Australia Privacy Act 2026: Your Rights Explained

The Australia Privacy Act 2026 marks the most significant overhaul of Australian data protection law in nearly four decades. Building on the Privacy Act 1988 and the sweeping reforms announced in response to the Privacy Act Review Report, the 2026 changes expand the rights of individuals, tighten obligations on businesses, and dramatically increase penalties for mishandling personal information. This guide explains what the Act means for you as an Australian consumer, employee or small business owner.

What Is the Australia Privacy Act 2026?

The Australia Privacy Act 2026 is the updated federal framework that governs how Australian Privacy Principles (APP) entities collect, use, store and disclose personal information. It modernises the original Privacy Act 1988 by introducing a direct right of action, broader definitions of personal information, stronger protections for children, and clearer rules for automated decision-making and online tracking.

The reforms are being rolled out in tranches. The first tranche (passed in late 2024) introduced statutory tort for serious invasions of privacy, a children's online privacy code, and criminal penalties for doxxing. The 2026 tranche delivers the bulk of the substantive changes to individual rights, consent standards, and small business obligations.

Who the Act Applies To

The Act applies to:

• All Australian Government agencies.
• Private sector organisations with annual turnover above AUD $3 million (though the small business exemption is being phased out under the 2026 reforms).
• Health service providers of any size.
• Credit reporting bodies and credit providers.
• Overseas businesses that collect or hold personal information of Australians.

The most significant change is the gradual removal of the small business exemption, meaning that from 2026 onward, far more businesses will have formal privacy obligations.

Your Key Rights Under the 2026 Reforms

The 2026 Act establishes a stronger, more enforceable set of rights that bring Australia closer to the European GDPR model while retaining a distinctly Australian flavour.

1. The Right to Access and Correct Your Information

You have always had the right to ask an organisation what personal information it holds about you. The 2026 changes make this right faster and cheaper: organisations must respond within 30 days, cannot charge excessive fees, and must provide information in a commonly used, machine-readable format where feasible.

2. The Right to Erasure

For the first time, Australians have a general right to request deletion of their personal information. An organisation must erase your data when:

1. The information is no longer necessary for the purpose it was collected.
2. You withdraw consent and there is no other lawful basis to keep it.
3. The information was collected from a child without appropriate consent.
4. The information has been unlawfully handled.

Exceptions apply for legal obligations, public interest research, and freedom of expression.

3. The Right to Object to Direct Marketing

You can require any business to stop using your personal information for direct marketing, including profiling connected to marketing. The business must comply promptly and free of charge, and must tell you where it obtained your details.

4. The Right to Information About Automated Decisions

If a business uses automated systems (including AI) to make decisions that significantly affect you — such as loan approvals, insurance pricing, or employment screening — you have the right to:

• Be told that an automated decision is being made.
• Receive meaningful information about the logic involved.
• Request human review of the decision.

5. A Direct Right of Action

Perhaps the biggest shift: individuals can now sue directly in the Federal Court or Federal Circuit and Family Court for interferences with their privacy, after first making a complaint to the Office of the Australian Information Commissioner (OAIC). Courts can award damages, including for non-economic loss such as distress and humiliation.

6. The Statutory Tort for Serious Invasions of Privacy

Separate from the APP framework, a new statutory tort allows individuals to sue for serious invasions of privacy — including intrusion upon seclusion (e.g. covert surveillance) and misuse of private information. This applies to individuals and companies, not just APP entities.

What Counts as Personal Information Now?

The definition of "personal information" has been clarified and broadened. It now explicitly includes technical identifiers that can reasonably identify you, even indirectly.

Category	Examples Covered in 2026
Identity data	Name, address, date of birth, Medicare number, driver licence
Technical identifiers	IP address, device ID, advertising ID, cookies tied to a person
Location data	GPS coordinates, Wi-Fi based location, mobile network location
Behavioural data	Browsing history, app usage, purchase history where linked to a person
Sensitive information	Health, biometrics, genetic data, sexual orientation, political views
Inferred information	Profiles and predictions generated by AI about you

New Obligations on Businesses

The reforms are not just about new rights — they impose a "fair and reasonable" test on all handling of personal information. Even if a business obtains consent, the use of your data must still be objectively fair and reasonable in the circumstances.

Consent Must Be Genuine

Consent under the 2026 Act must be voluntary, informed, current, specific and unambiguous. Pre-ticked boxes, bundled consents, and "take it or leave it" terms will generally not qualify. Organisations also must make it as easy to withdraw consent as it was to give it.

Privacy by Design and Default

Businesses must build privacy protections into products and services from the outset, applying data minimisation and purpose limitation. Settings must default to the most privacy-protective option, especially for services likely to be used by children.

Mandatory Privacy Impact Assessments

High-risk activities — such as large-scale profiling, biometric processing, or deployment of AI in decision-making — require a documented Privacy Impact Assessment that may need to be shared with the OAIC on request.

Breach Notification Within 72 Hours

The notifiable data breach scheme has been tightened. Businesses must notify the OAIC within 72 hours of becoming aware of an eligible breach and notify affected individuals as soon as practicable, with specific content requirements for the notice.

Penalties: Why Businesses Are Taking This Seriously

The maximum civil penalty for serious or repeated interferences with privacy is now the greatest of:

• AUD $50 million; or
• Three times the benefit obtained from the misuse of information; or
• 30% of adjusted turnover during the breach period.

A new mid-tier civil penalty applies to less serious contraventions, and infringement notices can be issued for administrative failures such as not having an up-to-date privacy policy. Executives can also face personal liability where they were knowingly involved in a contravention.

Protections for Children and Vulnerable People

The Children's Online Privacy Code (COP Code) applies to social media platforms, data brokers, and other services likely to be accessed by children under 18. Key elements include:

1. Age-appropriate design standards (based on the UK model).
2. Default high-privacy settings for minors.
3. Prohibition on using children's data for targeted advertising.
4. Restrictions on nudge techniques that encourage data sharing.
5. Mandatory risk assessments before releasing new features.

Separately, the Act strengthens protections for people experiencing domestic violence, allowing them to request suppression of their personal information across multiple services at once.

How to Exercise Your Rights: A Step-by-Step Guide

1. Identify the organisation. Work out which APP entity holds your data — it may be the website, the parent company, or a third-party processor.
2. Make a written request. Email their privacy officer (contact details must be in their privacy policy). Clearly state whether you want access, correction, erasure, or to object to processing.
3. Wait up to 30 days. The business must respond within 30 days of your request.
4. Escalate to the OAIC. If you are unhappy with the response (or get none), lodge a complaint with the Office of the Australian Information Commissioner at oaic.gov.au.
5. Consider legal action. From 2026, if conciliation fails, you can take the matter directly to court under the new right of action.

Practical Steps to Protect Your Privacy

While the law gives you stronger rights, prevention is better than cure. Here are practical measures every Australian should consider:

Audit Your Digital Footprint

Search for your name, email and phone number. Request removal from people-search sites and data brokers. Under the 2026 Act, data brokers must honour deletion requests from Australians.

Lock Down Social Media

Review privacy settings on every platform. Turn off ad personalisation, limit who can see your posts, and remove old content you no longer need public.

Use Privacy-Respecting Tools

Choose browsers with tracking protection, encrypted DNS resolvers, end-to-end encrypted messaging, and password managers with breach monitoring. When sharing links — especially on social media or in email campaigns — consider a privacy-focused link shortener like Lunyb, which lets you share short URLs without exposing unnecessary tracking data about your recipients. You can read more in our honest review of Lunyb or compare it against alternatives in our 2026 URL shortener buyer's guide.

Be Deliberate About Consent

The 2026 Act gives you the right to say no — use it. Reject non-essential cookies, decline optional data collection, and withdraw old consents you no longer remember giving.

Monitor for Breaches

Sign up for breach notification services such as Have I Been Pwned, and act fast when you learn your data has been exposed: change passwords, enable multi-factor authentication, and consider a credit ban under the Privacy (Credit Reporting) Code.

What Small Businesses Need to Do

With the small business exemption being phased out, hundreds of thousands of Australian businesses will need a formal privacy program for the first time. At minimum, you should:

1. Appoint a privacy officer (even if part-time).
2. Publish an APP-compliant privacy policy and collection notices.
3. Map what personal information you collect, where it is stored, and who it is shared with.
4. Implement reasonable security controls, including encryption, access controls and staff training.
5. Have a documented data breach response plan.
6. Review contracts with overseas service providers for cross-border disclosure compliance.

Cross-Border Data Transfers

Under APP 8, you remain accountable for personal information even when it is sent overseas. The 2026 reforms introduce a mechanism for prescribed countries with substantially similar laws (likely to include the EU, UK and New Zealand), which simplifies transfers to those jurisdictions. For other countries, you must either obtain informed consent or ensure contractual safeguards are in place.

How Australia Compares Internationally

Right / Feature	Australia 2026	EU GDPR	California CCPA/CPRA
Right to erasure	Yes	Yes	Yes
Right to data portability	Limited (CDR scheme)	Yes	Yes
Direct right of action	Yes	Yes	Limited
Max penalty	$50M / 30% turnover	€20M / 4% turnover	$7,500 per violation
Children's code	Yes (COP Code)	Yes	Yes
Small business coverage	Being extended	Full coverage	Threshold-based

Frequently Asked Questions

When does the Australia Privacy Act 2026 take effect?

The reforms are being commenced in stages. First-tranche changes (statutory tort, doxxing offences, children's code framework) commenced in 2024–2025. The main second-tranche changes — including the direct right of action, expanded definitions, and the fair and reasonable test — are being switched on through 2026, with transitional periods for small businesses extending into 2027.

Can I sue a company directly for a privacy breach?

Yes. Once the direct right of action commences, you can take an APP entity to the Federal Court or Federal Circuit and Family Court after first lodging a complaint with the OAIC and attempting conciliation. Separately, the statutory tort allows you to sue for serious invasions of privacy without needing to go through the OAIC first.

Does the Act apply to overseas companies like Meta or Google?

Yes. The Act has extraterritorial reach: any organisation that collects or holds personal information about Australians in the course of carrying on business in Australia is covered, regardless of where it is headquartered. The OAIC has already pursued major global platforms under this test.

What's the difference between personal information and sensitive information?

Personal information is any information that can identify you. Sensitive information is a protected sub-category that includes health, biometric, genetic, racial, political, religious, union, sexual orientation and criminal record data. Sensitive information generally requires explicit consent to collect and attracts stronger protections.

How do I lodge a privacy complaint?

First, complain in writing to the organisation and give them 30 days to respond. If you are not satisfied, lodge a complaint with the OAIC through oaic.gov.au. The OAIC can investigate, conciliate, and make determinations including compensation. From 2026, you can also take matters directly to court if conciliation fails.

Final Thoughts

The Australia Privacy Act 2026 is not just a compliance headache for businesses — it is a genuine strengthening of the rights of every Australian. The combination of a direct right of action, expanded definitions, the fair and reasonable test, and penalties with real teeth means that privacy is finally being treated as the fundamental right it always should have been. Learn your rights, exercise them regularly, and choose services that take your data seriously by default.