Privacy and Other Legislation Amendment Act 2024: What Changed

What changed, and when

The Privacy and Other Legislation Amendment Bill 2024 was introduced on 12 September 2024 and received assent on 10 December 2024 as the Privacy and Other Legislation Amendment Act 2024 (Cth), No 128 of 2024. It did not commence all at once. Section 2 of the Act staged it, and only the last stage remains.

Most of the Act, including the new penalty tiers, the Children's Online Privacy Code mandate, the data breach declarations, the overseas transfer mechanism and the doxxing offences, commenced on 11 December 2024. The statutory tort for serious invasions of privacy commenced on 10 June 2025, when the six months allowed for a proclamation ran out. The automated decision rules for privacy policies commence on 10 December 2026.

The headline maximum penalty for a serious interference with privacy, the greatest of $50 million, three times the benefit obtained or 30% of adjusted turnover, is set out with the text of section 13G in our note on when the GDPR reaches an Australian business. This article deals with everything else the Act changed.

The statutory tort for serious invasions of privacy: who can sue whom

Since 10 June 2025 an individual can sue for a serious invasion of privacy without proving any loss. The cause of action is in Schedule 2 of the Privacy Act 1988 (Cth). Clause 7 sets out five elements, all of which the plaintiff must establish:

Two features of that wording matter most to a business. The plaintiff must be an individual, so a company whose confidential information is leaked has no claim under the tort and must rely on confidence, contract or defamation. The defendant is another person, so the tort runs against individuals and businesses of every size. The small business exemption, which keeps most businesses with annual turnover of $3 million or less outside the Australian Privacy Principles, appears nowhere in Schedule 2, and the Schedule is to be read separately from the rest of the Act.

Intrusion upon seclusion includes physically intruding into a person's private space and watching, listening to or recording their private activities or affairs. Misusing information includes collecting, using or disclosing it. Both definitions are inclusive, and under clause 7(7) it does not matter whether misused information was true.

Intent, seriousness and the public interest

Carelessness is not enough: the invasion must be intentional or reckless, and recklessness carries its Criminal Code meaning. A data breach caused by poor security will not usually found the tort, although it may still be an interference with privacy under the Australian Privacy Principles and attract a civil penalty.

Seriousness is judged by factors the court may consider under clause 7(6), including the offence, distress or harm to dignity likely to be caused to a person of ordinary sensibilities, whether the defendant knew or ought to have known that, and, where the invasion was intentional, whether the defendant was motivated by malice. The public interest in privacy must then outweigh any countervailing public interest. Clause 7(3) lists freedom of expression, freedom of the media, the proper administration of government, open justice, public health and safety, national security and the prevention and detection of crime and fraud.

Defences cover lawful authority, consent, a reasonable belief that the invasion was necessary to prevent or lessen a serious threat to life, health or safety, and the defence of persons or property where that is proportionate, necessary and reasonable. Where the invasion is a publication, absolute privilege, publication of public documents and fair report of proceedings of public concern are also available.

There is no exemption for employers or for small businesses. Whether an employer answers for an employee's deliberate invasion of a customer's privacy is a question Schedule 2 does not address, and no court has yet decided it.

What a privacy claim is worth, and how long a plaintiff has

Damages for non-economic loss and any exemplary damages together are capped, and the cap now follows the defamation cap, which is $520,000 from 1 July 2026. Clause 11(5) fixes the cap at the greater of $478,550 and the maximum for non-economic loss in defamation proceedings under an Australian law. The $478,550 figure is fixed in the Schedule; the defamation maximum is declared under the State and Territory defamation Acts and stood at $520,000 from 1 July 2026, so it is the defamation figure that now governs. Economic loss is outside the cap, aggravated damages are not available, and exemplary damages are reserved for exceptional circumstances.

A court may also order an account of profits, an injunction, an apology, a correction, the destruction or delivery up of material, or a declaration. An apology is relevant to the amount of damages and, under clause 13, is not an admission of fault or liability. Where the invasion involves publishing, the court considering an injunction must have particular regard to the public interest in the publication.

The limitation period is short, and the drafting is precise:

A court may extend the time, but never beyond six years after the invasion. No claim can be brought for the privacy of a person who has died, or against a defendant who has died.

That interlocutory ruling in Kurraba is the only published decision under Schedule 2 we have found. Nothing has yet been decided about what makes an invasion serious or reckless.

Automated decision-making: what a privacy policy must say from 10 December 2026

From 10 December 2026, an APP entity that uses a computer program in significant decisions about individuals must say so in its privacy policy. The new Australian Privacy Principles 1.7 and 1.8 were inserted by Schedule 1, Part 15 of the Act:

Under APP 1.9 a decision includes refusing or failing to decide, and it may affect rights or interests beneficially as well as adversely. The examples given are a decision to grant or refuse a statutory benefit, a decision affecting rights under a contract, and a decision affecting access to a significant service or support. Credit, insurance, account suspension, fraud blocking and recruitment screening are the obvious commercial candidates.

The rule applies to every decision made from 10 December 2026, even if the program was installed, or the personal information collected, years earlier. A small business outside the Australian Privacy Principles is outside this rule as well.

What the automated decision rule does and does not require

The policy must describe kinds of information and kinds of decisions. It need not explain how the program reaches its output. The original version of this article said otherwise. APP 1.8 does not require an explanation of any individual decision, and the second tranche exposure draft does not add one.

The rule is wider than a fully automated decision. Paragraph (a) of APP 1.7 catches a program that does a thing "substantially and directly related" to a human's decision, such as a risk score or a recommendation a reviewer usually follows. The Office of the Australian Information Commissioner's guidance issued on 30 September 2026 says human review does not of itself take a decision outside the rule, and that the obligation stays with the entity that arranged for the program even where a vendor operates it.

The OAIC's guidance also states that commercially sensitive detail about a system need not be disclosed. That position rests on the explanatory material to the Bill rather than on any exception in the Act. In practice it rarely matters, because a policy written at the level of kinds of information and kinds of decisions does not reveal how a system works.

The penalty ladder below the $50 million maximum

The Act built two tiers beneath the headline penalty, and the lowest one needs no harm and no seriousness at all. Section 13K is a civil penalty for specified process failures, and the OAIC can deal with it by notice without going to court.

A penalty unit is $364 for conduct from 1 July 2026, so the company maximum under section 13H is about $3.64 million and an ordinary section 13K infringement notice is $21,840 per contravention. Sections 13H and 13K themselves state 2,000 and 200 penalty units; the company figures in Table 3 are five times those amounts, by section 82(5) of the Regulatory Powers (Standard Provisions) Act 2014 (Cth).

Instead of an infringement notice, the Commissioner may give a compliance notice under section 80UC requiring specified steps within a reasonable time. Complying is not an admission. More usefully, while a notice that has been complied with stands, section 80UC(8) prevents the Commissioner from seeking a civil penalty under sections 13G, 13H or 13K for the same conduct. A compliance notice can be reviewed by the Federal Court or the Federal Circuit and Family Court.

The middle tier, court orders and investigation powers

Under section 13H an interference with privacy attracts a civil penalty whether or not it is serious. Section 13H(1) reads:

Where the Commissioner sues under section 13G and fails on seriousness, the court may impose a section 13H penalty instead. For section 13G itself, section 13G(1B) now lists factors a court may weigh in deciding whether an interference is serious, including the sensitivity of the information, the number of people affected, whether a child or vulnerable person was affected, repetition, and a failure to put practices, procedures and systems in place.

Once a court has found, or will find, a civil penalty contravention, section 80UA lets it order redress, compensation to any affected individual, steps to stop the conduct, or a public statement. An affected individual or the Commissioner may apply within six years of the contravention, and compensation ordered is recoverable as a debt. The power depends on civil penalty proceedings, which the Commissioner brings, so it is not a free-standing right for individuals to sue.

The OAIC's investigation powers, including entry, search and seizure under the Regulatory Powers (Standard Provisions) Act 2014 (Cth), now extend to every offence and civil penalty provision in the Act. Its monitoring powers are narrower and are confined to specified provisions and information. The Minister may also direct or approve a public inquiry by the Commissioner into specified acts or practices, or direct the Commissioner to develop an APP code.

Security of personal information and data breaches

APP 11 now says expressly that reasonable security steps include technical and organisational measures. New APP 11.3 applies to all personal information held from 11 December 2024, however old. It makes clear that organisational steps, such as training, access policies and governance, form part of the standard alongside technical controls.

The Act also lets the Minister make an eligible data breach declaration after a breach, for up to 12 months, specifying what personal information may be shared, by and with whom, and for which harm reduction purposes. While a declaration is in force, an entity that reasonably believes a person may be at risk can collect, use or disclose their information within its terms without breaching the Australian Privacy Principles or a duty of confidence. A declaration permits sharing; it does not compel it:

A recipient who passes the information on outside the permitted cases commits an offence carrying 60 penalty units, imprisonment for one year, or both. We found no declaration registered on the Federal Register of Legislation as at 9 November 2026.

The Children's Online Privacy Code

The OAIC must register a Children's Online Privacy Code setting out how the Australian Privacy Principles apply to children, and the statutory deadline is 9 December 2026. Section 26GC(10) allows 24 months from assent, and under the Acts Interpretation Act 1901 (Cth) that period ends at the close of 9 December 2026.

The Code binds an APP entity that provides a social media service, a relevant electronic service or a designated internet service, as the Online Safety Act 2021 (Cth) defines them, which is likely to be accessed by children, unless the entity is providing a health service. The Code may add or exclude entities. A child is anyone under 18. On the OAIC's description, apps, games, messaging services, streaming, cloud storage and many ordinary websites can fall within those categories.

The OAIC consulted on an exposure draft from 31 March to 5 June 2026. When we checked the Federal Register on 9 November 2026 the Code had not been registered. Once registered it will be a disallowable legislative instrument and will take effect from the date it specifies. Breach of a registered APP code is an interference with privacy under section 13(1)(b), so the civil penalty provisions in sections 13G and 13H apply to it. The OAIC's code page tracks its progress.

Doxxing is now a Commonwealth offence

Using the internet or a phone network to publish a person's personal data in a way that reasonable people would regard as menacing or harassing carries up to six years' imprisonment. Section 474.17C of the Criminal Code provides:

The test in paragraph (c) is what reasonable persons would regard as menacing or harassing. The section does not make an intention to menace or harass an element of the offence. Personal data includes a name, image, phone number, email address, online account, home or work address, and place of education or worship. Section 474.17D carries seven years where the conduct is motivated by a belief that the targets belong to a group distinguished by race, religion, sex, sexual orientation, gender identity, intersex status, disability, nationality or national or ethnic origin.

These are offences by the person who publishes, not compliance obligations on businesses that hold data. The Minister must have an independent review of their operation begin as soon as practicable after 10 December 2026, with a report six months after it starts.

Sending personal information overseas

The Act created a route for sending personal information to approved countries without carrying liability for the overseas recipient, and no country has yet been approved. Ordinarily, under APP 8, an Australian entity that discloses personal information overseas remains accountable for what the recipient does with it. New APP 8.3 removes that where the recipient is subject to the laws of a country, or a binding scheme, prescribed by regulation. Before any country is prescribed, section 100(1A) requires the Minister to be satisfied of two things:

The Privacy Regulations 2025 (Cth), in force from 1 April 2026, prescribe no country and no scheme. Until a country is prescribed, an Australian entity sending data to a European recipient has the existing exception in APP 8.2(a), which turns on the entity's own reasonable belief that the recipient is bound by a law substantially similar to the Australian Privacy Principles with enforcement mechanisms the individual can use; the prescribed-country route would replace that self-assessment with certainty. Otherwise the group relies on contract and the APP 8 accountability rule on the Australian side, and on the GDPR's transfer rules on the European side, which our note on offering digital products to the EU market also touches.

What the second tranche of Privacy Act reform would change

The second tranche exists as an exposure draft, the Privacy Amendment (Personal Data Protection) Bill 2026, released for consultation on 31 August 2026 and not yet introduced to Parliament. Consultation closed on 18 September 2026, and the Attorney-General's Department says the Bill remains subject to further consideration by government. The draft's commencement table is blank.

The draft would, among roughly 40 proposals:

• redefine personal information as information that relates to an identified or reasonably identifiable individual;
• add precise geolocation tracking data and genomic information to sensitive information;
• define consent as voluntary, informed, current, specific and unambiguous, and require consent to trade personal information;
• replace several collection, use and disclosure rules with a single test that handling be fair and reasonable in the circumstances, with a child's best interests a primary consideration;
• require a statement to the Commissioner within 72 hours of reasonable grounds to believe an eligible data breach has occurred;
• give individuals a right to erasure against large digital platforms; and
• introduce controllers and processors, so that a processor acting on documented instructions is treated as acting for the controller.

Just as important is what the draft does not do. It keeps the small business exemption, adjusting only the rules on trading in personal information. It contains no direct right of action for breach of the Australian Privacy Principles, no change to the employee records exemption and no right to an explanation of an automated decision.

What to do now

Most of the work the 2024 Act requires is documentary, and the next deadline is 10 December 2026. The European side of the same exercise is in our note on European cybersecurity obligations, and vendor terms for decision tools often end up where our note on technology contract disputes begins.

Where the consent and design questions in the second tranche overlap with consumer law, the new Australian Consumer Law bans on unfair trading practices are the other half of the picture. For groups with an Australian subsidiary, our cross-border and IP and technology law pages describe how we approach the two regimes together, and our technology and software page covers the sector.

This article is provided for general information purposes only and does not constitute legal advice. Specialised legal counsel should be sought for specific fact patterns.