Australian Privacy Reform Projections
This was a projection two years ago. It’s mostly law now. Here’s what’s actually in effect, what’s still pending, and the dates that matter over the next twelve months.
This piece was originally written as a projection. It isn’t anymore. The Privacy and Other Legislation Amendment Act 2024 received royal assent on 10 December 2024, and most of it has been in force since 11 December 2024. Some of the biggest changes only just landed. One more lands in three months. Here’s where things actually stand.
What’s already law
Since 11 December 2024, the OAIC has had meaningfully sharper enforcement tools: infringement notices of up to $66,000 per contravention it can issue directly, without going to court, plus compliance notices requiring specific remediation action, and expanded search and seizure powers. This is the change that mattered least in headlines and most in practice, it’s what turned “the regulator could theoretically fine you” into “the regulator can fine you next week.”
The bigger shift landed later. The statutory tort for serious invasions of privacy commenced on 10 June 2025. Before that date, privacy enforcement in Australia ran entirely through the OAIC’s discretion. Since that date, an individual can bring a direct claim for a serious privacy invasion regardless of whether the regulator chooses to act. That’s a structural change in who can come after you, not just how hard they can hit.
The maximum penalty exposure for serious or repeated interferences with privacy sits at up to $50 million for a body corporate, or a formula based on the benefit obtained and annual turnover if that produces a larger number, whichever is greater. That ceiling predates this reform, it was set in 2022, but the 2024 changes are what gave the OAIC faster, lower-friction tools to actually pursue conduct that could reach it, rather than relying solely on Federal Court action for every case.
What’s still pending, and when
Two commitments from the same 2024 Act haven’t landed yet, and one of them is close:
| Change | Status | Commencement |
|---|---|---|
| Automated decision-making transparency requirements | Legislated, not yet in force | 10 December 2026 |
| Children’s Online Privacy Code | Framework legislated, code development underway | Registered by 10 December 2026 |
The automated decision-making requirement is the one worth flagging now, not in November. It requires organisations to disclose, in privacy policies, when personal information is used in automated decisions that could significantly affect an individual, and to explain the kinds of decisions and information involved. If any part of your personalisation, credit, pricing or eligibility logic runs on an automated model, this is a genuine compliance deadline with three months’ runway from where this article stands, not an abstract future concern.
Tranche 2: promised, not yet legislated
The larger structural reforms sit in what’s being called Tranche 2, and as of writing, none of it has been introduced as a bill. What’s understood to be in scope: a “fair and reasonable” test applied to collection, use and disclosure of personal information regardless of consent; removal of the small business exemption, which currently excludes most businesses under $3 million turnover from the Act entirely; reform of the employee records exemption; a right to erasure; and an expanded definition of “personal information” that shifts from information “about” an individual to information that “relates to” one, which would capture online identifiers and IP addresses more explicitly than the current wording does.
None of that is law yet. All of it is directionally where the government has said it’s heading, and the small business exemption removal in particular would be a meaningfully bigger compliance footprint than Tranche 1 for any business currently relying on it.
Need to put a number on your next media decision?
Model the impact of a media or marketing decision on your own numbers, browse the full library of strategic calculators and decision tools, and get definitions straight on the industry terms that come up along the way, three free resources, ready whenever you need them.
What this means for marketers specifically
Two practical items belong on a marketing team’s radar ahead of anyone else’s: consent architecture for any first-party data collection now needs to hold up against a regulator with faster enforcement tools and individuals who can sue directly, not just a theoretical audit risk; and any automated personalisation, scoring or eligibility logic needs a disclosure plan ready before 10 December 2026, not drafted after. Neither of these requires waiting for Tranche 2 to start. Both are already due.
The commercial argument for treating this as more than a legal compliance exercise, rather than repeating it here, is covered in Why Australian Privacy Overhauls Are Necessary.
Free Playbook
The FSI Marketing Playbook covers regulatory compliance requirements for marketing in Australia’s most heavily regulated sectors, including data governance obligations that map directly onto this reform.
Get the FSI Marketing PlaybookAustralian Privacy Reform: FAQ
Is the Privacy Act reform fully in effect now?
Mostly, not entirely. Tranche 1 (the Privacy and Other Legislation Amendment Act 2024) is almost fully in force as of June 2025, with one requirement, automated decision-making transparency, still pending until December 2026. Tranche 2, the larger structural reforms, hasn’t been introduced as legislation yet.
Does the small business exemption still apply?
Yes, currently. Businesses with turnover under $3 million are still largely exempt from the Privacy Act. Removing this exemption is understood to be part of Tranche 2, which hasn’t been legislated, so it still applies for now.
What’s the actual deadline businesses should be tracking?
10 December 2026, for automated decision-making transparency disclosures. It’s the nearest binding deadline still outstanding from Tranche 1, and the one most likely to be overlooked since it was legislated back in 2024 alongside changes that already commenced.
