Australia Privacy Act 2026: Your Rights Explained

The Australia Privacy Act 2026 marks the most significant overhaul of Australian privacy law in nearly four decades. Following years of consultation after the Attorney-General's Privacy Act Review, the reforms expand individual rights, tighten business obligations, and introduce European-style accountability measures. If you live, work, or run a business in Australia, these changes affect how your personal information is collected, used, stored, and shared.

This guide breaks down what the Privacy Act 2026 means for everyday Australians and small to medium businesses. We'll cover your new rights, the obligations placed on organisations, enforcement powers of the Office of the Australian Information Commissioner (OAIC), and practical steps you can take to protect your data today.

What Is the Australia Privacy Act 2026?

The Australia Privacy Act 2026 is a package of amendments to the original Privacy Act 1988 that modernises the framework for the digital economy. It builds on the 2023 Government Response to the Privacy Act Review, implementing the majority of the 116 proposed reforms in staged tranches.

The reforms sit alongside the Australian Privacy Principles (APPs) and apply to Australian Government agencies and most private sector organisations with an annual turnover above the small business threshold — a threshold that is itself being phased out under the new Act.

Key Goals of the Reform

• Strengthen individual control over personal information.
• Align Australia more closely with the EU's GDPR and other global standards.
• Expand enforcement powers and increase penalties for serious breaches.
• Address modern risks such as automated decision-making, targeted advertising, and children's data.

Your New Rights Under the Privacy Act 2026

The Act introduces or expands several individual rights that give Australians far greater say over how their personal information is handled. Here are the most important ones.

1. The Right to Erasure

You can now request that an organisation delete personal information it holds about you. Previously, Australians could only request correction. The right to erasure applies when the data is no longer necessary, when consent is withdrawn, or when the information was collected unlawfully. Organisations must respond within a reasonable timeframe and inform third parties they have shared your data with.

2. The Right to Object to Direct Marketing

You now have a clearer, enforceable right to opt out of direct marketing — including targeted online advertising based on your personal information. Businesses must provide a simple, free opt-out mechanism and honour it promptly.

3. The Right to De-Index Online Search Results

Modelled loosely on Europe's "right to be forgotten," Australians can request that search engines remove links to information that is inaccurate, out-of-date, irrelevant, or excessive. This is particularly important for individuals dealing with old news articles, revenge content, or outdated records.

4. The Right to Information About Automated Decisions

If an organisation uses automated decision-making — including AI systems — to make decisions that significantly affect you (such as loan approvals, insurance pricing, or employment screening), you have the right to:

1. Be told that automated decision-making is being used.
2. Receive meaningful information about how the decision was made.
3. Request human review in certain circumstances.

5. Enhanced Rights for Children

A new Children's Online Privacy Code places stricter obligations on services likely to be accessed by minors. Platforms must consider the best interests of the child, limit data collection, and apply high privacy defaults.

6. The Right to Sue for Serious Invasions of Privacy

Perhaps the most dramatic change: Australians now have a statutory tort for serious invasions of privacy. You can take direct legal action against individuals or organisations that intentionally or recklessly misuse your private information or intrude on your seclusion. Remedies include damages, injunctions, and apologies.

What Counts as Personal Information Now?

The definition of "personal information" has been expanded and clarified. It now explicitly covers technical identifiers such as IP addresses, device IDs, location data, and online identifiers where they relate to an identifiable individual.

This is a crucial shift. Under the old framework, there was legal ambiguity about whether things like cookies and tracking pixels counted as personal information. Under the Privacy Act 2026, there is little doubt — if it can be used to single you out, it's covered.

Business Obligations: What Organisations Must Do

The Act imposes a range of new duties on APP entities. Here's a summary comparison between the old and new frameworks.

Obligation	Privacy Act 1988 (Previous)	Privacy Act 2026
Small business exemption	Applied to businesses under $3M turnover	Being phased out
Fair and reasonable test	Not required	All collection, use and disclosure must be "fair and reasonable in the circumstances"
Privacy Impact Assessments	Required only for government	Required for high-risk activities across sectors
Data breach notification	Within 30 days where serious harm likely	Within 72 hours of awareness
Maximum penalty	$2.22M (pre-2022)	Up to $50M, 30% of adjusted turnover, or 3× benefit obtained
Right to erasure	Not available	Available in defined circumstances
Direct right of action	Complaint to OAIC only	Individuals can sue in Federal Court

The "Fair and Reasonable" Test

This is a cornerstone of the reforms. Even if a business obtains consent, the collection, use, or disclosure of personal information must be objectively fair and reasonable. Factors include whether the handling is proportionate, whether the individual would reasonably expect it, and the potential impact on the person.

Mandatory Privacy Officers

Organisations above a certain threshold must appoint a designated privacy officer responsible for compliance, training, and acting as the primary contact for individuals and the OAIC.

Penalties and Enforcement

The OAIC's enforcement toolkit has grown considerably. Alongside the maximum penalty increases introduced in 2022, the 2026 Act gives the Commissioner:

• Power to issue infringement notices for mid-tier breaches without going to court.
• Power to conduct public inquiries into specific sectors or practices.
• A new mid-tier civil penalty for interferences with privacy that fall short of "serious or repeated."
• Expanded information-gathering powers during investigations.

Combined with the new statutory tort, Australian organisations face meaningful legal and financial consequences for sloppy data handling for the first time.

Data Breaches: The 72-Hour Rule

Under the Notifiable Data Breaches scheme as amended, organisations must notify the OAIC within 72 hours of becoming aware of an eligible data breach. Affected individuals must be notified as soon as practicable thereafter.

The notification must include:

1. The nature of the breach.
2. The kinds of information involved.
3. Likely consequences for affected individuals.
4. Steps the organisation is taking in response.
5. Recommendations for what individuals should do to protect themselves.

How the Privacy Act 2026 Affects Online Tracking and Marketing

The reforms significantly tighten the rules around online tracking, profiling, and targeted advertising. Key impacts:

Targeted Advertising

Targeting a person based on sensitive information (health, religion, political views, sexual orientation) is prohibited without express consent. Targeting children is prohibited outright, except in narrow circumstances in their best interests.

Trading in Personal Information

Data brokers face new transparency and consent requirements. Individuals have the right to know who their data has been shared with and to request erasure from downstream recipients.

Link Tracking and Analytics

Businesses using analytics on shared links, campaign URLs, or marketing emails need to review whether the data they collect falls under the expanded definition of personal information. Using a privacy-respecting link management platform like Lunyb — which offers URL shortening with transparent analytics and no shadowy data resale — can help marketers stay on the right side of the fair-and-reasonable test. You can read our honest Lunyb review or compare options in the 2026 URL shortener buyer's guide if you're evaluating tools.

Practical Steps to Protect Your Privacy

Even with stronger laws, personal responsibility matters. Here's a checklist Australians can use today:

For Individuals

1. Review app permissions on your phone every few months and revoke anything unnecessary.
2. Use encrypted DNS (such as DNS over HTTPS) in your browser to reduce passive tracking by your ISP.
3. Switch to a privacy-focused browser or install tracker-blocking extensions.
4. Enable multi-factor authentication on every account that supports it.
5. Request a copy of your data from services you use heavily — you have the right.
6. Exercise your new erasure rights on old accounts you no longer use.
7. Check what links you click — hover before clicking, and be wary of shortened URLs from unknown sources.

For Small Businesses

1. Map the personal information you collect, where it is stored, and who it is shared with.
2. Update your privacy policy to reflect the new rights and your contact details for privacy requests.
3. Appoint a privacy officer (even informally) and train staff on their obligations.
4. Review third-party vendors — especially marketing, analytics, and cloud providers — for compliance.
5. Build a documented data breach response plan with the 72-hour clock in mind.
6. Conduct a Privacy Impact Assessment before launching any new product that involves personal information.

How to Make a Privacy Complaint

If you believe an organisation has mishandled your personal information, you have escalating options:

1. Complain directly to the organisation in writing. They must respond within 30 days.
2. Escalate to the OAIC if you are unsatisfied. The OAIC can investigate, conciliate, and make determinations.
3. Pursue court action under the new statutory tort for serious invasions of privacy, or appeal OAIC determinations in the Federal Court.

How Australia Compares Globally

The Privacy Act 2026 brings Australia much closer to the EU's General Data Protection Regulation (GDPR), though some gaps remain. Here's a quick comparison:

Feature	Australia 2026	EU GDPR	California CCPA/CPRA
Right to erasure	Yes (limited)	Yes	Yes
Right to data portability	Partial (Consumer Data Right)	Yes	Yes
Direct right of action	Yes (serious invasions)	Yes	Limited
Breach notification	72 hours	72 hours	Varies by state
Max penalty	$50M / 30% turnover	€20M / 4% turnover	$7,500 per violation
Children's code	Yes	Yes	Yes

Timeline and Transition

The reforms are being rolled out in tranches. Some provisions commenced on assent, while others — notably the removal of the small business exemption and the automated decision-making transparency rules — have transition periods of up to 24 months to give organisations time to prepare.

Businesses should monitor OAIC guidance closely, as the regulator is issuing updated APP guidelines, codes of practice, and sector-specific rules on an ongoing basis.

Frequently Asked Questions

Does the Privacy Act 2026 apply to small businesses?

Yes — eventually. The long-standing small business exemption (for businesses under $3M turnover) is being phased out. During the transition, some smaller operators are already covered if they handle sensitive information, trade in personal data, or provide services to government. All businesses should assume they will be covered and start preparing now.

Can I sue a company directly for breaching my privacy?

Yes. The Privacy Act 2026 introduces a statutory tort for serious invasions of privacy, allowing individuals to take direct action in the Federal Court. You can seek damages, injunctions, and other remedies. For less serious complaints, the complaint pathway through the OAIC remains available and is usually faster and cheaper.

What is the maximum penalty under the Privacy Act 2026?

For serious or repeated interferences with privacy, corporate penalties can reach the greater of $50 million, three times the benefit obtained from the breach, or 30% of the organisation's adjusted turnover during the breach period. Individuals can face penalties of up to $2.5 million.

Does the Act cover IP addresses and cookies?

Yes. The expanded definition of personal information explicitly includes technical identifiers — including IP addresses, device identifiers, and cookie IDs — where they can reasonably be linked to an identifiable person. This closes a major loophole that previously let adtech companies argue tracking data wasn't "personal."

How do I request erasure of my data from a company?

Submit a written request to the organisation's privacy officer (contact details should be in their privacy policy). Clearly identify yourself, the data you want deleted, and the grounds (e.g. no longer necessary, consent withdrawn). The organisation must respond within a reasonable period, generally 30 days, and tell you if they refuse — along with reasons and your right to complain to the OAIC.

Final Thoughts

The Australia Privacy Act 2026 is a long-overdue upgrade that puts real power — and real remedies — in the hands of Australians. For individuals, it means more control and more leverage. For businesses, it means genuine accountability and the need to treat personal information as the sensitive asset it has always been.

Whether you're a consumer wanting to exercise your rights or a business owner preparing for compliance, the time to act is now. Review your digital footprint, audit your data practices, and treat privacy not as a legal checkbox but as a core element of trust.