The Privacy Act 1988 protects how personal information is collected, used, stored and disclosed across Australia's federal public sector and most of the private sector. Quiet for thirty years, it has just been overhauled. A three-tier penalty regime, a new statutory tort for serious invasions of privacy, an enforceable code for children online and (from December 2026) transparency duties for automated decisions all now sit on top of the original thirteen Australian Privacy Principles.
The Privacy Act applies to "APP entities", a term covering all Commonwealth agencies and every private sector organisation above a turnover threshold, with several stitched-on exceptions. Knowing whether you fall inside the regime is the first question; the threshold has been settled since 2001 and the carve-outs were narrowed in 2024.
An "APP entity" is any Commonwealth agency or any private sector organisation with annual turnover of AU$3 million or more. Once you are an APP entity, every one of the thirteen Australian Privacy Principles applies to your handling of personal information.
The 2024 reforms also clarified that organisations doing business in Australia are bound, regardless of where the personal information is collected. The old "Australian link" carve-out has been narrowed.
The Australian Privacy Principles are a single list of thirteen rules, but they are best read as five phases of a personal information lifecycle. Tap any principle to see what it requires. The Office of the Australian Information Commissioner (OAIC) treats the APPs as the foundational standard against which every interference with privacy is judged.
The Notifiable Data Breaches scheme is the most operationally consequential part of the Act. Any APP entity that suspects an "eligible data breach" must move through a fixed assessment-and-notification sequence, on a strict 30-day clock. Get it wrong, or get it slow, and Section 13G civil penalties enter the picture.
The entity becomes aware of circumstances suggesting an eligible data breach, unauthorised access or disclosure of personal information, or loss likely to result in such access.
A 30-day window to take all reasonable steps to confirm whether an eligible data breach has occurred. Failure to assess is itself an interference with privacy.
If confirmed, prepare a statement covering the entity's identity, the kinds of information affected, and recommended steps. Provide it to the OAIC as soon as practicable.
Notify each affected individual, or the class of individuals at risk, or publish the statement on the website and take reasonable steps to publicise it.
The Privacy and Other Legislation Amendment Act 2024 reorganised enforcement into three escalating tiers, calibrated to the severity of the breach. For body corporates, the Tier 3 figure is the greater of an absolute amount, three times any benefit obtained, or 30% of "adjusted turnover" over the breach period, putting Australia broadly in line with GDPR-style consequences.
For the first time in Australian legal history, an individual has a personal right of action for serious invasions of privacy. The statutory tort sits beside (not inside) the APP regime, and reaches defendants who would never have been bound by the Act. It is actionable without proof of damage.
Two pathways. The tort recognises two species of invasion: (i) intrusion upon seclusion (physical surveillance, hacking devices, watching or listening) and (ii) misuse of information (collecting, using, or disclosing information, broadly construed).
Crucially, claims can be brought against any person or organisation, including individuals and small businesses outside the APP regime. The OAIC has standing only to make submissions or appear as amicus, not to bring the claim itself. Class actions are explicitly contemplated.
Intrusion upon seclusion or misuse of information relating to the plaintiff.
The plaintiff had a reasonable expectation of privacy in the circumstances.
The defendant's conduct was intentional or reckless. Negligence does not suffice.
The invasion is serious, judged on degree, sensitivity and likely consequences.
Public interest in the plaintiff's privacy outweighs any countervailing public interest (free expression, media, security).
The Office of the Australian Information Commissioner is the independent regulator. Before December 2024 its enforcement toolkit was thin, often limited to determinations after long investigations. The Amendment Act gave the Commissioner a working enforcement toolbox: infringement notices on the spot, compliance notices, search-and-seizure powers, and the standing to seek mid-tier penalties without first establishing seriousness.
The Privacy Act has had three major chapters: enactment as a public-sector statute in 1988, extension to the private sector in 2000, and the 2024 modernisation. A second tranche of reforms remains in the pipeline; the items below are already on the statute book or announced.
A guided walk through the Act's key triggers. Answer up to five questions to land on the regime that applies to you, the APPs, the new tort, the breach scheme, or none of the above. This is a heuristic, not legal advice. The binding answers come from the Privacy Act itself, the APP guidelines and the cases.