Privacy Act 2026
Privacy Act Changes 2026: Every Date Your Australian Business Needs on the Calendar
A clean timeline of Australia's Privacy Act 1988 changes for 2026: the statutory tort (in force 10 June 2025), AML Tranche 2 (1 July 2026), automated decision-making disclosure and the Children's Online Privacy Code (both 10 December 2026), and the proposed exemption removal. Source-checked.
Australia's privacy reforms are landing on a staggered schedule, which is exactly why businesses miss the date that affects them. Here is the whole calendar in one place, with what is in force, what is legislated, and what is still only proposed.
(About Australia's Privacy Act 1988, not the US Privacy Act of 1974.)
The timeline
| Date | Change | Status |
|---|---|---|
| 11 December 2024 | Privacy and Other Legislation Amendment Act 2024 receives Royal Assent | Done |
| 10 June 2025 | Statutory tort for serious invasions of privacy commences | In force |
| 31 March 2026 | AUSTRAC enrolment opens for AML Tranche 2 sectors | Done |
| 18 May – 15 June 2026 | OAIC draft ADM guidance consultation open | Done |
| 1 July 2026 | AML/CTF Tranche 2 obligations begin; Privacy Act attaches to AML personal information regardless of turnover | Legislated |
| 29 July 2026 | Deadline to apply to enrol with AUSTRAC (within 28 days of first designated service) | Legislated |
| 10 December 2026 | Automated decision-making disclosure becomes mandatory in privacy policies | Legislated |
| 10 December 2026 | Children's Online Privacy Code must be finalised/registered by the OAIC | Legislated deadline |
| No confirmed date | Proposed removal of the $3M small-business exemption | Proposed only — not law |
What's in force now
Statutory tort (10 June 2025). Individuals can sue directly for a serious invasion of privacy, regardless of your turnover. See the statutory tort explained. (Source: OAIC.)
The Notifiable Data Breaches scheme also applies today — assess a suspected eligible breach within 30 days. See the data-breach response plan.
1 July 2026 — AML Tranche 2
New professions become reporting entities, and the personal information they collect for AML/CTF falls under the Privacy Act regardless of turnover. The enrolment deadline is 29 July 2026 (not 29 June — that figure is incorrect). See AML Tranche 2 and the Privacy Act. (Source: AUSTRAC.)
10 December 2026 — two deadlines
ADM disclosure becomes mandatory in privacy policies (see the ADM guide), and the OAIC must finalise the Children's Online Privacy Code (see the Children's Code guide).
The proposed item — keep it off your deadline list
The removal of the $3M small-business exemption is proposed, not law, with no confirmed date. Do not put it on your calendar as a deadline. See the $3 million exemption explained.
Run the free checker to see which of these dates are actually yours.
General information only, not legal or compliance advice. Current to June 2026; confirm your obligations at oaic.gov.au and austrac.gov.au or with a qualified adviser. Last verified: 8 June 2026.
Run the free ML/TF risk assessment →