Australia’s privacy laws continue to evolve, and businesses should not assume the reform process ended with the amendments introduced in 2024 and 2025. While relatively few major new obligations have commenced since 1 July 2026, several significant changes are imminent and further substantial reforms remain under active consideration by the Federal Government.
For many organisations, the next 12 months will be a critical period for reviewing privacy practices, cybersecurity measures, artificial intelligence systems and data governance frameworks.
Australia’s Privacy Reform Journey
Australia is undergoing its most significant overhaul of privacy regulation since the introduction of the Privacy Act 1988 (Cth). The reform program stems from the Federal Government’s response to the Attorney-General’s Privacy Act Review and has been delivered through staged legislative reform.
The first tranche of amendments introduced stronger enforcement powers, increased penalties, a statutory tort for serious invasions of privacy and enhanced transparency obligations. Further reforms are expected through a second tranche of legislation, although a Bill has not yet been enacted.
For businesses, the key question is no longer whether privacy compliance matters. The focus has now shifted to whether existing privacy frameworks are sufficiently robust to deal with emerging regulatory expectations, cybersecurity risks and increased individual rights.
The Most Significant Upcoming Change: Automated Decision-Making Transparency
The most significant Privacy Act reform currently scheduled to commence is the new requirement for certain organisations to disclose their use of automated decision-making processes in privacy policies and related notices. These requirements are due to commence on 10 December 2026.
The reforms are designed to provide greater transparency when organisations use technology to make decisions about individuals.
Affected organisations may be required to disclose:
- whether automated systems are used to make decisions affecting individuals;
- the types of personal information used by those systems;
- the categories of decisions being made; and
- how those processes impact individuals.
While many businesses may not consider themselves users of artificial intelligence or automated decision-making tools, the concept is broader than many expect. Common examples may include:
- AI-assisted recruitment platforms;
- automated customer screening systems;
- credit assessment tools;
- fraud detection platforms;
- customer profiling software;
- automated eligibility assessments; and
- algorithmic risk-scoring systems.
Businesses that utilise these technologies should begin reviewing their privacy policies and internal governance processes now, well before the commencement date.
Increased Litigation Risk: The Statutory Tort for Serious Invasions of Privacy
One of the most significant reforms already in force is the introduction of a statutory cause of action for serious invasions of privacy, which commenced on 10 June 2025.
Historically, individuals often relied upon complaints to the Office of the Australian Information Commissioner (OAIC) when privacy breaches occurred. The new tort creates a separate avenue for individuals to pursue legal remedies through the courts in serious cases.
The new regime may apply in circumstances involving:
- misuse of private information;
- serious intrusions into an individual’s private affairs; or
- conduct causing significant privacy harm.
As awareness of these provisions increases, organisations may face a greater risk of private litigation arising from data breaches, surveillance practices, unauthorised disclosure of personal information and other privacy-related conduct.
Regulatory Enforcement Continues to Strengthen
The Federal Government’s privacy reforms have significantly enhanced the OAIC’s enforcement capabilities. The regulator now has stronger investigative powers and access to a more robust penalty framework.
The practical consequence for businesses is that privacy compliance is increasingly being viewed by regulators as a governance and risk-management issue rather than simply an administrative obligation.
Boards and senior management should ensure that privacy compliance is considered alongside:
- cyber security frameworks;
- risk management processes;
- incident response planning;
- vendor management programs; and
- broader ESG and governance obligations.
What Further Reforms Are Likely?
Although a second tranche of privacy legislation has not yet been passed, a number of potentially significant reforms remain under active consideration by the Government.
1. A New “Fair and Reasonable” Test
One of the most significant proposed reforms would introduce a requirement that the collection, use and disclosure of personal information be objectively “fair and reasonable”.
This would represent a substantial shift in Australian privacy law.
Rather than relying primarily upon consent mechanisms and privacy notices, organisations may need to demonstrate that their data practices are objectively justified in light of:
- the sensitivity of the information;
- the purpose of collection;
- the expectations of individuals; and
- the potential risks arising from the activity.
Such a reform would significantly affect marketing practices, data analytics, customer profiling and AI-driven systems.
2. Possible Removal of the Small Business Exemption
Another major proposal involves the future removal or narrowing of the long-standing small business exemption.
Currently, many businesses with annual turnover below the statutory threshold are exempt from parts of the Privacy Act.
Although no commencement date has been announced, removal of the exemption remains a key policy objective. If implemented, a substantial number of small and medium-sized businesses would become subject to:
- Australian Privacy Principles;
- privacy policy requirements;
- data security obligations; and
- mandatory data breach requirements.
Businesses currently relying upon the exemption should consider preparing for future compliance obligations rather than waiting for legislation to be finalised.
3. Reform of the Employee Records Exemption
The employee records exemption has also been identified as a potential target for reform.
If amended or removed, employers could become subject to significantly greater regulation in relation to:
- employee information;
- workplace monitoring;
- recruitment data;
- personnel records;
- HR systems; and
- employee surveillance technologies.
For organisations with large workforces, any reform in this area could require substantial updates to employment documentation, privacy notices and HR practices.
4. Expanded Individual Rights
The Government is also considering a suite of enhanced rights for individuals that are more closely aligned with international privacy regimes such as the European GDPR.
Potential reforms include:
- a right to erasure or deletion of personal information;
- stronger correction rights;
- additional access rights; and
- expanded rights to object to certain forms of processing.
While these measures have not yet been enacted, they have the potential to significantly increase compliance obligations for Australian businesses.
The Growing Intersection of Privacy and Cyber Security
Privacy obligations can no longer be considered in isolation.
Recent regulatory developments and enforcement activity demonstrate an increasing expectation that businesses will maintain appropriate cybersecurity controls to protect personal information.
Organisations should ensure that privacy compliance programs align with:
- cyber security policies;
- breach response plans;
- supplier management arrangements;
- cloud computing governance; and
- information retention and destruction protocols.
This is particularly important where sensitive personal information, customer data or employee information is involved.
What Should Businesses Be Doing Now?
Given the continuing pace of reform, businesses shouldn’t wait for the next tranche of legislation before taking action.
Practical steps include:
- reviewing privacy policies and collection notices;
- identifying any automated decision-making systems currently in use;
- reviewing AI governance frameworks;
- auditing overseas data transfers and cloud arrangements;
- reviewing vendor and managed services agreements;
- updating data retention and destruction practices;
- assessing cyber security controls; and
- ensuring data breach response plans remain current.
Key Takeaway
Although the privacy reform agenda remains a work in progress, businesses should treat the period between now and the end of 2027 as a critical compliance window.
The commencement of automated decision-making transparency requirements in December 2026 highlights the Government’s increasing focus on technology, artificial intelligence and data governance. At the same time, broader reforms concerning fairness, employee records, small business exemptions and expanded individual rights remain firmly on the horizon.
Organisations that proactively review their privacy governance frameworks now will be better positioned to manage compliance obligations, regulatory scrutiny and growing stakeholder expectations in the years ahead.
If you would like advice on how these reforms may affect your organisation or assistance preparing for future compliance obligations, please contact our highly experienced Commercial Services team.
