Yes. Download it straight from this page. There is no email field and nothing to sign up for.

What is the 30-day clock?

If you have reasonable grounds to suspect an eligible data breach, you must carry out a reasonable and expeditious assessment, and take all reasonable steps to complete it within 30 days after you become aware (s 26WH(2)).

Does it cover the AML/CTF collection notice?

Yes. The OAIC says reporting entities need a privacy policy and collection notices for their AML/CTF handling, and it publishes a template collection notice. Each sector edition of our AML/CTF kit includes a drafted collection notice for customer due diligence.

Privacy Act 2026 readiness checklist (free)

Ticks are not saved. They stay in this page until you close it. To keep a record, print the page or use the Word version. This checklist is general information about Australia's Privacy Act 1988, not legal advice.

s 26WH the law, read in the authorised textOAIC guidance the regulator's published guidance, which is not law

Download the checklist (.docx)Not sure the Act applies? Use the checker

1. Does the Act apply to you?

Tick any that are true. Turnover of $3,000,000 or less is usually exempt, but not always. s 6D(1)

Turnover has been over $3,000,000 in a financial year since you started, or a related company's business is not small. s 6D(4) s 6D(9)
You provide a health service and hold health information, other than in employee records. s 6D(4)Both parts must be true. Holding identity documents, biometrics or other sensitive information is not, on its own, one of the cases.
You disclose or collect personal information for a benefit, service or advantage, without consent and not because a law requires or authorises it. s 6D(4) s 6D(7)
You are a contracted service provider for a Commonwealth contract, or a credit reporting body. s 6D(4)Supplying services to a business that the Act covers does not count on its own.
You are an AML/CTF reporting entity. The Act then applies to your AML/CTF activities, whatever your turnover. s 6E(1A)

Only the first four cases take a business out of the small business exemption. A tick in one of them means the whole Act very likely applies. A tick in the fifth means it applies to your AML/CTF activities. Removing the small business exemption is not law. The exposure draft Bill released for consultation on 31 August 2026 keeps the exemption and re-words the trading cases, and no Bill to change the exemption has been introduced to Parliament.¹ AGD

2. In force now

You know about the statutory tort. Since 10 June 2025 an individual can sue for a serious invasion of privacy that was intentional or reckless. It has no turnover threshold.²
You can assess a suspected eligible data breach, and have a way to finish the assessment within 30 days. s 26WH
You know who to tell: a statement to the Commissioner as soon as practicable, then the people at risk. s 26WK s 26WL
Your privacy policy is clearly expressed and up to date (APP 1.3), and has the contents in part 5.³A missing or deficient policy can lead to an infringement notice: $21,840 for a body corporate, $72,800 for a listed corporation, $4,368 for an individual, for a contravention on or after 1 July 2026.⁴
You know the OAIC is checking privacy policies. It announced a review of about 60 entities in six sectors, including rental and property, against APP 1.4, starting in early 2026.⁵ OAIC

3. Automated decisions, from 10 December 2026

This applies if a computer program makes decisions, or does something substantially and directly related to making them, that could reasonably be expected to significantly affect a person's rights or interests, using their personal information. It covers decisions made once the rule starts on 10 December 2026.⁶

You have listed each such program, the decisions it affects and the personal information it uses.
Your privacy policy says the kinds of personal information those programs use.
It says the kinds of decisions the programs make on their own.
It says the kinds of decisions where a program does something substantially and directly related to making the decision.

4. Data breaches

You know what an eligible data breach is: unauthorised access to or disclosure of personal information, or its loss where that is likely, which a reasonable person would conclude is likely to result in serious harm. s 26WE
You know that quick remedial action can mean a breach does not have to be notified. s 26WF
You have a short written plan: who contains a breach, who assesses it, who decides whether to notify, and who writes the statement.

5. Your privacy policy

APP 1.4 lists what the policy must contain.³

The kinds of personal information you collect and hold.
How you collect and hold it.
Why you collect, hold, use and disclose it.
How a person can see their information and ask for it to be corrected.
How a person can complain, and how you deal with complaints.
Whether you are likely to disclose it overseas and, if practicable, to which countries.
It is free, and available in another form on request where reasonable (APP 1.5 and 1.6).
Your forms and onboarding give a collection notice (APP 5).
It is dated and easy to find on your website.

6. AML/CTF reporting entities

From the OAIC's guidance for reporting entities, updated 28 August 2026.⁷ OAIC

Your privacy policy and collection notices explain how you handle personal information for AML/CTF. The OAIC publishes a template collection notice.
You do not keep copies of identity documents you no longer need. The AML/CTF Act does not require copies: keep the details you need, such as the document type and the result of verification.
Your collection notice leaves out anything that would be inconsistent with your tipping-off obligations.

Where to go next

Download the checklist (.docx)Run the free checker

Data breaches: data breach response plan.
Automated decisions: what to disclose from 10 December 2026.
Reporting entities: AML tranche 2 and the Privacy Act.
Everything in 2026: the Privacy Act section. Every source we use: sources.

AMLCompliant is published by Wani Meridian Pty Ltd, an independent private business. We are not affiliated with, or endorsed by, the Office of the Australian Information Commissioner, the Attorney-General's Department or any other government body. This checklist is general information, not legal advice.

Independent. Not affiliated with, or endorsed by, AUSTRAC or the Australian Government.

Sources

Law is quoted from the authorised text on the Federal Register of Legislation, opened 25 September 2026. OAIC and Attorney-General's Department pages are guidance, not law. They open in a new window, and linking to them does not mean either body endorses this page.

Attorney-General's Department, "Privacy reform: consultation on exposure draft legislation" (consultation closed 18 September 2026), and the Exposure Draft Privacy Amendment (Personal Data Protection) Bill 2026. An exposure draft is not law. consultations.ag.gov.au
Privacy Act 1988, Schedule 2, clause 7(1); compilation No. 104 (C2026C00227), endnote 3 ("sch 2: 10 June 2025"). legislation.gov.au/C2004A03712/latest/text
Privacy Act 1988, Schedule 1, Australian Privacy Principles 1.3 to 1.6 and 5.
Privacy Act 1988 ss 13K and 80UB(1A); Regulatory Powers (Standard Provisions) Act 2014 s 104(2): 60 penalty units for a body corporate, 200 for a listed corporation, 12 for an individual. Crimes (Amount of a Penalty Unit) Instrument 2026 (F2026N00424): $364 a unit for contraventions on or after 1 July 2026. Dollar amounts are our arithmetic.
OAIC, "Privacy compliance sweep to put privacy policies under the spotlight", 9 December 2025. Guidance, not law. oaic.gov.au
Privacy and Other Legislation Amendment Act 2024 (C2024A00128), Schedule 1, Part 15, items 87 to 89 (Australian Privacy Principles 1.7 to 1.9), commencing 10 December 2026 under s 2 table item 7. legislation.gov.au/C2024A00128/latest/text
OAIC, "Privacy guidance for reporting entities under the Anti-Money Laundering and Counter-Terrorism Financing Act", updated 28 August 2026. Guidance, not law. oaic.gov.au

Questions

Is the .docx free?: Yes. Download it straight from this page. There is no email field and nothing to sign up for.
What is the 30-day clock?: If you have reasonable grounds to suspect an eligible data breach, you must carry out a reasonable and expeditious assessment, and take all reasonable steps to complete it within 30 days after you become aware (s 26WH(2)).
Does it cover the AML/CTF collection notice?: Yes. The OAIC says reporting entities need a privacy policy and collection notices for their AML/CTF handling, and it publishes a template collection notice. Each sector edition of our AML/CTF kit includes a drafted collection notice for customer due diligence.

Privacy Act readiness checklist