Australia Privacy Act 2026: Your Rights Explained

The Australian privacy landscape is undergoing its most significant transformation in decades. The Australia Privacy Act 2026 reforms build on amendments passed in late 2024 and continue rolling out through 2025 and 2026, bringing Australian law closer to international standards like the EU's GDPR. For individuals, this means stronger rights over personal information. For businesses, it means new obligations, higher penalties, and a serious rethink of data practices.

This guide explains what the updated Privacy Act means for you, whether you're an Australian resident wanting to protect your personal data or a business trying to stay compliant.

What Is the Australia Privacy Act 2026?

The Australia Privacy Act 2026 refers to the latest tranche of reforms to the Privacy Act 1988, which governs how personal information is collected, used, stored, and disclosed by Australian Government agencies and private sector organisations with an annual turnover of more than $3 million. The reforms respond to the 2020 Privacy Act Review and major data breaches at Optus, Medibank, and Latitude Financial that exposed millions of Australians' records.

The changes are being implemented in stages. The first tranche passed in November 2024 introduced a statutory tort for serious invasions of privacy, new rules for children's online privacy, and tougher enforcement powers. The second tranche, expected throughout 2026, is set to address consent standards, a right to erasure, automated decision-making transparency, and the long-debated removal of the small business exemption.

Why the Reforms Matter

Australia's privacy regime had fallen behind global peers. The GDPR in Europe, the UK Data Protection Act, and even New Zealand's Privacy Act 2020 offered citizens stronger controls than Australians enjoyed. The 2026 updates are designed to close that gap and restore public trust after years of high-profile breaches.

Your Key Rights Under the Updated Privacy Act

The reforms expand and clarify the rights Australian individuals have over their personal information. Here are the most important ones to know.

1. The Right to Sue for Serious Invasions of Privacy

Perhaps the most significant change is the introduction of a statutory tort for serious invasions of privacy, commencing in June 2025. This gives Australians the ability to sue directly in court if their privacy is seriously invaded, either through intrusion upon seclusion (such as surveillance or hacking) or misuse of private information.

To succeed, you must show the invasion was intentional or reckless, serious, and that your reasonable expectation of privacy outweighed any competing public interest. Damages of up to $478,550 are available, aligning with defamation caps.

2. The Right to Erasure (Right to Be Forgotten)

The second tranche of reforms is expected to introduce a right to request deletion of your personal information in certain circumstances. This mirrors GDPR's famous "right to be forgotten" and will apply when:

• The information is no longer necessary for its original purpose
• You withdraw consent and no other lawful basis exists
• The information was collected unlawfully
• You object to processing that cannot be justified

3. Enhanced Rights for Children

A new Children's Online Privacy Code is being developed by the Office of the Australian Information Commissioner (OAIC) and must be in force by December 2026. It will set specific rules for services likely to be accessed by children under 18, covering default privacy settings, age-appropriate design, and restrictions on targeted advertising to minors.

4. Transparency Around Automated Decisions

From December 2026, organisations will be required to disclose in their privacy policies when personal information is used in substantially automated decisions that significantly affect individuals. This includes decisions about credit, insurance, employment, and access to services. You'll have the right to understand how automated systems are shaping outcomes that affect your life.

5. The Right to Access and Correct Your Information

Longstanding rights to access your personal information held by an organisation and request corrections remain, but response timeframes and the ability to charge fees are being tightened. Most agencies and organisations must now respond within 30 days.

Business Obligations Under the Privacy Act 2026

If you run or work for an Australian business, the reforms significantly change your compliance landscape. The 13 Australian Privacy Principles (APPs) still form the backbone of the law, but their interpretation and enforcement are evolving fast.

Key New Obligations

1. Reasonable steps must be "appropriate": The requirement to take "reasonable steps" to protect data has been clarified. Both technical and organisational measures are now explicitly required.
2. Transparent privacy policies: Privacy policies must specifically disclose automated decision-making uses of personal information.
3. Overseas data transfers: New whitelisted countries will be designated as providing "substantially similar" protection, simplifying cross-border transfers but tightening others.
4. Statutory tort exposure: Businesses face a new litigation risk from individuals, not just regulator fines.
5. Notifiable Data Breach refinements: Reporting obligations under the NDB scheme have been strengthened.

Penalties Comparison

Penalties for serious or repeated interferences with privacy have jumped dramatically. The table below shows the shift.

Entity Type	Previous Maximum Penalty	Current Maximum Penalty (2026)
Body Corporate	$2.22 million	Greater of $50 million, 3x benefit obtained, or 30% of adjusted turnover
Individuals	$444,000	$2.5 million
Mid-tier interference	Not applicable	Up to $3.3 million (bodies corporate)
Administrative infringements	Not applicable	Up to $66,000 per contravention

The Small Business Exemption: Still There (For Now)

Currently, businesses with turnover under $3 million are largely exempt from the Privacy Act. The government has indicated this exemption will eventually be removed, bringing an estimated 2.3 million small businesses into scope. However, the removal has been deferred to allow for consultation and support, and is not expected before late 2026 or 2027.

Small businesses should start preparing now by auditing what personal information they hold, how it's stored, and who has access.

What the Reforms Mean for Everyday Australians

Beyond the legal technicalities, the Privacy Act 2026 reforms affect daily life in several practical ways.

Online Shopping and Services

Expect clearer, simpler privacy notices when you sign up for new services. Dark patterns designed to trick you into sharing more data than necessary are increasingly being scrutinised by the OAIC.

Social Media and Targeted Advertising

Children under 16 will see significant changes to how platforms engage with them, following both the Privacy Act reforms and separate social media age restriction laws. Targeted advertising based on sensitive information categories faces tighter restrictions.

Data Breach Notifications

You should receive clearer, faster notifications when your personal information is involved in a breach. Organisations must notify both the OAIC and affected individuals when a breach is likely to result in serious harm.

Everyday Privacy Hygiene

Legal reforms are only part of the picture. Individuals can take practical steps to limit their exposure, including using encrypted DNS services, privacy-focused browsers, and avoiding sharing identifying information with every website that asks. When sharing links online, consider using a privacy-respecting shortener like Lunyb that doesn't bundle in excessive tracking. For businesses, choosing marketing tools that respect user data has become a compliance issue, not just a brand values one — our 2026 buyer's guide to URL shorteners compares options with privacy practices in mind.

How to Exercise Your Privacy Rights

Knowing your rights is one thing; using them is another. Here's a practical process to assert your rights under the Privacy Act.

1. Identify the organisation that holds your personal information and locate their privacy policy.
2. Find the Privacy Officer contact, typically listed in the privacy policy or on a "Contact Us" page.
3. Submit a written request clearly stating what you want: access, correction, deletion, or an explanation of automated decisions.
4. Wait for a response — organisations generally have 30 days to respond.
5. Escalate to the OAIC if your request is refused or ignored. Complaints are free to lodge and the Commissioner has conciliation and investigation powers.
6. Consider legal action for serious invasions of privacy, now that the statutory tort is available.

Pros and Cons of the Privacy Act 2026 Reforms

The reforms are broadly welcomed, but they're not without controversy. Here's a balanced view.

Pros

• Stronger individual rights, closer to international best practice
• Meaningful penalties that will actually influence corporate behaviour
• Direct legal recourse through the statutory tort
• Better protections for children and sensitive information
• Greater transparency around automated decision-making

Cons

• Compliance costs will rise significantly for medium-sized businesses
• Small business exemption removal could burden sole traders
• Some reforms are still being drafted, creating ongoing uncertainty
• Statutory tort may encourage opportunistic litigation
• Enforcement capacity at the OAIC remains stretched

Preparing for Full Implementation

Whether you're an individual or a business, there are concrete steps to take now before the final tranche of reforms lands.

For Individuals

• Review the privacy settings on all your major accounts
• Opt out of marketing communications where possible
• Request access to data held about you by key organisations to see what they have
• Use strong, unique passwords and multi-factor authentication
• Be selective about what personal information you share online

For Businesses

• Conduct a privacy impact assessment of your current data practices
• Update your privacy policy to reflect new transparency requirements
• Train staff on the new obligations, particularly around breach response
• Review contracts with third-party processors and overseas vendors
• Appoint or designate a Privacy Officer if you haven't already
• Document your lawful basis for processing each category of personal information

Frequently Asked Questions

When does the Australia Privacy Act 2026 take full effect?

The reforms are being rolled out in stages. The first tranche took effect in late 2024 and mid-2025, with provisions like the statutory tort and children's online privacy code fully operational by December 2026. The second tranche, covering erasure rights and the small business exemption, is still being consulted on and will likely roll out through 2026 and into 2027.

Does the Privacy Act 2026 apply to overseas companies?

Yes. The Act applies to any organisation that carries on business in Australia or collects personal information in Australia, regardless of where it's based. Global tech companies, overseas e-commerce sites targeting Australians, and international service providers all fall within scope.

Can I sue a company directly for a privacy breach?

Yes, since June 2025. The new statutory tort for serious invasions of privacy allows individuals to bring civil proceedings directly in court, independent of OAIC action. However, the invasion must be serious, intentional or reckless, and your privacy expectation must outweigh competing public interests.

What's the maximum fine a business can face?

For serious or repeated interferences with privacy, bodies corporate face the greatest of $50 million, three times the benefit obtained from the conduct, or 30% of adjusted turnover during the breach period. This brings Australian penalties into line with GDPR-style enforcement.

Do small businesses need to comply with the Privacy Act yet?

Most businesses with annual turnover under $3 million are still exempt, with some exceptions (health service providers, those trading in personal information, and contracted service providers to the Commonwealth). The exemption is slated for removal in a future tranche of reforms, so small businesses should begin preparing their data practices now.

How do I lodge a privacy complaint?

Complaints are made to the Office of the Australian Information Commissioner (OAIC) through their website at oaic.gov.au. You should first attempt to resolve the issue with the organisation directly. If that fails, the OAIC can investigate, conciliate, and in serious cases, pursue civil penalties.

Final Thoughts

The Australia Privacy Act 2026 reforms represent a genuine shift in how personal information is treated in this country. For individuals, the new rights and remedies make it easier than ever to understand, control, and defend your data. For businesses, the regulatory environment demands serious investment in privacy-by-design practices, not just paperwork compliance.

Privacy is no longer a back-office concern or a legal footnote. It's a strategic priority, a consumer expectation, and increasingly, a competitive advantage. Whether you're building a product, running a small business, or simply trying to protect yourself and your family online, understanding the updated Privacy Act is one of the most valuable investments you can make in 2026.