What Do the Recent Privacy Act Reforms Mean for Australian Businesses?
The Privacy and Other Legislation Amendment Act 2024 introduced a statutory tort for serious invasions of privacy, tougher OAIC enforcement powers and, from 10 December 2026, new privacy policy disclosures for automated decisions. Businesses covered by the Privacy Act should review their privacy policy, data handling and security controls now.
Written and reviewed by The Technology Office · Independent technology advisory
Key takeaways
- The Privacy and Other Legislation Amendment Act 2024 received Royal Assent on 10 December 2024 and is the first tranche of broader reform.
- A statutory tort for serious invasions of privacy has applied since 10 June 2025, giving individuals a direct right to sue.
- From 10 December 2026, privacy policies must explain the use of personal information in automated decisions that significantly affect individuals.
- The OAIC now has tiered civil penalties, infringement notices and compliance notices, making administrative failures such as a weak privacy policy more likely to attract action.
The short answer
The Privacy and Other Legislation Amendment Act 2024 is the biggest change to Australian privacy law in years, and its next major milestone for businesses arrives on 10 December 2026, when privacy policies must explain how personal information is used in significant automated decisions. It also created a statutory tort for serious invasions of privacy and gave the Office of the Australian Information Commissioner (OAIC) new, faster enforcement tools. If your business is covered by the Privacy Act, check now that your privacy policy, data handling and security match what actually happens.
This article is general information, not legal advice. Privacy obligations depend on your circumstances, so confirm your position with a qualified lawyer and the OAIC.
What changed, and when?
The Act passed Parliament on 29 November 2024 and received Royal Assent on 10 December 2024. Most provisions started straight away, but two significant changes were staged.
| Change | What it means | Timing |
|---|---|---|
| Tiered civil penalties, infringement notices and compliance notices | The OAIC has more options for lower-level contraventions, not just court action for the most serious breaches | In force since December 2024 |
| Clarified security obligation (APP 11) | Reasonable steps to protect personal information expressly include technical and organisational measures | In force since December 2024 |
| Statutory tort for serious invasions of privacy | Individuals can sue for serious intrusion upon seclusion or misuse of information | In force since 10 June 2025 |
| Automated decision-making transparency (APP 1) | Privacy policies must describe the use of personal information in significant automated decisions | From 10 December 2026 |
| Children's Online Privacy Code | The OAIC must develop a code for online services likely to be accessed by children | Under development by the OAIC |
| Overseas disclosure "whitelist" | A mechanism to prescribe countries and schemes with substantially similar protections | Mechanism created; depends on regulations |
What is the automated decision-making obligation?
From 10 December 2026, APP entities that arrange for a computer program to make, or do something substantially and directly related to making, decisions that could reasonably be expected to significantly affect an individual's rights or interests must explain this in their privacy policy. The OAIC has published resources on the obligation. The policy needs to describe:
- the kinds of personal information used by those programs;
- the kinds of decisions made solely by the programs; and
- the kinds of decisions where the programs do something substantially and directly related to making the decision.
That last limb matters. A decision signed off by a person can still be caught if software scores, ranks or shortlists people first. Practical examples could include:
- credit or payment-term decisions driven by an automated scoring model;
- recruitment software that screens or ranks candidates;
- eligibility or pricing rules applied automatically in an online portal;
- AI tools that recommend whether a claim, application or account is approved.
Writing the privacy policy wording is quick. Finding every system that does this is not. Many automated decisions sit inside SaaS products where the business has never documented the logic. This is also where privacy reform meets AI governance, which we cover in our guide to Australian AI regulation for business.
What does the new privacy tort mean?
Since 10 June 2025, individuals have had a cause of action for serious invasions of privacy, either by intrusion upon seclusion (for example, unauthorised surveillance) or by misuse of information about them. The invasion must be serious, and the court weighs the public interest in privacy against countervailing interests such as freedom of expression and public safety.
The OAIC does not run these cases; they go through the courts. For businesses, the practical effect is that poor handling of personal information now carries direct legal exposure to individuals, on top of regulatory risk.
What do the new OAIC powers change?
Before the reforms, the main civil penalty provision was aimed at serious or repeated interferences with privacy and required court proceedings. The Act added further penalty tiers, gave the OAIC the ability to issue infringement notices for certain administrative contraventions, and allowed it to issue compliance notices requiring a business to fix specific problems.
In practice, that makes everyday failures more visible: a privacy policy that does not reflect real practices, missing collection notices, or mishandled direct marketing opt-outs. These were once low-risk in enforcement terms. That has changed.
Which businesses are covered?
The Privacy Act applies to "APP entities", which includes Australian Government agencies and most organisations with annual turnover above $3 million. Some smaller businesses are also covered, including health service providers and businesses that trade in personal information. The privacy tort is broader and is not limited to APP entities.
Further reforms recommended by the Privacy Act Review, including possible changes to the small business exemption, were not part of the 2024 Act and would require future legislation. Track official announcements rather than commentary.
What should businesses do now?
A practical sequence for the weeks ahead:
- Map your personal information. List what you collect, why, where it is stored (including in SaaS and AI products) and who can access it.
- Inventory automated decisions. Ask each team and key vendors where software makes or materially shapes decisions about customers, staff or applicants.
- Rewrite the privacy policy against reality. Generic templates are unlikely to describe your actual automated decisions or data flows.
- Test your security controls. APP 11 now explicitly refers to technical and organisational measures, such as MFA, access reviews, encryption, logging and staff training.
- Check breach readiness. Confirm your process for assessing suspected eligible data breaches and notifying under the Notifiable Data Breaches scheme.
- Review vendor contracts. Make sure providers that process personal information give you the information and controls you need to meet your obligations.
- Report to the board. Directors should see a short summary of exposure, gaps and the remediation plan.
Staff pasting customer data into public generative AI tools is a common gap that touches several of these steps. See our article on ChatGPT, Copilot and data risk.
How The Technology Office helps
Privacy reform is now as much a technology and governance problem as a legal one. Lawyers interpret the obligation, but someone has to find the automated decisions, trace the data flows and fix the controls. The Technology Office leads that work from a CIO-level, board-facing perspective. We are independent and vendor-neutral, and we keep the response proportionate, so a mid-sized business is not handed an enterprise compliance program.
We work alongside your legal advisers through our IT governance and risk consulting and AI governance consulting, for businesses of any size and industry across Australia. You get a clear inventory, a prioritised remediation plan and a plain-English report your board can act on.
Frequently asked questions
When do the automated decision-making privacy changes start?
From 10 December 2026, APP entities must include information in their privacy policy where a computer program is used to make, or do something substantially and directly related to making, decisions that could significantly affect individuals' rights or interests. Check the OAIC website for its current guidance.
What is the statutory tort for serious invasions of privacy?
It is a new legal right, in force since 10 June 2025, that lets individuals sue for serious invasions of privacy involving intrusion upon seclusion or misuse of information. It is pursued through the courts rather than by the OAIC.
Do the Privacy Act reforms apply to small businesses?
Most businesses with annual turnover of $3 million or less remain generally exempt from the Privacy Act, but there are exceptions, including health service providers and businesses that trade in personal information. The statutory tort is separate and is not limited to APP entities, so get legal advice on your position.
Has the small business exemption been removed?
Not as part of the 2024 Act. Changes to the exemption were among the Privacy Act Review proposals left for later reform, so businesses should watch for announcements from the government and the OAIC.
What should a business do first to prepare?
Map where personal information is collected, stored and used, identify any automated decisions that rely on it, update the privacy policy to match reality, and confirm security controls and breach response plans are current.
Sources and further reading
- Passing of bill a significant step for Australia's privacy law — Office of the Australian Information Commissioner
- New resources on transparency for use of AI and automated decision-making — Office of the Australian Information Commissioner
- Privacy and Other Legislation Amendment Act 2024 — Federal Register of Legislation
Mentioned services
These service and regional NSW pages expand on the topics covered in this article.
Need help applying this?
Bring in senior technology leadership without the full-time overhead.
The Technology Office works with Sydney and regional NSW businesses on embedded CIO support, Head of IT leadership, governance, vendor management, cost optimisation, crisis stabilisation, and no-cost technology reviews as a lighter first step.