A Complete Guide to Data Protection in Australia

Summary

Australia’s main data protection law is the Privacy Act 1988, enforced by the OAIC. It covers federal agencies and organisations with annual turnover above AUD 3 million, plus some smaller businesses. Its 13 Australian Privacy Principles govern how organisations collect, use, disclose, secure, access, and correct personal information. Reforms since December 2024 add a privacy tort, automated decision transparency and a children’s code, with further changes proposed.

This guide covers the legal framework, who it applies to, the Australian Privacy Principles, individual rights, breach notification, the recent reforms, the proposed second tranche, and how Australian law differs from the GDPR. It reflects the position at the time of writing.

Key Takeaways

• The Privacy Act 1988 and its 13 Australian Privacy Principles (APPs) are the core of Australian data protection. The Office of the Australian Information Commissioner (OAIC) regulates them.

• The Act does not use GDPR terms such as controller, processor or lawful basis, and it gives individuals no general right to erasure or portability. Compliance with the GDPR does not mean compliance with the Privacy Act, and vice versa.

• Reform is under way. Some changes from December 2024 apply now; the automated decision and children’s code changes are due by 10 December 2026, and a second tranche of reforms is still at draft stage.

The Privacy Act 1988 Is the Main Law

The Privacy Act 1988 is the federal law that protects individuals’ privacy and regulates how agencies and organisations handle personal information. It sets out 13 Australian Privacy Principles. The Act also covers consumer credit reporting, tax file numbers and health and medical research.

State and territory laws cover their own public sector bodies, including public hospitals. Other laws add sector rules, such as those for My Health Record and telecommunications. OAIC guidance explains how the Act applies in practice, and our guide to the Australian Privacy Principles covers each one.

The OAIC receives complaints, can investigate on its own initiative, and carries out privacy assessments. Breaching an Australian Privacy Principle interferes with an individual’s privacy and can lead to regulatory action and penalties.

The Act Covers Agencies and Larger Organisations

The Act’s obligations apply to Australian Government agencies and to organisations with an annual turnover of more than AUD 3 million, with some exceptions. Together they are called APP entities.

Some smaller businesses are covered regardless of their turnover. The OAIC lists these, among others:

• private sector health service providers, which includes gyms, child care centres and private schools;

• businesses that sell or buy personal information;

• credit reporting bodies;

• businesses accredited under the Consumer Data Right;

• businesses that have opted in to the Act; and

• businesses related to a covered business.

The Act also covers some activities of other small businesses, including those of reporting entities under the anti-money laundering and counter-terrorism financing law.

The Act does not cover state or territory agencies, individuals acting in a personal capacity, registered political parties, and a media organisation acting in the course of journalism if it is publicly committed to published privacy standards. The Act exempts the handling of employee records in some situations.

Foreign organisations can also be caught. The Act applies to overseas businesses that carry on business in Australia, so an international company selling to Australian customers should check whether it falls within the Act.

The 13 Australian Privacy Principles Set the Standards

The Australian Privacy Principles are principles-based and technology neutral. The OAIC groups them around four areas:

• the collection, use and disclosure of personal information;

• governance and accountability;

• the integrity and correction of personal information; and

• individuals’ rights of access.

In practice, the principles require an organisation to:

• manage personal information openly, with a clear and current privacy policy;

• collect only information that is reasonably necessary for its functions, and tell people about the collection;

• use and disclose information only for the purpose it was collected for, unless an exception applies;

• take reasonable steps to keep information accurate and secure, and to destroy or de-identify it when no longer needed;

• respect opt-out requests for direct marketing;

• take care before disclosing information overseas; and

• give people access to their information and correct it on request.

Sensitive information, such as health or biometric information, carries extra restrictions, and collecting it generally needs consent unless an exception applies. The Australian Privacy Principles guide covers the details.

Individuals Have a Set of Defined Rights

The OAIC says the Act lets people:

• know why their information is collected, how it will be used and who will receive it;

• choose not to identify themselves, or use a pseudonym, in some circumstances;

• ask for access to their information;

• ask for incorrect information to be corrected;

• stop unwanted direct marketing; and

• make a complaint about an organisation or agency the Act covers.

The Act does not give a general right to erasure or data portability. APP 11 requires reasonable steps to destroy or de-identify information once it is no longer needed, which is not the same as a right to demand deletion. The Consumer Data Right provides data transfer rights only in designated sectors.

The Notifiable Data Breaches Scheme Requires Notice

Under the Notifiable Data Breaches Scheme, an organisation or agency covered by the Act must notify affected individuals and the OAIC when a data breach is likely to result in serious harm to an individual whose personal information is involved.

A data breach occurs when an organisation’s personal information is lost, accessed, or disclosed without authorisation. The OAIC’s examples are a lost device, a hacked database and information sent to the wrong person.

The notice to individuals must include recommendations about the steps they should take. The scheme works differently from the GDPR’s 72-hour rule, so compare the two if you operate in both places. See our guide to data breach reporting for the GDPR side.

Reforms From December 2024 Are Taking Effect in Stages

The Privacy and Other Legislation Amendment Act 2024 received Royal Assent on 10 December 2024. A law firm summary of the commencement dates lists these changes:

• Privacy tort: a statutory cause of action for serious invasions of privacy, to start on a date fixed by 10 June 2025.

• Automated decisions: new transparency duties, effective 10 December 2026. Organisations must state in their privacy policy when they make decisions using automated processes.

• Children’s Online Privacy Code: the OAIC must develop and register it by 10 December 2026.

• Overseas disclosures: a power to prescribe countries with substantially similar privacy protection, effective 11 December 2024.

• Enforcement: infringement notices and compliance notices, effective 11 December 2024.

• Security: a clarification that reasonable steps include technical and organisational measures, effective 11 December 2024.

• Doxxing: a new offence for sharing personal information with intent to harm, effective 11 December 2024.

The automated decision change needs preparation now. Map any system that helps decide on a person, and check that your privacy policy describes it.

The Children’s Online Privacy Code Is Due by December 2026

The OAIC says the Code is an APP code that sets out how online services likely to be accessed by children must comply with the APPs, with extra requirements for handling children’s information. It applies to social media services, relevant electronic services and designated internet services as defined in the Online Safety Act 2021.

The OAIC published an exposure draft on 31 March 2026, and submissions have closed. It says the OAIC must register the final Code by 10 December 2026. Check the OAIC’s Children’s Online Privacy Code page for the final text and start date.

A Second Tranche of Reforms Is Still at Draft Stage

Commentary reports that the Attorney-General’s Department released an exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026 on 31 August 2026. It is not law, and it has not been confirmed as introduced to Parliament.

Reports say the draft would replace several APPs on collection and use with a rule that collection, use and disclosure must be lawful and fair and reasonable in the circumstances, even where the person has consented. It is also reported that it would not remove the small business exemption. Check the Attorney-General’s Department website for the current status before relying on any of this.

Australian and EU Rules Work Differently

The Privacy Act and the GDPR share broad aims, but their structures differ. Our guide to comparing Australia’s data protection with the GDPR covers it in detail. The main differences are:

• Roles: the Act does not divide organisations into controllers and processors. Each entity that holds personal information carries its own obligations. Our guide to controllers and processors explains the GDPR roles.

• Legal bases: there is no list of lawful bases. APPs ask whether collection is reasonably necessary and require consent for sensitive information unless an exception applies.

• Rights: access, correction and marketing opt-out are in the Act, and erasure and portability are not.

• Scope: the AUD 3 million turnover threshold and the employee records exemption have no GDPR equivalent.

An Australian business that offers goods or services to people in the EU, or monitors their behaviour, may be subject to the GDPR as well. It would then need to meet both sets of rules.

A Practical Checklist Helps Australian Organisations Prepare

Work through these points:

• confirm whether the Act covers you, including through an exception for small businesses;

• review your privacy policy against the APPs and the automated decision change;

• map personal information flows, including overseas disclosures and suppliers;

• check security measures against the reasonable steps standard;

• test your data breach response against the NDB scheme; and

• if you serve children, follow the Children’s Online Privacy Code process.

Our guide to fines in Australia for data protection violations covers enforcement.

Conclusion

Australian data protection rests on the Privacy Act, its 13 APPs and the OAIC, with a breach notification scheme and a set of rights that differs from the GDPR. The law is changing in stages, and 10 December 2026 is the date to plan around for automated decision transparency and the Children’s Online Privacy Code.

We are updating this guide because the original was written before the Privacy and Other Legislation Amendment Act 2024 and before the second tranche of reforms was drafted. Review your privacy policy and processes against these points, and speak to our GDPR consultants if you want them checked.

Frequently Asked Questions

Does the GDPR Apply in Australia?

Not as such. Australia’s Privacy Act 1988 is the relevant law. The GDPR can still apply to an Australian business that offers goods or services to people in the EU or monitors their behaviour, so some organisations need to meet both.

Do Small Businesses Have to Comply With the Privacy Act?

Not usually, if annual turnover is AUD 3 million or less. Some small businesses are covered anyway, including health service providers, businesses that buy or sell personal information, credit reporting bodies and businesses that have opted in.

Is There a Right to Erasure in Australia?

Not as a general right. The Act provides access, correction, and marketing opt-out rights, and APP 11 requires reasonable steps to destroy or de-identify information no longer needed. A second tranche of reforms has been drafted, so check its status.

Disclaimer: This blog post is intended solely for informational purposes. It does not offer legal advice or opinions. This article is not a guide for resolving legal issues or managing litigation on your own. It should not be considered a replacement for professional legal counsel and does not provide legal advice for any specific situation or employer.