AMLCompliant, home

Privacy Act guide · general information, not legal advice

Privacy Act changes 2026: the business guide

What is already law under the Privacy Act 1988, what starts on 10 December 2026, and what is only proposed. Written for small accounting practices, real estate agencies, conveyancers and legal practices, from the authorised text of the Act.

Last checked 25 September 2026 against the Privacy Act 1988 compilation C2026C00227 (compilation date 4 June 2026) and the Privacy and Other Legislation Amendment Act 2024 (C2024A00128)

s 6D(1) the law, read in the authorised textOAIC guidance the regulator's published guidance, which is not law

The dates at a glance

  1. 10 December 2024

    The Privacy and Other Legislation Amendment Act 2024 (the POLA Act) received Royal Assent. Most of Schedule 1 commenced the next day, 11 December 2024. That included the new mid-tier and low-tier civil penalties, compliance notices and the duty to make a Children's Online Privacy Code.

    POLA Act s 2
  2. 10 June 2025

    The statutory tort for serious invasions of privacy commenced. It is Schedule 2 to the Privacy Act.

    Sch 2 POLA Act s 2
  3. 1 July 2026

    AML/CTF obligations applied to tranche 2 services from this date. A small business operator that is a reporting entity is covered by the Privacy Act for its AML/CTF activities. The Commonwealth penalty unit also rose to $364.

    s 6E(1A) OAIC Crimes Act s 4AA
  4. 31 August 2026

    The Attorney-General's Department released an exposure draft Privacy Amendment (Personal Data Protection) Bill 2026 for consultation. Submissions closed on 18 September 2026. It is a draft, not law.

    AGD consultation page
  5. 10 December 2026

    APP 1.7 to 1.9 start: a privacy policy must describe certain automated decisions. The OAIC says the Children's Online Privacy Code will be in place by this date. The Act gives the Commissioner 24 months, beginning on the day of Royal Assent, to develop and register it.

    s 26GC(10) POLA Act s 2 OAIC

Does the Act apply to you?

Most businesses with annual turnover of $3,000,000 or less are outside the Privacy Act.1 Size alone does not settle it for the practices this site serves. All or part of the Act still applies to a small business if:

  • you are an AML/CTF reporting entity. The Act then applies to your activities for AML/CTF purposes as if you were an organisation, whatever your turnover.2 s 6E(1A)
  • one of the cases in s 6D(4) applies to you. Examples are trading in personal information and being a contracted service provider for a Commonwealth contract.1
  • you hold tax file number information. The tax file number rules bind anyone who holds it, and the Notifiable Data Breaches scheme covers it.3

The full test, and what does not count, is in Does the Privacy Act apply to your small business?

AML/CTF tranche 2 brings practices in

From 1 July 2026, AML/CTF obligations applied to listed services provided by real estate agencies, conveyancers, legal practices and accountants. Once you are a reporting entity, the Privacy Act applies to what you do to meet those obligations.2

The OAIC's guidance for reporting entities, updated on 28 August 2026, says:4 OAIC

  • the Privacy Act applies to these activities "regardless of whether those entities fall within the definition of a small business";
  • you must have a privacy policy and collection notices that explain how you handle personal information for your AML/CTF obligations;
  • the AML/CTF Act does not require you to keep copies of identity documents. You should take reasonable steps to destroy or de-identify those copies once you no longer need them, and keep instead the details you need, such as the document type and the outcome of verification.

The OAIC also publishes a template collection notice for reporting entities. More in AML tranche 2 and the Privacy Act.

What applies now

If the Act applies to you, these obligations are already in force:

  • A privacy policy. It must be clearly expressed and up to date, and must cover the matters listed in APP 1.4. These include the kinds of information you hold, how to access and correct it, how to complain, and whether you are likely to disclose it overseas.5
  • Collection notices. When you collect personal information, you must take reasonable steps to tell the person the APP 5.2 matters, at or before the time or as soon as practicable afterwards.5
  • Data breaches. If you suspect an eligible data breach, you must carry out a reasonable and expeditious assessment. You must take all reasonable steps to complete it within 30 days after you become aware.6 s 26WH(2) If you believe one has happened, you must notify the Commissioner and the affected individuals as soon as practicable.6

Missing or incomplete privacy policies are low-tier civil penalty matters that can lead to an infringement notice.7 s 13K(1) See Privacy Act penalties 2026.

10 December 2026: automated decisions

From 10 December 2026 your privacy policy must say more if you have arranged for a computer program to make a decision, or to do something substantially and directly related to making one, where:8

  • the decision could reasonably be expected to significantly affect an individual's rights or interests; and
  • personal information about that individual is used in the program.

The policy must then state the kinds of personal information used, the kinds of decisions the program makes alone, and the kinds of decisions in which it does something substantially and directly related. This applies to decisions made after the new principles commence, even if the system was set up, or the information collected, earlier.8

The OAIC ran a consultation on an issues paper from 18 May 2026 to 15 June 2026 to inform its guidance, and said it intended to release guidance by September 2026.9 OAIC Check oaic.gov.au for the current version. Detail: automated decision-making disclosure.

The Children's Online Privacy Code

The Commissioner must develop and register the Code within 24 months beginning on the day of Royal Assent, 10 December 2024.10 s 26GC(10) The OAIC says the Code "will be in place by 10 December 2026".11 It will bind an APP entity that provides a social media service, a relevant electronic service or a designated internet service (as defined in the Online Safety Act 2021) that is likely to be accessed by children, unless the entity is providing a health service. The Code can also name other APP entities that are bound, or entities that are not.10 Whether your website or app is caught depends on those tests and on the Code as registered. See the Children's Online Privacy Code.

The statutory tort

Since 10 June 2025 an individual can sue for a serious invasion of privacy, by intrusion upon seclusion or misuse of information, where the invasion was intentional or reckless.12 There is no turnover threshold, and the OAIC has no direct role: claims go to court. See the statutory tort.

Penalties in brief

Maximum civil penalties, for conduct on or after 1 July 2026
Tier Provision Body corporate Anyone else
Serious interference with privacy s 13G The greatest of $50 million; 3 times the benefit, if the court can determine it; or, if the court cannot determine the benefit, 30% of adjusted turnover $2,500,000
Interference with privacy s 13H $3,640,000 $728,000
Listed APP breaches, such as the privacy policy s 13K $364,000 $72,800

These are maximums a court can order, not typical outcomes. The dollar amounts for ss 13H and 13K are our arithmetic at the $364 penalty unit.13 The detail is in Privacy Act penalties 2026.

Proposed, not law

The exposure draft of 31 August 2026 is a consultation document. The Attorney-General's Department says the Bill "remains subject to further consideration by government".14 AGD The draft keeps the small business exemption. It re-words the trading carve-outs in s 6D(4). No Bill to remove the exemption has been introduced to Parliament. We will update these guides if that changes.

Where to go next

Run the free Privacy Act checkerUse the free checklist

More guides in this section:

AMLCompliant is published by Wani Meridian Pty Ltd, an independent private business. We are not affiliated with, or endorsed by, the Office of the Australian Information Commissioner, the Attorney-General's Department or any other government body. This guide is general information, not legal advice.

Independent. Not affiliated with, or endorsed by, AUSTRAC or the Australian Government.

Sources

Law is quoted from the authorised text on the Federal Register of Legislation, opened 25 September 2026. OAIC and Attorney-General's Department pages are guidance, not law. They open in a new window, and linking to them does not mean either body endorses this page.

  1. Privacy Act 1988 ss 6C(1), 6D(1), (3) and (4), compilation No. 104 (C2026C00227). legislation.gov.au/C2004A03712/latest/text

  2. Privacy Act 1988 s 6E(1A).

  3. Privacy Act 1988 ss 11(1), 17, 18 and 26WE(1)(d).

  4. OAIC, "Privacy guidance for reporting entities under the Anti-Money Laundering and Counter-Terrorism Financing Act", updated 28 August 2026. Guidance, not law. oaic.gov.au

  5. Privacy Act 1988, Schedule 1, APP 1.3 to 1.6 and APP 5.1 to 5.2.

  6. Privacy Act 1988 ss 26WE, 26WH(2), 26WK and 26WL.

  7. Privacy Act 1988 ss 13K(1)(b)(i) and (ii), and 80UB(1)(a).

  8. Privacy and Other Legislation Amendment Act 2024 (No. 128, 2024; C2024A00128), Schedule 1, items 87 to 89 (new APP 1.7 to 1.9), commencing under POLA Act s 2(1), table item 7. legislation.gov.au/C2024A00128/latest/text

  9. OAIC, "Consultation on guidance for transparency in automated decision-making", published 18 May 2026, and the issues paper. Guidance, not law. oaic.gov.au

  10. Privacy Act 1988 s 26GC(5), (7) and (10).

  11. OAIC, "Children's Online Privacy Code". Guidance, not law. oaic.gov.au

  12. Privacy Act 1988, Schedule 2, clause 7(1); compilation endnote 3 ("sch 2: 10 June 2025"). OAIC, "Statutory tort for serious invasions of privacy" (guidance). oaic.gov.au

  13. Privacy Act 1988 ss 13G(2) to (4), 13H(3) and 13K(4); Regulatory Powers (Standard Provisions) Act 2014 s 82(5); Crimes (Amount of a Penalty Unit) Instrument 2026 (F2026N00424). The $50 million tier was set by the Privacy Legislation Amendment (Enforcement and Other Measures) Act 2022; ss 13H and 13K were inserted by the POLA Act. legislation.gov.au/F2026N00424/latest/text

  14. Attorney-General's Department, "Privacy reform: consultation on exposure draft legislation". Guidance, not law. consultations.ag.gov.au

Questions

Does the Privacy Act apply to a business under $3,000,000 turnover?

Generally not. A business with annual turnover of $3,000,000 or less for the previous financial year is a small business (s 6D(1)), and a small business operator is outside the definition of an organisation (s 6C(1)). But the cases in s 6D(4) take a business outside the exemption, and a small business operator that is an AML/CTF reporting entity is treated as an organisation for its AML/CTF activities (Privacy Act s 6E(1A)). See Does the Privacy Act apply to your small business?

What starts on 10 December 2026?

Two things. New APP 1.7 to 1.9 start: a privacy policy must describe certain automated decisions (Privacy and Other Legislation Amendment Act 2024, Schedule 1, Part 15, which commences on 10 December 2026, the day after the 24-month period that began with Royal Assent on 10 December 2024). And the Children's Online Privacy Code is due: the Information Commissioner must develop and register it within the 24 months beginning on the day of Royal Assent (s 26GC(10)), and the OAIC says it will be in place by 10 December 2026.

Is the statutory tort in force?

Yes. Schedule 2 to the Privacy Act commenced on 10 June 2025. Damages for non-economic loss plus any exemplary or punitive damages cannot exceed the greater of $478,550 and the maximum for non-economic loss in defamation proceedings (Sch 2 cl 11(5)).

Has the small business exemption been taken away?

No. It is still law. The exposure draft the Attorney-General's Department released on 31 August 2026 keeps it, and no Bill to change it has been introduced to Parliament. Do not put a removal date in your calendar.