to bring Australia closer in line with the EU's General Data Protection Regulation (GDPR) while retaining a distinctly Australian framework centred on the 13 Australian Privacy Principles (APPs).

Key changes at a glance

A new statutory tort for serious invasions of privacy
Direct right of action for individuals in the Federal Court
Enhanced protections for children under 18 and the Children's Online Privacy Code
Transparency requirements for automated decision-making
Higher civil penalties, now up to $50 million or 30% of adjusted turnover
Expanded powers for the OAIC to investigate and issue infringement notices

Your Rights as an Australian Under the 2026 Reforms

The Privacy Act 2026 strengthens individual rights significantly. If you are an Australian resident, you now have a clearer, more enforceable set of entitlements when organisations collect and use your personal information.

1. The right to know

Organisations must tell you, at or before the time they collect your data, why they are collecting it, who they might share it with, and how you can access or correct it. Privacy notices must be clear, concise, and layered — no more burying critical disclosures on page 47 of a terms document.

2. The right of access and correction

You can request a copy of the personal information an organisation holds about you and require them to correct anything that is inaccurate, out-of-date, incomplete, or misleading. Under the 2026 rules, organisations must respond within 30 days in most cases and cannot charge excessive fees.

3. The right to erasure (the "right to be forgotten")

One of the most anticipated changes is a qualified right to have your personal information deleted where it is no longer necessary, was collected unlawfully, or where you withdraw consent. This right is not absolute — organisations can refuse where retention is required by law, for legal claims, or for public interest research — but it gives Australians a meaningful new tool.

4. The right to object to automated decisions

If a decision that significantly affects you (a loan approval, insurance premium, job screening) is made using automated processing, you have the right to be told, to receive meaningful information about how the decision was made, and to request human review.

5. The right to sue for serious invasions of privacy

The new statutory tort allows individuals to sue in the Federal Court where someone has intentionally or recklessly invaded their privacy in a way a reasonable person would consider serious. Damages of up to $478,550 (indexed) are available, plus aggravated damages in appropriate cases.

Who Does the Privacy Act 2026 Apply To?

The Act applies to "APP entities," which includes Australian Government agencies and organisations with an annual turnover above $3 million. The small business exemption, long criticised by privacy advocates, has been progressively narrowed and is expected to be removed entirely for businesses handling significant volumes of personal data.

Businesses that must comply regardless of size

Health service providers (including allied health, gyms with health data, and telehealth platforms)
Businesses that buy or sell personal information
Credit reporting bodies and credit providers
Residential tenancy databases
Contracted service providers to the Commonwealth
Businesses related to APP entities

Extraterritorial reach

The Act also applies to overseas organisations that carry on business in Australia and collect personal information from Australians — regardless of whether the data is stored offshore. This mirrors the GDPR's approach and captures major global platforms.

Penalties: What Happens When Organisations Get It Wrong

The financial consequences of non-compliance have escalated dramatically. Under the previous regime, maximum penalties sat at $2.22 million. The 2026 framework introduces a tiered penalty structure.

Breach Type	Maximum Penalty (Body Corporate)	Maximum Penalty (Individual)
Serious or repeated interference with privacy	The greater of $50 million, 3x the benefit obtained, or 30% of adjusted turnover	$2.5 million
Mid-tier civil penalty (interference with privacy)	$3.3 million	$660,000
Low-tier infringement (administrative breaches)	$330,000	$66,000
Infringement notice (on-the-spot)	$66,000	$13,320

The OAIC now has the power to issue infringement notices without going to court, conduct public inquiries, and make binding determinations that can be enforced in the Federal Court.

The Notifiable Data Breaches Scheme in 2026

The Notifiable Data Breaches (NDB) scheme requires organisations to notify affected individuals and the OAIC when a data breach is likely to result in serious harm. The 2026 reforms have tightened the process.

Assessment period reduced — organisations must assess suspected breaches within 30 days (previously interpreted more loosely).
72-hour notification — once a breach is confirmed as notifiable, the OAIC must be told within 72 hours.
Content requirements — notifications must include specific details about what data was affected, the likely consequences, and the steps individuals should take.
Public register — the OAIC now maintains a public register of significant breaches, increasing reputational stakes.

Children's Privacy: New Protections

A dedicated Children's Online Privacy Code, developed by the OAIC, applies to services likely to be accessed by children. It draws heavily from the UK's Age Appropriate Design Code and imposes obligations such as:

Default high-privacy settings for users under 18
Prohibitions on nudging children into weaker privacy choices
Restrictions on targeted advertising to minors
Data minimisation and age-appropriate transparency
Prohibition on trading in children's personal information

Social media platforms, gaming services, and educational technology providers are the primary focus, but any online service accessible to under-18s should assess its exposure.

Practical Steps to Protect Your Privacy

While the law has improved, personal vigilance remains essential. Here are practical measures every Australian should consider.

1. Audit what you share

Before signing up to a new service, ask whether it really needs your date of birth, phone number, or address. If it doesn't, don't provide it. Use secondary email addresses for non-essential sign-ups.

2. Use privacy-respecting tools

When sharing links — whether in marketing emails, social posts, or business communications — use a link management service that doesn't harvest excessive data on your audience. Lunyb is one option that offers URL shortening with a privacy-forward approach, avoiding the aggressive tracking pixels used by some competitors. If you're comparing services, our 2026 URL shortener buyer's guide walks through what to look for.

3. Exercise your access rights

Send an access request to any organisation you suspect holds significant data on you — banks, telcos, insurers, loyalty programs. You may be surprised what's on file. This is also an opportunity to request corrections or, where applicable, deletion.

4. Enable multi-factor authentication

The Optus and Medibank breaches showed how attackers exploit reused passwords. Enable multi-factor authentication (MFA) on email, banking, and government services (myGov supports it) and use a password manager to generate unique passwords.

5. Watch for automated decisions

If you're denied credit, insurance, or a job and suspect automated processing was involved, ask the organisation directly. Under the 2026 rules, they must explain their process and offer human review.

What Businesses Need to Do Now

If you run a business handling Australian personal data, the compliance clock is ticking. Here's a prioritised action list.

Immediate priorities

Data mapping — know what personal information you hold, where it lives, who has access, and why you have it.
Update privacy policies and collection notices — ensure they are layered, plain-English, and cover automated decision-making and overseas disclosures.
Appoint a Privacy Officer — while not strictly mandatory for all entities, having a nominated contact is now considered baseline practice.
Review vendor contracts — cloud providers, marketing platforms, and analytics tools must have adequate contractual protections.
Test your data breach response plan — tabletop exercises with real 72-hour clocks are essential.

Medium-term projects

Implement data minimisation across collection forms
Build technical capability to respond to erasure and portability requests
Assess automated decision-making systems and document their logic
Train staff on the updated APPs and breach response
Consider Privacy Impact Assessments for new products

How Australia Compares Internationally

The 2026 reforms narrow the gap between Australia and other advanced privacy jurisdictions, though differences remain.

Feature	Australia 2026	EU GDPR	California CCPA/CPRA
Right to erasure	Yes (qualified)	Yes	Yes
Direct right of action	Yes	Yes	Limited (breach only)
Data portability	Partial (Consumer Data Right)	Yes	Yes
Maximum fine	$50M or 30% turnover	€20M or 4% turnover	US$7,500 per violation
Small business exemption	Narrowing	None	Threshold-based
Children's code	Yes (2026)	Yes (Article 8)	Yes (specific provisions)

Looking Ahead: What's Still to Come

Not every reform proposal made it into the current Act. Further tranches of amendments are expected to address:

Full removal of the small business exemption
Introduction of a general "fair and reasonable" test for data handling
Enhanced data portability beyond the Consumer Data Right sectors
Statutory obligations around AI training data
Sector-specific codes for retail, financial services, and telecommunications

Businesses that treat privacy as a competitive advantage — rather than a compliance burden — will be best placed as these reforms roll out.

Frequently Asked Questions

When does the Australia Privacy Act 2026 take effect?

The reforms are being implemented in tranches. Many first-tranche provisions (including higher penalties and the statutory tort) commenced during 2024 and 2025. Second-tranche measures, including elements of automated decision-making transparency and the Children's Online Privacy Code, are rolling out through 2026. Check the OAIC website for the current commencement schedule.

Can I sue a company directly for a privacy breach?

Yes. The 2026 reforms introduce both a direct right of action under the Privacy Act (after first complaining to the OAIC) and a separate statutory tort for serious invasions of privacy that can be pursued directly in the Federal Court. Damages, including for non-economic loss like distress, are available.

Does the Privacy Act apply to overseas companies?

Yes, if they carry on business in Australia and collect personal information from Australians. This captures most major global platforms — social media, e-commerce, cloud services — even if their servers and headquarters are offshore.

What should I do if I think my data has been breached?

First, secure your accounts by changing passwords and enabling multi-factor authentication. If the organisation has notified you, follow their guidance. Consider placing a credit ban with the credit reporting bodies (Equifax, Experian, illion) if identity data was exposed. If you're not satisfied with the organisation's response, you can complain to the OAIC.

Are small businesses exempt from the Privacy Act?

The small business exemption (for businesses under $3 million turnover) still exists but is narrowing. Even small businesses must comply if they handle health information, trade in personal data, provide services under Commonwealth contracts, or are related to a larger APP entity. The exemption is expected to be phased out in future tranches.

How can I make an access or deletion request?

Write to the organisation's Privacy Officer (their privacy policy should list contact details) and clearly state that you are making a request under the Australian Privacy Principles. Specify whether you want access, correction, or erasure, and provide enough information to verify your identity. They generally have 30 days to respond.