Privacy Act 2026 Readiness Checklist

1. Does this even apply to me? (60-second scope triage)

If you tick any of these, the Privacy Act very likely applies to you — turnover under $3M is not a free pass.

• Turnover over $3 millionAbove the small-business exemption threshold.
• Provide a health service / hold sensitive informationCovered regardless of turnover.
• Trade in personal information for a benefitRemoves the exemption.
• Contractor under a Commonwealth contract / to a covered entityCan bring you in.
• Will be an AML/CTF Tranche 2 reporting entity from 1 July 2026Brings the personal info you collect for AML under the Privacy Act regardless of turnover.

2. The things in force RIGHT NOW

• Understand the statutory tort (since 10 June 2025)Individuals can sue you directly for a serious invasion of privacy, regardless of turnover.
• Set up your 30-day data-breach assessment clockAssess a suspected eligible breach within 30 days; notify the OAIC + individuals if serious harm is likely.
• Confirm your privacy policy is APP-1 compliantA non-compliant policy can attract an OAIC infringement notice (up to $66,000).
• Be aware of OAIC enforcement activityThe early-2026 OAIC sweep reviewed ~60 in-person-collection businesses.

3. ADM disclosure — the 10 December 2026 item

Do you use any program, AI, rules engine or scoring tool to make (or substantially help make) decisions that significantly affect a person — credit/eligibility, pricing, hiring/tenant screening, risk scoring? If yes, your privacy policy must disclose it.

• Build an ADM inventoryEach tool, the decision it affects, the personal information it uses.
• Disclose the kinds of personal information usedIn your privacy policy.
• Disclose the kinds of decisions madeIn plain language a customer can understand.

4. Data-breach basics

• Know what an "eligible data breach" isUnauthorised access/disclosure/loss likely to cause serious harm.
• Document a first-72-hours action listContain → assemble team → assess scope → evaluate harm → prepare notices → notify → review.
• Know who/what to notifyThe OAIC and affected individuals if serious harm is likely.

5. Privacy-policy gap self-audit (12 points)

• States what personal information you collect
• States why you collect it
• Explains how you collect it
• Lists who you disclose it to (incl. overseas + countries)
• Explains how to access and correct information
• Explains how to complain, and that complaints can go to the OAIC
• Describes security and retention practices
• Covers sensitive information separately (if relevant)
• Has matching APP 5 collection notices on forms/onboarding
• Includes a KYC collection notice (if AML-captured)
• Includes the ADM disclosure (before 10 Dec 2026, if applicable)
• Is current, dated, and easy to find

Not sure it applies to you? Run the free 2-minute checker →

General information only — NOT legal advice. About Australia's Privacy Act 1988, not the US Privacy Act of 1974. It does not account for your specific circumstances and creates no lawyer-client relationship. Dates, penalties and thresholds are drawn from OAIC, the Attorney-General's Department, AUSTRAC and the Federal Register of Legislation (current to June 2026) and can change. The removal of the $3M small-business exemption is proposed — timing not confirmed. Confirm your obligations at oaic.gov.au or with a qualified adviser before acting. Last verified 8 June 2026.