Quick answer
Recent Privacy Act changes in Australia have increased penalties, introduced a statutory right to sue for serious invasions of privacy and added more transparency about automated decisions. Businesses covered by the Act should review their privacy policy, forms, data security and breach response.
Key takeaways
- Check whether the Privacy Act applies to your business.
- Know what personal data you collect and why.
- Keep your privacy policy accurate and easy to read.
- Have a data breach response plan.
Does the Privacy Act apply to you?
The Act generally covers businesses with an annual turnover above $3 million, plus some smaller ones, such as health service providers and businesses that trade in personal information.
If you are unsure, check with the Office of the Australian Information Commissioner (OAIC).
What should you review on your website?
- Your privacy policy: is it current and written in plain language?
- Contact and enquiry forms: do they collect only what you need?
- Cookies and tracking tools: do you explain them?
- Where data is stored and who can access it.
- Third-party tools, such as email platforms and analytics.
What about data security and breaches?
- Limit who can see personal information.
- Use strong passwords and multi-factor authentication.
- Keep software updated.
- Delete data you no longer need.
- Write a simple breach response plan, so you know who acts first.
What changes are worth watching?
| Area | Direction of change |
|---|---|
| Penalties | Higher for serious or repeated breaches |
| Right to sue | Statutory tort for serious privacy invasions |
| Automated decisions | More transparency about their use |
| Children's privacy | A dedicated code is being developed |
Keep it practical
This is general information, not legal advice. For firm answers about Privacy Act changes, speak to the OAIC or a qualified privacy lawyer. Review your website, forms and data practices at least once a year, so changes never catch you by surprise.
Bottom line
Keep up with Privacy Act changes by doing the basics well. Know what personal information you collect, say so clearly, keep it secure and delete it when you no longer need it. If unsure, get advice from the OAIC or a privacy lawyer.
Sources and further reading
- Office of the Australian Information Commissioner: Privacy
- OAIC: Notifiable Data Breaches
- Attorney-General's Department: Privacy reform
Checked against the sources above and our own project experience. Last reviewed 7 October 2026.
