AMLCompliant, home

Privacy Act guide · general information, not legal advice

The statutory tort for serious invasions of privacy

Since 10 June 2025 an individual can sue in court for a serious invasion of their privacy. This guide sets out what a plaintiff has to prove, the defences and exemptions, the remedies and the damages cap, from the authorised text of Schedule 2 to the Privacy Act 1988.

Last checked 25 September 2026 against the Privacy Act 1988 compilation C2026C00227 (compilation date 4 June 2026) and the Privacy and Other Legislation Amendment Act 2024 (C2024A00128)

Sch 2 cl 7 the law, read in the authorised textOAIC guidance the regulator's published guidance, which is not law

The tort at a glance

Schedule 2 to the Privacy Act 1988, in brief
Question Answer Source
In force from 10 June 2025 Sch 2 POLA Act s 2
Who can sue An individual. A business cannot sue for an invasion of its own privacy. Sch 2 cl 7(1)
Who can be sued Another person. The OAIC describes the defendant as "another person or organisation". There is no turnover threshold. Sch 2 cl 7(1) OAIC
Proof of damage Not needed. The invasion is actionable without it. Sch 2 cl 7(2)
Damages cap The greater of $478,550 and the defamation maximum, for non-economic loss plus exemplary or punitive damages Sch 2 cl 11(5)
Time limit Usually the earlier of 1 year after the plaintiff became aware and 3 years after the invasion Sch 2 cl 14
Who decides The courts. The OAIC has no direct role in administering the tort. Sch 2 cl 23 OAIC

The tort was added by Schedule 2 of the Privacy and Other Legislation Amendment Act 2024 (the POLA Act), which received Royal Assent on 10 December 2024.1 It now sits in Schedule 2 of the Privacy Act 1988. Schedule 2 is to be read and construed separately from the rest of the Act.2

What a plaintiff must prove

An individual has a cause of action against another person if all five of these are true:3

  1. An invasion of privacy. The defendant intruded upon the plaintiff's seclusion, or misused information that relates to the plaintiff, or both.
  2. A reasonable expectation of privacy. A person in the plaintiff's position would have had a reasonable expectation of privacy in all of the circumstances.
  3. Intention or recklessness. The invasion was intentional or reckless. Carelessness alone is not enough. "Reckless" has the meaning it has in the Criminal Code.4
  4. Seriousness. The invasion was serious.
  5. The public interest balance. The public interest in the plaintiff's privacy outweighed any countervailing public interest.

"Intruding upon seclusion" includes physically intruding into a person's private space, and watching, listening to or recording their private activities or private affairs. "Misusing information" includes collecting, using or disclosing information about the individual. Both definitions are open-ended.5 Where the claim is about misused information, it does not matter whether the information was true.6

How a court weighs the claim

Schedule 2 lists matters a court may consider. None of the lists is exhaustive.7

Matters a court may consider under Schedule 2, clause 7
Element Matters listed in Schedule 2
Reasonable expectation of privacy The means used, including any device or technology; the purpose; the plaintiff's age, occupation or cultural background; the plaintiff's own conduct; for an intrusion, the place where it happened; for misused information, its nature (for example health, financial or family matters), how the plaintiff held or communicated it, and whether it was already public
Seriousness The degree of offence, distress or harm to dignity likely to be caused to a person of ordinary sensibilities in the plaintiff's position; whether the defendant knew or ought to have known that; and, if the invasion was intentional, whether the defendant was motivated by malice
Countervailing public interest Freedom of expression, freedom of the media, the proper administration of government, open justice, public health and safety, national security, and the prevention and detection of crime and fraud

Defences and exemptions

It is a defence if any of these applies:8

  • the invasion was required or authorised by or under an Australian law or a court or tribunal order;
  • the plaintiff, or a person with lawful authority to act for the plaintiff, expressly or impliedly consented to it;
  • the defendant reasonably believed it was necessary to prevent or lessen a serious threat to the life, health or safety of a person;
  • it was incidental to the exercise of a lawful right of defence of persons or property, and was proportionate, necessary and reasonable.

Where the invasion was a publication, the defendant may also rely on three defences drawn from defamation law: absolute privilege, publication of public documents, and fair report of proceedings of public concern.9

Schedule 2 does not apply at all to some people and bodies: journalists, and those who employ or assist them, for journalistic material; Commonwealth agencies and State or Territory authorities acting in good faith in their functions or powers, and their staff; law enforcement bodies and intelligence agencies, including an invasion to the extent it involves disclosing information to them or information they disclosed; and persons under 18.10 An action also cannot be brought about the privacy of a person who has died, or against a defendant who has died.11

Remedies and the damages cap

A court can grant an injunction at any stage of the proceedings to stop the defendant invading the plaintiff's privacy.12 It may award damages, including damages for emotional distress. It may award exemplary or punitive damages only in exceptional circumstances. It must not award aggravated damages.13

The cap

The total of damages for non-economic loss and any exemplary or punitive damages must not exceed the greater of $478,550 and the maximum damages for non-economic loss that can be awarded in defamation proceedings under an Australian law.14

The $478,550 figure is written into Schedule 2, and the Schedule contains no mechanism that adjusts it. Only the second limb can change, because it follows the defamation maximum. Damages for economic loss are not within the cap.

Instead of damages, or as well as damages, a court may order an account of profits, an injunction, an apology, a correction, the destruction or delivery up of material obtained or misused through the invasion, or a declaration that the defendant seriously invaded the plaintiff's privacy.15 In setting damages it may take into account whether the defendant apologised or published a correction, and whether either side took reasonable steps to settle. An apology is not an admission of fault or liability for the purposes of Schedule 2.16

Time limits and courts

A plaintiff who was under 18 when the invasion happened must start proceedings before their 21st birthday. Anyone else must start before the earlier of 1 year after they became aware of the invasion and 3 years after it happened. A court can extend the time, but not beyond 6 years after the invasion.17

Claims can be heard in the Federal Circuit and Family Court of Australia (Division 2), the Federal Court, State courts and Territory courts.18 The OAIC says it "does not have a direct role in administering the tort". The Information Commissioner may, with the court's leave, intervene in proceedings or assist the court.19 State and Territory laws keep operating alongside Schedule 2.20

Who it reaches

The Australian Privacy Principles bind APP entities, and a business with an annual turnover of $3 million or less is usually outside them. Schedule 2 has no such threshold. The OAIC says the tort "is broader in application than the Privacy Act, extending to individuals and other entities that may not necessarily be an Australian Privacy Principle entity".19

For an accounting practice, real estate agency, conveyancer or legal practice, the exposure comes from ordinary work: client files that hold financial and family information, identity documents collected for AML/CTF checks, cameras at an office or an open inspection, and what staff say or send about clients. If you employ staff, read the privacy tort and employers.

What a small practice can do

  1. Know where you watch, listen or record

    List every camera, call recording and monitoring tool, and what each one captures. The means used and the place of an intrusion are matters a court may consider. Sch 2 cl 7(5)

  2. Collect and keep less

    Information you do not hold cannot be misused. Keep what the work and the law require, and delete the rest on a schedule.

  3. Control who can see client files

    Limit access to identity, financial, health and family information, and keep a record of what you disclose to third parties.

  4. Answer complaints quickly

    An apology is not an admission of liability under Schedule 2, and a court may take it into account in setting damages. Sch 2 cl 13 Sch 2 cl 11(6)

  5. Get advice early

    If you receive a claim or a letter of demand, get legal advice straight away. The time limits are short.

Where to go next

Run the free Privacy Act checkerUse the free checklist

AMLCompliant is published by Wani Meridian Pty Ltd, an independent private business. We are not affiliated with, or endorsed by, the Office of the Australian Information Commissioner, the Attorney-General's Department or any other government body. This guide is general information, not legal advice.

Independent. Not affiliated with, or endorsed by, AUSTRAC or the Australian Government.

Sources

Law is quoted from the authorised text on the Federal Register of Legislation, opened 25 September 2026. OAIC pages are guidance, not law.

  1. Privacy and Other Legislation Amendment Act 2024 (No. 128, 2024; C2024A00128), front page ("Assented to 10 December 2024") and s 2(1), table item 8. Privacy Act 1988, compilation No. 104 (C2026C00227), endnote 3: "sch 2: 10 June 2025". legislation.gov.au/C2024A00128/latest/text

  2. Privacy Act 1988, Schedule 2, clause 2 and clause 6(2) to (3). legislation.gov.au/C2004A03712/latest/text

  3. Privacy Act 1988, Schedule 2, clause 7(1).

  4. Privacy Act 1988, Schedule 2, clause 6(1), definition of "reckless".

  5. Privacy Act 1988, Schedule 2, clause 6(1), definitions of "intruding upon the seclusion of an individual" and "misusing information that relates to an individual".

  6. Privacy Act 1988, Schedule 2, clause 7(7).

  7. Privacy Act 1988, Schedule 2, clause 7(3), (5) and (6).

  8. Privacy Act 1988, Schedule 2, clause 8(1).

  9. Privacy Act 1988, Schedule 2, clause 8(2) to (3).

  10. Privacy Act 1988, Schedule 2, clauses 15, 16, 16A, 16B, 17 and 18.

  11. Privacy Act 1988, Schedule 2, clause 20.

  12. Privacy Act 1988, Schedule 2, clause 9.

  13. Privacy Act 1988, Schedule 2, clause 11(1) to (4).

  14. Privacy Act 1988, Schedule 2, clause 11(5).

  15. Privacy Act 1988, Schedule 2, clause 12.

  16. Privacy Act 1988, Schedule 2, clauses 11(6) and 13.

  17. Privacy Act 1988, Schedule 2, clause 14.

  18. Privacy Act 1988, Schedule 2, clause 23 and the note to clause 23(1), which refers to the Judiciary Act 1903 ss 39(2) and 39B(1A)(c).

  19. OAIC, "Statutory tort for serious invasions of privacy". Guidance, not law. oaic.gov.au. Intervention: Privacy Act 1988, Schedule 2, clause 22.

  20. Privacy Act 1988, Schedule 2, clause 21.

Questions

When did it start?

On 10 June 2025. Schedule 2 of the Privacy and Other Legislation Amendment Act 2024 was to commence on a day fixed by Proclamation, or otherwise on the day after the end of 6 months from Royal Assent on 10 December 2024. The Privacy Act compilation records its commencement as 10 June 2025.

What is the damages cap?

Damages for non-economic loss plus any exemplary or punitive damages cannot exceed the greater of $478,550 and the maximum damages for non-economic loss that can be awarded in defamation proceedings under an Australian law (Sch 2 cl 11(5)). Aggravated damages cannot be awarded (cl 11(2)). Damages for economic loss are outside the cap.

Does turnover protect us?

No. Schedule 2 has no turnover threshold, and the $3 million small business test in the Privacy Act does not apply to it. The OAIC describes the tort as broader in application than the Privacy Act, reaching individuals and entities that may not be APP entities.