Last reviewed: October 2026
Navigating Data Protection in a Digital World
Privacy law protection has become essential as we navigate a data-driven era where smartphones, cloud platforms, and artificial intelligence are integral to daily life and commerce. The scale and speed at which personal information is collected, stored, and shared, by both government and the private sector, has made robust privacy law regulation critical.
Australian courts have not recognised a general common law right to privacy, but since 10 June 2025 individuals can sue under a statutory tort for serious invasions of privacy. This article outlines current privacy law protections, the reforms already in force and those that are still only proposed. Our IT and privacy lawyers advise businesses on Privacy Act 1988 (Cth) compliance, data breach response, and Australian Privacy Principles obligations.
Defining ‘Personal Information’ Under Privacy Law
The Privacy Act 1988 (Cth) defines Personal Information as:
“Information or an opinion about an identified individual, or an individual reasonably identifiable, irrespective of accuracy or whether recorded in material form.”
This includes but are not limited to:
- Names, addresses, and contact details
- Date of birth, gender, and racial or ethnic origin
- Sexuality and relationship status
Enhanced protections for Special Categories:
- Sensitive Information: Political associations or opinions, religious beliefs, trade union membership, sexual orientation, and criminal records.
- Health Information: Physical or mental health status, disabilities, health services accessed, genetic data, or biometric information.
- Other protected categories: Tax File Numbers, electoral roll details, spent convictions, and telecommunications metadata.
Federal Framework: Privacy Act 1988 (Cth)
The Privacy Act applies to:
- All Australian Federal government agencies
- Private organisations that:
- Has an annual turnover of $3 million or more;
- Provides a health service (e.g., GP clinics, pharmacies);
- Trades in Personal Information sharing;
- Is a credit reporting body;
- Is a service provider under a Commonwealth contract;
- Has voluntarily opted into the Privacy Act.
Privacy Law Reforms: What Has Changed and What Is Proposed
Australian privacy law is being reformed in stages, so it is important to separate what is now law from what is still only proposed.
In force now:
- Higher maximum penalties for serious or repeated interferences with privacy (since December 2022): the greater of $50 million, three times the benefit obtained, or 30% of adjusted turnover for the relevant period.
- A statutory tort for serious invasions of privacy (since 10 June 2025), explained below.
- New enforcement tools for the OAIC under the Privacy and Other Legislation Amendment Act 2024 (Cth), including infringement notices and lower-tier civil penalties for less serious breaches.
- An express statement that the reasonable steps required to secure personal information include technical and organisational measures (APP 11).
- Criminal offences for doxxing, being the menacing or harassing release of a person’s personal data.
Coming into effect:
- From 10 December 2026, privacy policies must explain when substantially automated decisions are used that significantly affect individuals.
- A Children’s Online Privacy Code is being developed by the OAIC.
Proposed, not yet law:
In 2026 the Federal Government released an exposure draft of the second tranche of reforms. Proposals include a requirement that the handling of personal information be fair and reasonable, a right to erasure for some large digital platforms, and a 72-hour deadline for notifying the OAIC of eligible data breaches. These measures are not law yet, and businesses should not treat them as current obligations until legislation is passed.
Privacy compliance often intersects with technology licensing; see our guide to software licensing and legal risks.
Exceptions
Employee records (directly related to current/former employment relationships) remain exempt from most APPs, though still subject to Fair Work Act 2009 and state obligations. This is a specific nuance within privacy law.
Australian Privacy Principles (APPs)
The 13 APPs form the foundation of privacy law compliance. Key obligations include:
| APP | Core Obligation | What It Means in Practice |
| APP 1 | Open and transparent management | Keep a clear, current privacy policy. From 10 December 2026 it must also cover substantially automated decisions. |
| APP 3 | Collection of solicited personal information | Collect only information reasonably necessary for your functions or activities, by lawful and fair means. |
| APP 5 | Collection notification | Tell individuals who you are, why you collect their information and to whom it is usually disclosed. |
| APP 8 | Cross-border disclosures | Take reasonable steps to ensure overseas recipients do not breach the APPs. |
| APP 11 | Security of personal information | Take reasonable steps, including technical and organisational measures, to protect personal information. |
| APP 12/13 | Access to and correction of personal information | Respond to access and correction requests within a reasonable period (30 days for government agencies). |
International Application
The Privacy Act applies to foreign entities if they:
- Are incorporated in Australia;
- Have central management or control in Australia;
- Collect or hold Australian individuals’ data
NSW Privacy Framework: PPIPA and HRIPA
The Privacy and Personal Information Protection Act 1998 (PPIPA) regulates state public sector agencies through 12 Information Protection Principles (IPPs), including:
- Lawful: Collection must serve a lawful purpose.
- Direct: Information collected directly from individuals (exceptions: minors/parental consent).
- Open: Explain why data is collected, how it’s used, and rights to access/correct.
- Relevant: Data must be accurate, up-to-date, and non-excessive.
- Secure: Implement safeguards against unauthorised access/loss.
- Transparent: Disclose stored information and usage purposes.
- Accessible: Provide access without unreasonable delay/cost.
- Correct: Allow amendments to inaccurate data.
- Accurate: Verify relevance/accuracy before use.
- Limited: Use data only for its original purpose (exceptions: consent/public safety).
- Restricted: Disclose only with consent or for directly related purposes.
- Safeguarded: Never disclose sensitive data without consent (exceptions: imminent safety threats).
Health Information remains covered by the Health Records and Information Privacy Act 2002 (HRIPA) and its 15 Health Privacy Principles.
In NSW, covert surveillance in workplaces is regulated under the Workplace Surveillance Act 2005 (NSW), which limits the use of video, audio, and computer monitoring.
Key Exemption: Employee Records
Employee records in the context of current or former employment are largely exempt from the Privacy Act, though still subject to:
- The Fair Work Act 2009 (Cth)
- State-based workplace and surveillance laws
Penalties for Non-Compliance
- Federal breaches:
- Up to $50 million fines
- Infringement notices and lower-tier civil penalties for less serious breaches
- NSW breaches (PPIPA or HRIPA):
- Binding orders from the NSW Privacy Commissioner
- Compensation payments to affected individuals
- Orders enforceable through NCAT or the Supreme Court
Suing for a Serious Invasion of Privacy (Schedule 2, Privacy Act 1988)
Since 10 June 2025, Schedule 2 of the Privacy Act 1988 (Cth) lets individuals in NSW sue for a serious invasion of privacy, either intrusion into their seclusion or misuse of their private information. The conduct must be intentional or reckless, proof of financial loss is not required, and small businesses exempt from the APPs can still be sued.
To succeed, a claimant must show that:
- the defendant invaded their privacy by intruding upon their seclusion (for example, by watching, listening to or recording them) or by misusing information about them;
- a person in their position would have had a reasonable expectation of privacy in all the circumstances;
- the invasion was intentional or reckless, as carelessness alone is not enough;
- the invasion was serious; and
- the public interest in their privacy outweighs any competing public interest, such as freedom of expression or the proper administration of justice.
Remedies
A claim can succeed without proof of financial loss. Courts can award damages, including for emotional distress, grant injunctions to stop or prevent an invasion, and order an apology. Damages other than for economic loss are capped at the same maximum that applies to non-economic loss in defamation.
Who Can Be Sued and Time Limits
The tort applies to individuals and organisations of any size, including small businesses that are exempt from the Australian Privacy Principles. There are exemptions for journalists in relation to journalistic material, intelligence agencies, law enforcement bodies, and government agencies and their staff acting in good faith. A claim must be brought within one year of the claimant becoming aware of the invasion and no later than three years after it occurred. A claimant who was under 18 at the time has until their 21st birthday.
Privacy and reputation claims often overlap. If the material is also false and damaging, see our guide to defamation claims in NSW. The full text is in Schedule 2 of the Privacy Act 1988 (Cth) on the Federal Register of Legislation.
How Citilawyers Can Help
Citilawyers assists with:
- Privacy Act and APP compliance reviews
- Data breach response under the Notifiable Data Breaches scheme
- Updating privacy policies, including the automated decision disclosures that apply from 10 December 2026
- Advice on bringing or defending a claim for a serious invasion of privacy
- Representation in OAIC/NSW Privacy Commissioner investigations
The reforms signal Australia’s commitment to modernising privacy law in a data-driven era. For organisations, compliance is now both a legal imperative and a competitive advantage, demonstrating respect for those whose information you hold. Understanding privacy law is more critical than ever.
Facing or considering a privacy claim? Call (02) 9233 7737 for a free initial phone consultation.
