Australia Privacy Act
Amended Australia · In force Dec 11, 2024 · next deadline Dec 10, 2026 (in 3 months)
Deadlines
Summaries for reference, not legal advice. Check the official text.
What it does
Australia's federal privacy law (13 Australian Privacy Principles, Notifiable Data Breaches scheme). The 2024 amendment adds a statutory tort for serious invasions of privacy, tiered civil penalties and infringement notices, a mandate for a Children's Online Privacy Code, clearer security duties, and privacy-policy transparency for substantially automated decisions from 10 December 2026. It also adds criminal doxxing offences.
- Who it applies to
- APP entities: Australian Government agencies and organizations with annual turnover above AUD 3 million, plus some smaller businesses (e.g. health service providers, data traders). The statutory tort applies to anyone, not only APP entities. The Children's Online Privacy Code will cover social media, relevant electronic and designated internet services likely to be accessed by children.
- Penalties
- Serious interference with privacy: for bodies corporate, the greater of AUD 50 million, 3x the benefit obtained, or 30% of adjusted turnover. New mid-tier civil penalty for interferences with privacy (up to AUD 3.3 million for bodies corporate) and infringement notices for administrative breaches. Statutory tort: court-awarded damages, with a cap on damages for non-economic loss.
- Enforced by
- Office of the Australian Information Commissioner (OAIC); courts (statutory tort)
- Official name
- Privacy Act 1988 (Cth), as amended by the Privacy and Other Legislation Amendment Act 2024
- Citation
- Privacy Act 1988 (Cth); Privacy and Other Legislation Amendment Act 2024 (No. 128, 2024)
- Topics
- privacy, children, breach-notification, ai
Research notes
The OAIC released an exposure draft Privacy (Children's Online Privacy) Code 2026 for consultation from 31 Mar to 5 Jun 2026; it was not registered as of Aug 2026, and its commencement date for regulated entities is not yet set. 'Tranche 2' reforms (e.g. removing the small business exemption, a fair and reasonable test) are not yet legislated. The mid-tier and tort cap figures come from the Act and secondary summaries; check against the current indexed penalty unit value.
Related
Australia Cyber Security Act (ransomware reporting)Questions about Australia Privacy Act
- What are the Australia Privacy Act compliance deadlines?
- Dec 11, 2024: Most POLA Act 2024 amendments commence. Jun 10, 2025: Statutory tort for serious invasions of privacy commences. Dec 10, 2026: Children's Online Privacy Code must be registered. Dec 10, 2026: Automated decision-making transparency applies.
- When does Australia Privacy Act take effect?
- Australia Privacy Act took effect on Dec 11, 2024. The next milestone is Dec 10, 2026: Children's Online Privacy Code must be registered.
- Who does Australia Privacy Act apply to?
- APP entities: Australian Government agencies and organizations with annual turnover above AUD 3 million, plus some smaller businesses (e.g. health service providers, data traders). The statutory tort applies to anyone, not only APP entities. The Children's Online Privacy Code will cover social media, relevant electronic and designated internet services likely to be accessed by children.
- What are the penalties under Australia Privacy Act?
- Serious interference with privacy: for bodies corporate, the greater of AUD 50 million, 3x the benefit obtained, or 30% of adjusted turnover. New mid-tier civil penalty for interferences with privacy (up to AUD 3.3 million for bodies corporate) and infringement notices for administrative breaches. Statutory tort: court-awarded damages, with a cap on damages for non-economic loss.