Privacy Act reforms and the new obligations for Australian businesses

Australian privacy law has been rewritten in stages by the Privacy and Other Legislation Amendment Act 2024 (Cth) (the POLA Act), the first tranche of the biggest overhaul of the Privacy Act 1988 (Cth) in decades. The changes did not arrive in a single hit. Higher penalties and new criminal offences started on 10 December 2024. A new right to sue for serious invasions of privacy commenced on 10 June 2025. Two further obligations land on 10 December 2026, when automated decision-making transparency rules come into force and the Children's Online Privacy Code is due to be registered.

If your business handles personal information, five things now demand attention: the new penalty regime, the Children's Online Privacy Code, the automated decision-making rules, the doxxing offences, and the statutory tort. This guide sets out who each obligation applies to, what you must actually do, and the deadlines that will catch you out.

Which businesses the changes apply to

The reforms sit on top of the existing Privacy Act, so the first question is whether your business is already bound. The Act applies to APP entities. In the private sector, that generally means organisations with annual turnover above $3 million, plus smaller operators in specific categories, including health service providers, businesses that trade in personal information, credit reporting bodies and their customers, and recipients of tax file numbers.

Each new obligation then has its own reach:

Penalties: the new penalty regime applies to every APP entity, whatever its size.
Children's Online Privacy Code: the code will bind APP entities that provide social media services, apps, games, streaming platforms or other online services likely to be accessed by children, together with any additional entities the code names.
Automated decision-making: the transparency rules apply to any APP entity that uses computer programs to make, or to substantially assist, decisions about individuals.
Doxxing: the new criminal offences apply to everyone, not just APP entities, which means your staff's conduct can expose them to prosecution.
Right to sue: the statutory tort can be brought against any person, including a business, whether or not it is an APP entity.

If your business is not an APP entity, the doxxing offences and the tort still affect you. The privacy-specific duties below only bite if the Privacy Act applies to you.

New penalties for privacy breaches

The POLA Act replaced the old flat penalty with a tiered regime, and for the first time defined what makes an interference with privacy "serious". Under s 13G of the Privacy Act 1988 (Cth), a serious interference exposes an individual to a penalty of up to $2.5 million and a body corporate to the greatest of $50 million, three times the value of any benefit obtained from the conduct, or 30% of the company's adjusted turnover during the breach period.

In deciding whether an interference is serious, a court may weigh the kind and sensitivity of the information involved, the consequences for the individual, the number of people affected, whether a child or vulnerable person was involved, whether the conduct was repeated or continuous, and whether the business failed to implement the practices and procedures needed to comply. A single data breach can therefore be assessed against all of these factors, and can involve multiple contraventions.

Two lower tiers fill out the scheme. Interferences that are not serious are capped at 2,000 penalty units, currently about $660,000 for an individual. Specific lower-level breaches, including failing to have a privacy policy at all or having one that omits required content, are capped at 200 penalty units, currently about $66,000 for an individual and $330,000 for a company. Penalty units are indexed, so these dollar figures rise over time.

Enforcement has also become faster. Under s 80UB, the Information Commissioner can issue infringement notices, effectively on-the-spot fines, for the lower-tier breaches without going to court, with each notice for a listed corporation capped at 200 penalty units. The Commissioner can also issue compliance notices requiring a business to fix its practices, and can pursue the higher penalties through the Federal Court.

Children's Online Privacy Code: what it will require

Under s 26GC of the Privacy Act, the Australian Information Commissioner must develop and register a Children's Online Privacy Code within 24 months of Royal Assent. The POLA Act received Royal Assent on 29 November 2024, so the code is due by the end of 2026, and the OAIC has flagged registration for 10 December 2026.

The code will bind APP entities that provide a social media service, a relevant electronic service or a designated internet service under the Online Safety Act 2021 (Cth), where the service is likely to be accessed by children or is primarily concerned with children's activities. Health services are carved out. That covers far more than the big platforms: the OAIC has said the code will reach most apps, games, streaming platforms and websites that children and teenagers use daily.

The OAIC released an exposure draft of the code on 31 March 2026 and consulted publicly until 5 June 2026. The draft obligations give a clear picture of what registration will mean for in-scope businesses:

Best interests of the child: collection, use and disclosure of a child's personal information must be consistent with the child's best interests.
Consent for targeted advertising: direct marketing would only be permitted with consent, when it is in the child's best interests, and when the information was collected directly from the child rather than from third parties.
Deletion rights: children would gain a right to request the destruction of their personal information.
Age-appropriate notices: privacy notices and policies must be written in clear language a child can understand.
Parental consent transparency: children must be told when a parent consents to collection on their behalf, and when other users, including parents, are tracking their geolocation on the service.

If your business operates an app, game, streaming service or website that children use, assume the code will bind you and review your children's data practices against the draft now, rather than waiting for registration.

Automated decision-making: transparency from 10 December 2026

The POLA Act introduces automated decision-making transparency requirements that commence on 10 December 2026, amending Australian Privacy Principle 1 to add new clauses 1.7, 1.8 and 1.9.

The trigger is specific. Your privacy policy must contain the new information if your business arranged for a computer program to make a decision, or to do something that is substantially and directly related to making a decision, the decision could reasonably be expected to significantly affect an individual's rights or interests, and personal information about the individual is used in operating the program. "Computer program" is broad: it covers pre-programmed rule-based processes as well as AI and machine learning, and "substantially and directly" are two separate tests. A program that calculates a figure is directly but not necessarily substantially related to a decision unless that figure is a key factor in a human decision-maker's choice. A program that shortlists job applicants for a human to review does meet the test.

Where the trigger is met, your privacy policy must state:

the kinds of personal information used in operating the program, such as name, date of birth, address and other identifiers;
the kinds of decisions made solely by the program, such as a fully automated credit-score calculation or a loan refusal; and
the kinds of decisions where the program does something substantially and directly related to the decision, such as shortlisting candidates for a human recruiter.

A decision "significantly affects" rights or interests when it is more than trivial and has the potential to significantly influence the individual's circumstances. Examples the new clause contemplates include decisions about eligibility for a benefit under legislation, decisions affecting rights under a contract such as an insurance policy, and access to significant services or support, including targeted advertising that affects access to significant goods or services. Whether an effect is significant also depends on the individual's circumstances, and a child or a person with a disability is more readily affected.

If your business uses AI or rule-based systems in pricing, credit assessment, recruitment, insurance underwriting, fraud screening or customer targeting, this is the obligation to start working on now. The content has to sit in your privacy policy from 10 December 2026, and the policy itself must be up to date at all times under APP 1.

Doxxing is now a criminal offence

The POLA Act added doxxing offences to the Criminal Code Act 1995 (Cth), which commenced on 10 December 2024. Under s 474.17C, a person commits an offence if they use a carriage service to make available, publish or otherwise distribute personal data, such as a name, photograph, telephone number, email address or online account details, in a way that reasonable persons would regard as menacing or harassing towards the individuals concerned. The maximum penalty is imprisonment for six years.

Section 474.17D creates an aggravated offence where the conduct is engaged in because of the offender's belief that the group is distinguished by race, religion, sex, sexual orientation, gender identity, intersex status, disability, nationality or national or ethnic origin. The maximum penalty is seven years.

These are criminal provisions that apply to individuals, not just businesses. For employers, the practical exposure runs in two directions. Staff who publish customer or colleague details in a menacing or harassing way can face prosecution, and a business can face reputational and regulatory fallout where its platform or systems are used to facilitate the practice. Moderation policies and staff training should treat doxxing as a serious misconduct matter and a criminal offence, not an internal complaint.

The new right to sue for serious invasions of privacy

Since 10 June 2025, individuals have had a direct cause of action for serious invasions of privacy under Schedule 2 of the Privacy Act, a statutory tort that sits alongside the regulator's enforcement powers. This is a significant change: an affected individual can now sue your business directly, without the OAIC being involved at all.

Under clause 7 of Schedule 2, an individual can sue if the defendant invaded their privacy by intruding upon their seclusion, for example by physically intruding into a private space or watching, listening to or recording private activities or affairs, or by misusing information relating to them. The individual must show that a reasonable person in their position would have had a reasonable expectation of privacy, that the invasion was intentional or reckless, that it was serious, and that the public interest in their privacy outweighed any countervailing public interest. The cause of action is actionable without proof of damage, so compensation does not depend on the individual proving a measurable loss.

Defences include acting with lawful authority, consent, necessity and the defence of persons or property. Where the invasion involved publication, the usual defences available in defamation proceedings also apply, and exemptions cover intelligence agencies, law enforcement bodies and journalists acting in good faith.

For businesses, the tort changes the risk profile of ordinary activities. Surveillance of staff, disclosure of customer information beyond the purpose collected, and publication of an individual's details can all now become the subject of a direct lawsuit, even where the conduct falls short of a notifiable data breach. Complaints handling and incident response should treat individual claims as a live risk.

A compliance checklist for your business

Work through these items in order, using the deadlines above to set your priorities:

Confirm your status: check whether your business is an APP entity, taking into account turnover and the special categories that pull smaller businesses in.
Audit your data flows: map how personal information is collected, used, disclosed and stored, and identify gaps against the Australian Privacy Principles.
Update your privacy policy: ensure it meets APP 1.3 and 1.4 now, and prepare the automated decision-making content required by APPs 1.7 to 1.9 before 10 December 2026.
Map your automated decisions: list every computer program that makes, or substantially assists, decisions about individuals, including credit scoring, recruitment screening, pricing and fraud detection.
Assess the Children's Online Privacy Code: if you operate an online service likely to be accessed by children, review your practices against the exposure draft, including consent for targeted advertising and deletion rights.
Review surveillance and disclosure practices: with the statutory tort in force, test whether any monitoring, recording or publication of personal information could amount to intrusion upon seclusion or misuse of information.
Refresh staff training: cover doxxing as a criminal offence and the circumstances in which publishing personal data is unlawful.
Keep your data breach response plan current: a serious breach can now attract penalties of up to $50 million and individual claims in the same event.

Where a privacy lawyer helps

Most of these obligations turn on judgement calls that are easy to get wrong. A privacy lawyer can confirm whether your business is an APP entity and whether exemptions apply, draft or review your privacy policy so it covers APP 1.3 and 1.4 now and the automated decision-making content before the December 2026 deadline, and assess whether your online services will be bound by the Children's Online Privacy Code. If a complaint, infringement notice or tort claim arrives, a lawyer can respond to the OAIC, negotiate with the complainant, and advise on defences such as consent and lawful authority.

The 10 December 2026 deadline businesses will miss

The obligation most likely to slip is the automated decision-making transparency requirement, because it starts on 10 December 2026 rather than with the rest of the reforms, and it catches businesses that do not think of themselves as AI companies. An online retailer that auto-prices, a lender that uses credit scoring, a recruiter that screens applications by software: all of these arrange computer programs that make, or substantially assist, decisions about individuals, and all of them need the new content in their privacy policies by the deadline. The same date is when the Children's Online Privacy Code is due to be registered, so December 2026 is a double deadline.

The first action to take this week is to list every computer program your business uses to make decisions about people, and to check whether any online service you operate is likely to be accessed by children. If either answer is yes, the privacy policy work starts now, not in December.