For years, Australian businesses have heard that the Privacy Act 1988 (Cth) (the Act) was heading for its biggest overhaul since it was written. That anticipation has now crystallised into two distinct stages. The first tranche of reforms became law in December 2024 and most of it is already in force. The second tranche is still being drafted, and the items in it are the ones that will most affect small and medium businesses. This article explains how the reform process works, what has already changed, what is still on the table, and where the changes are most likely to bite your business.
The reform push has two drivers. The Australian Competition and Consumer Commission's 2019 Digital Platforms Inquiry recommended a stronger privacy framework, and the government's own review found the Act was struggling to keep pace with how much personal information businesses now collect, use and hold. There was also a desire to bring Australia closer to the standards that jurisdictions such as the European Union had already adopted. The result is a reform program delivered in tranches rather than as one single rewrite.
Who drives the reforms and how the process works
Before looking at what changed, it helps to know who is moving the pieces. The privacy reform process is a chain of actors:
- ACCC: Its 2019 Digital Platforms Inquiry supplied the initial recommendations that triggered the review.
- Attorney-General's Department: It ran the Privacy Act Review, produced the report and the government response, and drafts the amending legislation.
- OAIC: The Office of the Australian Information Commissioner is the regulator that enforces the Act. It also made submissions to the review and implements much of what is enacted.
- Parliament: It passes the amending acts in tranches.
- Businesses and individuals: They are the ones the reforms regulate and protect.
The sequence so far is worth knowing because it explains why some changes are already law and others are not. The review began in October 2020. Its report, released on 16 February 2023, contained 116 proposals for reform. The government responded on 28 September 2023, agreeing to 38 proposals, agreeing in principle to a further 68, and noting 10. Rather than amend the Act once, the government split implementation into tranches. The first tranche, the Privacy and Other Legislation Amendment Act 2024 (Cth), was introduced in September 2024 and received Royal Assent on 10 December 2024. A second tranche is under development, with public consultation beginning in August 2025.
The first tranche: what is already law
The first tranche delivered four headline changes. They are not proposals anymore; they are in force.
A statutory tort for serious invasions of privacy
The most significant change is a new statutory tort for serious invasions of privacy, which commenced in June 2025. An individual can now sue another person directly for invading their privacy, without needing to prove financial loss. To succeed, the plaintiff must show that the defendant intruded upon their seclusion or misused information relating to them, that they had a reasonable expectation of privacy in the circumstances, that the invasion was intentional or reckless, that it was serious, and that the public interest in their privacy outweighed any countervailing public interest.
The tort sits in a schedule to the Act and is drafted broadly. It applies to any person or entity, not just businesses that are otherwise regulated under the Act. That is a point many business owners miss: the exemptions that keep small businesses outside the Australian Privacy Principles do not protect them from being sued under the tort. There are carve-outs for journalists in some circumstances and for intelligence and law enforcement bodies, and exemptions also apply in relation to people under 18, but a trading business should assume the tort reaches it. Defences include consent, lawful authority and necessity.
Courts can award damages and grant injunctions to stop an ongoing invasion. Because the action does not require proof of damage, even an invasion that causes no measurable financial loss can still attract a remedy. The tort operates alongside the OAIC complaints process rather than through it, so an individual is not dependent on the regulator deciding to act.
Higher penalties and new enforcement powers
The second change is a much larger penalty regime. The Act now distinguishes between serious and less serious interferences with privacy. For a serious interference, a body corporate can be ordered to pay the greatest of $50 million, three times the value of the benefit obtained from the conduct, or 30% of its adjusted turnover during the breach period. Individuals face a cap of $2.5 million. A separate mid-tier civil penalty of up to 2,000 penalty units applies to interferences with privacy that fall short of serious.
The OAIC also gained new enforcement tools. It can now issue infringement notices for certain breaches, effectively a ticket that can be paid without going to court, and compliance notices that require a business to fix its conduct. The same package created criminal offences in the Criminal Code Act 1995 (Cth) for doxxing, which means the menacing or harassing release of personal data using a carriage service such as social media or messaging apps. It also gave the Minister power to direct the Commissioner to develop and register APP codes and to run public inquiries, a lever designed to push faster regulatory action on emerging privacy issues.
A Children's Online Privacy Code
The third change obliges the Information Commissioner to develop and register a Children's Online Privacy Code, setting out how the Australian Privacy Principles are to be applied to the online privacy of children. The code is part of the ongoing implementation of the first tranche and will impose code-specific requirements on the businesses it binds once registered.
The second tranche: what is still anticipated
The second tranche is where the reforms that generated the most headlines over the years still sit. None of the following is law yet, and each is subject to change during consultation and drafting, but each was either agreed or agreed in principle in the government response. There is no legislated timetable for the tranche, and its final shape will depend on the outcomes of consultation and the parliamentary calendar.
The small business exemption
Businesses with an annual turnover of $3 million or less remain exempt from most of the Act under s 6D. The review recommended scrapping this exemption, and the OAIC has long argued for its removal, but the government declined to include it in the first tranche. It remains the most likely candidate for significant change in the second tranche.
The employee records exemption
Acts directly related to a current or former employment relationship and an employee record held by the employer remain exempt under s 7B(3). Like the small business exemption, it was recommended for removal and was left for the second tranche.
A direct right of action for breaches of the Australian Privacy Principles
The statutory tort covers serious invasions of privacy, but a broader right for individuals to sue directly for ordinary breaches of the Privacy Principles is still not law. Today, an individual affected by a breach must complain to the OAIC, which decides whether to investigate. The review proposed a direct right of action, and it remains under consideration.
Reform of consent and a fair and reasonable test
The review proposed defining consent as a clear, affirmative act and introducing a requirement that handling personal information be fair and reasonable in the circumstances, not merely consented to. Neither change has been legislated.
Transparency about automated decision-making
The review proposed that businesses be required to disclose when they make decisions that significantly affect individuals on the basis of automated processing. As at mid-2026, no such requirement appears in the Act.
A broader definition of personal information
The review proposed expanding the definition of personal information so that more data, including data that can identify a person only when combined with other information, falls within the Act's protection. The definition is unchanged so far.
Where the reforms bite: the traps for businesses
The current mix of old and new law creates several traps worth flagging.
The turnover threshold is a moving target
The small business exemption is assessed on your annual turnover for the previous financial year, not the current one, under s 6D(1). A business that grows past $3 million in a given year does not necessarily become an APP entity until the next year, but a business that has once exceeded the threshold cannot simply assume it is exempt again. Turnover is defined broadly and includes rent, interest and dividends as well as sales revenue.
The employee records exemption is narrow
It only covers acts directly related to the employment relationship and an employee record. Routine handling of a worker's personal information that is not captured in an employee record, such as marketing use of contact details or monitoring that goes beyond the employment context, is not protected by the exemption.
"Serious" is a judgement call with real consequences
The difference between a $2.5 million or $50 million penalty and the mid-tier penalty turns on whether an interference is serious. The Act lists factors a court may weigh, including the sensitivity of the information, the number of individuals affected, whether children or vulnerable people were involved, whether the conduct was repeated or continuous, and whether the business had failed to put adequate privacy systems in place. A single breach with wide reach can cross the line quickly.
The tort reaches beyond the Act's exemptions
Because the statutory tort applies to anyone who seriously invades privacy, a small business that is exempt from the Privacy Principles can still be sued for intruding on seclusion or misusing information. The exemption discussion and the tort exposure are separate questions, and a business should not assume that one answers the other.
Notifiable data breach obligations are unchanged
For APP entities, the obligation to notify the OAIC and affected individuals about eligible data breaches under Part IIIC continues to apply and now sits alongside the higher penalty regime.
How a privacy lawyer can help your business prepare
The reform program is not a single compliance event, which is where a privacy lawyer earns their keep. A lawyer can map which parts of the Act already apply to your business, including whether you sit above or below the turnover threshold and whether the employee records exemption covers what you actually do with worker information. They can review and redraft your privacy policy, collection notices and consent processes so that they will survive a move to a stricter consent standard, and they can assess your exposure to the statutory tort across activities such as surveillance, biometric collection and data sharing. If the OAIC investigates a complaint or issues an infringement or compliance notice, a lawyer can manage that response and negotiate outcomes. For businesses above the threshold, a lawyer can also advise on notifiable data breach response before an incident happens, rather than after.
Getting ahead of the second tranche
If there is one thing to take from where the reforms now stand, it is this: the two exemptions that most small and medium businesses rely on, the small business exemption and the employee records exemption, are the ones the second tranche is most likely to revisit, and the statutory tort already applies to you regardless of turnover. The cost of being caught flat-footed, whether through a tort claim, an OAIC investigation or a penalty calculated on 30% of turnover, is far higher than the cost of a basic privacy audit now. A review of what you collect, why you collect it, what your notices say and how your staff handle personal information is a manageable project, and it positions you to absorb the second tranche when it arrives.