Australia Privacy Act 2026: Your Rights Explained

The Australian privacy landscape is undergoing its biggest shake-up in nearly four decades. The Australia Privacy Act 2026 reforms build on the staged amendments passed in late 2024 and bring Australian privacy law closer to global standards like the EU's GDPR. For individuals, that means stronger rights over your personal information. For businesses, it means tighter obligations, bigger fines, and far less room for error.

This guide breaks down what the Australia Privacy Act 2026 actually changes, what rights you now have as an Australian resident, and what organisations must do to stay compliant.

What Is the Australia Privacy Act 2026?

The Australia Privacy Act 2026 refers to the second and third tranches of reforms to the Privacy Act 1988, following the Privacy and Other Legislation Amendment Act 2024. These reforms expand the Australian Privacy Principles (APPs), introduce new individual rights, and strengthen the powers of the Office of the Australian Information Commissioner (OAIC).

In short, the Privacy Act 2026 modernises how personal information is collected, stored, used and disclosed in Australia. It affects almost every organisation with an annual turnover above $3 million, plus many smaller businesses handling sensitive data, children's information, or trading in personal information.

Why the Reforms Were Needed

The original Privacy Act was written in 1988, long before smartphones, social media, cloud storage or AI. High-profile breaches at Optus, Medibank, Latitude Financial and several government agencies exposed just how outdated the framework had become. The Attorney-General's Privacy Act Review Report made 116 recommendations, and the 2026 reforms implement a substantial portion of them.

Key Changes Introduced by the Privacy Act 2026

The reforms are extensive, but they cluster around five major themes: individual rights, business accountability, children's privacy, enforcement, and automated decision-making.

1. New individual rights, including the right to erasure and the right to object.
2. A statutory tort for serious invasions of privacy, allowing Australians to sue directly.
3. A Children's Online Privacy Code enforced by the OAIC.
4. Transparency requirements for automated decisions that significantly affect individuals.
5. Significantly higher penalties for serious or repeated interferences with privacy.

Your Rights Under the Australia Privacy Act 2026

If you live in Australia, the 2026 reforms give you meaningful new control over your personal information. Here is a breakdown of the rights you can now exercise.

1. The Right to Access Your Data

You can request a copy of all personal information an organisation holds about you. Organisations must respond within 30 days and provide the data in a usable format. This right existed before but is now broader, with clearer timeframes and fewer exemptions.

2. The Right to Correction

If your personal information is inaccurate, out of date, incomplete, irrelevant or misleading, you can require the organisation to correct it. They must also notify any third parties they shared the incorrect data with.

3. The Right to Erasure (Right to Be Forgotten)

This is a landmark change. You can now ask organisations to delete your personal information in defined circumstances, including when:

• The data is no longer necessary for the purpose it was collected.
• You withdraw consent and no other lawful basis applies.
• The information was collected from you as a child.
• The data has been unlawfully handled.

4. The Right to Object and De-index

You can object to certain uses of your personal information, including direct marketing and some forms of profiling. You can also request that search engines de-index results that contain outdated, inaccurate or excessive personal information about you.

5. The Right to Explanation of Automated Decisions

If an organisation uses automated systems (including AI) to make decisions that significantly affect you — such as loan approvals, insurance pricing, or job screening — you have the right to:

• Be told that an automated decision is being made.
• Receive a meaningful explanation of the logic involved.
• Request human review of the decision.

6. The Right to Sue for Serious Invasions of Privacy

For the first time, Australians have a statutory tort allowing them to bring court action for serious invasions of privacy. This covers intrusion upon seclusion (e.g. covert surveillance) and misuse of private information. Damages can include compensation for emotional distress.

Business Obligations Under the New Act

If you run a business or manage data in one, the compliance bar has moved sharply upward. Here are the core obligations you need to understand.

Fair and Reasonable Test

All collection, use and disclosure of personal information must now be "fair and reasonable in the circumstances," even if the individual has consented. Consent is no longer a shield for intrusive or unexpected data practices.

Updated Privacy Policies

Privacy policies must clearly disclose:

• Whether personal information is used in automated decision-making.
• The types of decisions that are automated.
• Overseas disclosures and the countries involved.
• How individuals can exercise their new rights.

Mandatory Data Breach Response

The Notifiable Data Breaches scheme has been strengthened. Organisations must notify affected individuals and the OAIC as soon as practicable, and in most cases within 72 hours of becoming aware of an eligible breach.

Security and Retention

APP 11 now expects "reasonable technical and organisational measures" aligned to the sensitivity and volume of data held. Indefinite data retention is effectively off the table — organisations must set and document retention periods.

Penalties and Enforcement

The OAIC has significantly expanded enforcement powers under the 2026 regime, including the ability to issue infringement notices without going to court for mid-tier breaches.

Breach Tier	Example	Maximum Penalty (Corporate)
Serious or repeated interference	Large-scale breach with inadequate safeguards	Greater of $50M, 3x benefit, or 30% of adjusted turnover
Mid-tier interference	Failure to comply with an APP causing harm	Up to $3.3M
Administrative breach	Non-compliant privacy policy	Up to $330,000 (infringement notice)

Children's Online Privacy Code

A dedicated Children's Online Privacy Code applies to services likely to be accessed by children under 18. Key requirements include:

• Default privacy-protective settings for child users.
• Prohibitions on targeted advertising to children.
• Restrictions on nudging children into weaker privacy settings.
• Age-appropriate transparency notices.

Platforms including social media, gaming services, and ed-tech providers are directly in scope.

How the Privacy Act 2026 Compares Internationally

Australia is converging — but not fully aligning — with other major privacy frameworks.

Feature	Australia 2026	EU GDPR	California CPRA
Right to erasure	Yes (limited grounds)	Yes	Yes
Right to sue individuals	Yes (statutory tort)	Yes	Limited
Automated decision transparency	Yes	Yes	Yes
Small business exemption	Narrowed	None	Threshold-based
Max corporate fine	Up to 30% of turnover	Up to 4% of turnover	Up to $7,500 per violation

Practical Steps to Protect Your Privacy as an Australian

The reforms give you real power, but exercising rights is only half the equation. Day-to-day digital hygiene still matters.

1. Audit your accounts. Delete services you no longer use and request erasure where possible.
2. Review app permissions on your phone every few months.
3. Use encrypted DNS and a privacy-focused browser such as Firefox or Brave to reduce tracking.
4. Turn on multi-factor authentication on email, banking and government services like myGov.
5. Be careful what you share in links. Long URLs often expose session tokens, email addresses, or tracking parameters. A privacy-respecting link shortener like Lunyb can strip tracking tails and give you a clean, shareable link without handing your audience's clicks to third-party ad networks. You can read more in our honest review of Lunyb.
6. Check breach databases like Have I Been Pwned to see if your data has leaked.

What Businesses Should Do Before Enforcement Begins

Most of the new obligations have transitional periods, but the OAIC has signalled that enforcement for the headline changes will begin promptly. A sensible compliance plan includes:

• Mapping all personal information flows, including overseas transfers.
• Updating privacy policies and collection notices.
• Building a workflow for erasure, correction and objection requests.
• Documenting the "fair and reasonable" basis for each major processing activity.
• Reviewing automated decision systems and preparing explanations.
• Training staff and appointing a privacy officer with clear authority.

If your marketing stack relies on tracking-heavy URLs, consider replacing them with privacy-respecting short links. Our 2026 buyer's guide to URL shorteners compares the main options for Australian businesses.

Common Myths About the Privacy Act 2026

"It only applies to big business."

False. The small business exemption has been narrowed. Many SMEs — including those handling health data, biometric data or children's data — are now covered regardless of turnover.

"Consent fixes everything."

No. The fair and reasonable test applies on top of consent. Dark patterns and bundled consents will not survive scrutiny.

"We're fine because our servers are offshore."

Offshoring does not reduce accountability. If you disclose personal information overseas, you remain responsible for how it is handled under APP 8.

FAQ: Australia Privacy Act 2026

When does the Australia Privacy Act 2026 take effect?

The reforms are being rolled out in tranches. Several obligations from the 2024 amendments are already in force, while the major new rights (erasure, statutory tort, automated decision transparency) commence through 2026 with transitional periods of 6–24 months for different provisions.

Can I sue a company directly for a privacy breach?

Yes. The new statutory tort for serious invasions of privacy allows individuals to take direct court action and seek damages, including for emotional distress, without needing the OAIC to act first.

Does the Privacy Act 2026 apply to small businesses?

In many cases, yes. The historic small business exemption has been significantly narrowed. Businesses dealing in personal information, handling sensitive or children's data, or providing certain digital services are covered regardless of turnover.

How do I request erasure of my personal information?

Contact the organisation's privacy officer in writing (email is fine), identify yourself, and specify the information you want erased. They must respond within 30 days. If they refuse or do not reply, you can escalate to the OAIC.

What should I do if a company ignores my privacy request?

Lodge a complaint with the Office of the Australian Information Commissioner at oaic.gov.au. The OAIC can investigate, mediate, issue determinations, and now impose infringement notices directly for many breaches.

Final Thoughts

The Australia Privacy Act 2026 is not just a compliance update — it is a cultural shift. For individuals, it finally delivers meaningful rights over how your personal data is handled. For organisations, it demands genuine accountability rather than box-ticking privacy notices.

Whether you are an Australian resident wanting to take control of your digital footprint, or a business leader preparing for the new rules, the time to act is now. Understand your rights, exercise them, and build privacy into every decision — before the OAIC does it for you.