Australian Privacy Act Reforms: Timeline and What to Expect

Australia's Privacy Law Is Changing

The Australian Privacy Act 1988 is undergoing its most significant reform since it was enacted nearly four decades ago. The process has been long — spanning multiple governments, two major reviews, and years of public consultation — but the direction is clear. Australia's privacy framework is moving toward stronger individual rights, broader coverage, and higher penalties.

This guide traces the history of the reform process, explains the key proposed changes, outlines the expected timeline, and provides practical guidance on how businesses can prepare.

A Brief History of Privacy Act Reforms

The Original Act (1988)

The Privacy Act 1988 was initially limited to federal government agencies. It was extended to private-sector organizations in 2000, but with significant carve-outs — most notably the small business exemption, which excluded businesses with annual turnover of AUD 3 million or less (with some exceptions for health service providers and certain other categories).

The Australian Law Reform Commission Review (2008)

The ALRC's landmark report "For Your Information: Australian Privacy Law and Practice" (Report 108) made 295 recommendations for reforming the Privacy Act. Many of these were implemented through the Privacy Amendment (Enhancing Privacy Protection) Act 2012, which introduced the 13 Australian Privacy Principles (APPs) that replaced the previous National Privacy Principles and Information Privacy Principles.

However, several significant ALRC recommendations were not implemented at that time, including the removal of the small business exemption and the introduction of a statutory cause of action for serious invasions of privacy.

The ACCC Digital Platforms Inquiry (2019)

The Australian Competition and Consumer Commission's Digital Platforms Inquiry Final Report in 2019 renewed momentum for privacy reform. The ACCC recommended strengthening the Privacy Act, including enhanced consent requirements, stronger enforcement powers, and a direct right of action for individuals.

The Attorney-General's Review (2020-2022)

In October 2020, the Attorney-General's Department launched a comprehensive review of the Privacy Act. A Discussion Paper was released in October 2021, followed by extensive public consultation. The Privacy Act Review Report was completed in February 2022 and publicly released in February 2023. It contained 116 proposals for reform.

The Government responded in September 2023, agreeing in principle to the majority of the proposals and committing to a phased implementation approach.

The Privacy and Other Legislation Amendment Bill (2024-2025)

The first tranche of reforms was introduced to Parliament through the Privacy and Other Legislation Amendment Bill 2024. This initial legislative package addressed a subset of the review's proposals. Key measures in this first tranche included strengthened enforcement powers, a children's privacy code, and codification of certain privacy rights.

Additional tranches of reform legislation are expected to follow, addressing the remaining proposals from the review including the removal of the small business exemption and the introduction of a statutory tort for serious invasions of privacy.

Key Proposed Changes

Removal of the Small Business Exemption

Currently, businesses with annual turnover of AUD 3 million or less are generally exempt from the Privacy Act (unless they are health service providers, trade in personal information, are related to a larger organization, or fall into other specific categories). The review recommended removing this exemption, which would bring an estimated 2.5 million additional Australian businesses under the Privacy Act.

The Government agreed to remove the exemption but acknowledged the need for a transition period to allow small businesses to prepare. The timing and mechanics of the transition are still being finalized. This is arguably the most impactful single change in the reform package, as it will require millions of small businesses to comply with the APPs for the first time.

For small businesses, this means implementing privacy policies, establishing processes for access and correction requests, ensuring appropriate security safeguards, and complying with the Notifiable Data Breaches scheme. See our guide to the NDB scheme for current notification requirements.

A Statutory Tort for Serious Invasions of Privacy

The review proposed introducing a statutory tort (a right to sue) for serious invasions of privacy. This would allow individuals to take direct legal action against organizations or individuals that seriously invade their privacy, and to claim compensation through the courts.

The proposed tort would cover:

• Intrusion upon seclusion — physically or electronically intruding into a person's private activities or affairs
• Misuse of private information — collecting, using, or disclosing private information in a way the person would find highly offensive

The tort would be subject to a "serious harm" threshold and would include a public interest defense. This is a significant addition because currently, Australia does not have a general right to sue for invasion of privacy — affected individuals must rely on the OAIC complaints process, which is an administrative mechanism rather than a private right of action.

The Children's Online Privacy Code

The review recommended, and the Government agreed to, the development of a Children's Online Privacy Code. This code would impose specific obligations on online services likely to be accessed by children, similar to the UK's Age Appropriate Design Code (the Children's Code).

Expected requirements include:

• Higher consent standards for children's personal information
• Restrictions on profiling and behavioral targeting of children
• Default privacy settings set to the highest level for child users
• Transparency requirements tailored to children's understanding
• Restrictions on using children's data in ways that are detrimental to their well-being

The code would be registered by the OAIC and would have the force of law once implemented.

Enhanced Individual Rights

The review proposed strengthening and expanding the rights available to individuals under the Privacy Act. Proposed changes include:

Right to erasure: The APPs currently provide a right to correction (APP 13) but not an explicit right to erasure. The review proposed introducing a right to erasure similar to GDPR Article 17, with appropriate exceptions for legal obligations, freedom of expression, and other legitimate purposes.

Right to object to processing: A right to object to certain types of processing, particularly direct marketing and processing based on legitimate interests (if a legitimate interests basis is introduced).

Right to de-identification as an alternative to deletion: Where deletion is not feasible, organizations could de-identify data as an alternative to erasure.

Right to explanation of automated decisions: A right to obtain meaningful information about decisions made solely by automated means that significantly affect the individual.

Consent and Legitimate Interests

The review proposed reforms to the consent framework, including:

• A requirement for consent to be voluntary, informed, specific, unambiguous, and current
• An explicit prohibition on bundled consent (requiring consent to unnecessary processing as a condition of a service)
• The introduction of a legitimate interests basis for processing, similar to GDPR Article 6(1)(f), as an alternative to consent where appropriate

The legitimate interests basis would include a balancing test and would not apply to sensitive information or children's data.

Automated Decision-Making

The review proposed requirements for transparency and accountability in automated decision-making. Organizations would need to provide individuals with meaningful information about automated decisions that significantly affect them, and individuals would have a right to request human review of such decisions.

Expected Implementation Timeline

The reform process is being implemented in phases. Based on the Government's announced approach:

Phase 1 (Legislation introduced 2024-2025): Initial tranche covering enhanced enforcement, children's privacy code framework, and selected individual rights reforms.

Phase 2 (Expected 2025-2026): Additional reform legislation addressing further proposals, potentially including the legitimate interests basis, enhanced consent requirements, and automated decision-making provisions.

Phase 3 (Expected 2026-2027): Later tranches addressing the removal of the small business exemption (with transition period), the statutory tort for privacy invasion, and remaining proposals.

Transition periods: For major changes like the small business exemption removal, a transition period of one to three years from royal assent is expected to allow affected businesses to prepare.

The exact timeline remains subject to Parliamentary processes and political priorities. Reform legislation must pass both houses of Parliament, and amendments during the legislative process may alter the scope and timing of specific provisions.

How to Prepare

Regardless of where the reform process currently stands, the direction is clear. Here is how businesses can prepare:

If You Are Currently Covered by the Privacy Act

Review your current compliance. The reforms will strengthen existing obligations. Ensure your current practices meet the APPs and the NDB scheme requirements before new requirements are added.

Build flexibility into your processes. Design your privacy management framework to accommodate new rights (erasure, objection) as they come into force. If your DSAR workflow can handle access and correction requests, extending it to cover erasure requests should be straightforward.

Watch the children's code. If your services are likely to be accessed by children, start assessing your data practices against the expected requirements now. Implementing age-appropriate design principles proactively is easier than retrofitting.

If You Are a Small Business (Currently Exempt)

Do not wait for the exemption to be removed. The transition period will not be unlimited, and the compliance work involved is not trivial. Starting early gives you time to build processes at your own pace rather than scrambling to meet a deadline.

Start with the basics. Create a privacy policy. Build a simple data inventory. Establish a process for handling access requests. Implement reasonable security measures. These fundamentals apply under the current law (if you voluntarily opt in) and will be mandatory once the exemption is removed.

Budget for compliance. Privacy compliance involves ongoing effort — it is not a one-time project. Factor in the time for maintaining your data inventory, responding to access requests, managing breaches, and keeping policies current.

For a practical overview of what the Privacy Act requires, see our Australian Privacy Act jurisdiction guide.

Related Guides

• Australian Privacy Act Jurisdiction Guide — current requirements
• Notifiable Data Breach Scheme: Australia — mandatory breach reporting
• Data Protection Laws by Country — global comparison

References

• Privacy Act 1988: Legislation
• Privacy Act Review Report (2022): Attorney-General's Department
• Government Response to the Privacy Act Review (2023): Attorney-General's Department
• OAIC: Office of the Australian Information Commissioner
• ALRC Report 108 (2008): For Your Information: Australian Privacy Law and Practice. ALRC