Australian Privacy Act
Privacy Act 1988 and the Australian Privacy Principles — OAIC (Office of the Australian Information Commissioner)
Also known as: Privacy Act 1988, APP, Australian Privacy Principles, NDB scheme
Official site Official change log Subscribe to Australian Privacy Act (RSS)
At a glance
- Status
- In force
- Next deadline
- in 31 days
- APP entities must disclose in their privacy policy when computer programs make or inform decisions that significantly affect individuals (APP 1.7-1.9) source
- Who must comply
- Australian Government agencies and organisations with annual turnover above $3 million, plus smaller businesses such as health service providers, traders in personal information and Commonwealth contractors. source
- How it is assessed
- Entities comply with the APPs themselves; data breaches carry assessment and notification duties, and privacy policies gain an automated decision disclosure from December 2026. source
- Authority
- An Act of the Australian Parliament. The Office of the Australian Information Commissioner (OAIC) investigates and can apply to the Federal Court for civil penalty orders. source source
- Enforced by
- The OAIC investigates and seeks civil penalty orders from the Federal Court; penalties range from infringement-notice amounts to the greater of $50 million, three times the benefit or 30% of turnover. source
- Last change
- None recorded yet
The Australian data protection regime, built on thirteen Australian Privacy Principles and a notifiable data breach scheme. It carries a statutory tort for serious invasions of privacy and tiered civil penalties, which makes its subordinate instruments worth watching separately from the Act.
Recent changes
No changes recorded yet — we are watching, and nothing has been published.
Key dates
Add these dates to your calendar- in 31 days APP entities must disclose in their privacy policy when computer programs make or inform decisions that significantly affect individuals (APP 1.7-1.9)
- Submissions on the draft privacy reform legislation and consultation paper close
- Government releases a consultation paper and draft legislation for further privacy reforms
- Federal Court orders the first civil penalties under the Privacy Act ($5.8 million against Australian Clinical Labs)
- Statutory tort for serious invasions of privacy takes effect
Amendments
-
Draft privacy reform legislation and consultation paper (31 August 2026) Draft
The Government released a consultation paper and draft legislation to modernise and strengthen Australia's privacy laws; submissions closed on 18 September 2026. source
More
- A fair and reasonable test for collecting and using personal information.
- A right to erasure for large digital platforms such as social media and search.
- Stronger consent standards and measures against trading in personal information without clear permission.
-
Privacy Act 1988 (Compilation No. 104) AmendmentCurrent text
Minor amendments by the Strengthening Oversight of the National Intelligence Community Act 2025 (Schedule 1, items 240 and 241). source
-
Compilation No. 103 (statutory tort) Amendment
Schedule 2 of the Privacy and Other Legislation Amendment Act 2024 took effect, adding a statutory tort for serious invasions of privacy as Schedule 2 to the Act. source
-
Compilation No. 102 Amendment
Consequential amendments by the Universities Accord (National Student Ombudsman) Act 2024. source
-
Compilation No. 101 (2024 privacy reforms) Amendment
Most of Schedule 1 of the Privacy and Other Legislation Amendment Act 2024 took effect. source
More
- It inserted a civil penalty for an interference with privacy that is not serious (section 13H) and a penalty for specified APP breaches that allows infringement or compliance notices (section 13K).
- It requires the Commissioner to develop and register a Children's Online Privacy Code within 24 months of Royal Assent (section 26GC).
- The automated decision transparency duty in APP 1 (items 87 and 88) takes effect separately, on 10 December 2026.
Show 2 older amendments
Who it applies to
The Act binds APP entities - agencies and organisations - to the 13 Australian Privacy Principles, with an exemption for most small businesses.
- Small business
- A business with annual turnover of $3,000,000 or less is a small business (section 6D) and generally outside the Act. source
- Small businesses still covered
- Those that provide a health service and hold health information, trade in personal information, are Commonwealth contracted service providers or are credit reporting bodies (section 6D(4)). source
- Outside Australia
- The Act extends to acts and practices outside Australia of an organisation with an Australian link (section 5B). source
- Statutory tort
- Individuals have a cause of action in tort against another person for a serious, intentional or reckless invasion of privacy, actionable without proof of damage (Schedule 2, clause 7). source
How compliance is assessed
Entities comply with the APPs themselves; data breaches carry assessment and notification duties, and privacy policies gain an automated decision disclosure from December 2026.
- Breach assessment
- Where an entity suspects an eligible data breach, it must take all reasonable steps to complete an assessment within 30 days (section 26WH). source
- Breach notification
- For an eligible data breach, prepare a statement, give it to the Commissioner and notify affected individuals as soon as practicable (sections 26WK and 26WL). source
- Automated decisions
- From 10 December 2026, privacy policies must describe the kinds of personal information and decisions involved where computer programs make or inform decisions that significantly affect individuals' rights or interests. source
Enforcement and penalties
The OAIC investigates and seeks civil penalty orders from the Federal Court; penalties range from infringement-notice amounts to the greater of $50 million, three times the benefit or 30% of turnover.
Greater of $50M, 3x benefit or 30% turnover
Section 13G, for a body corporate's serious interference with privacy; 30% of adjusted turnover applies when the court cannot determine the benefit. Up to $2,500,000 for persons other than bodies corporate. source
Up to 2,000 penalty units
Section 13H, for an interference with privacy that is not serious. source
Up to 200 penalty units
Section 13K, for breaching specified APPs (for example privacy policy content and direct marketing opt-outs) or a non-compliant eligible data breach statement; these can be dealt with by infringement or compliance notices. source
- First civil penalties
- On 8 October 2025 the Federal Court ordered the first civil penalties under the Privacy Act, against Australian Clinical Labs; the penalties applied the regime in force before 13 December 2022. source
Recent fines
-
AUD 5.8 million
Federal Court penalties against Australian Clinical Labs over the February 2022 Medlab Pathology data breach, including $4.2 million for failing to protect personal information under APP 11.1. source
Documents
Frequently asked questions
What is the maximum penalty under the Australian Privacy Act?
For a body corporate's serious interference with privacy, the greatest of $50 million, three times the benefit obtained, or 30% of adjusted turnover in the breach turnover period when the benefit cannot be determined (section 13G). source
Is there a tranche 2 of the Privacy Act reforms?
Further reforms are in draft. On 31 August 2026 the Government released a consultation paper and draft legislation, including a fair and reasonable test and a right to erasure for large platforms; submissions closed on 18 September 2026. source
Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 29 September 2026. Subscribe to Australian Privacy Act (RSS)