The Australian privacy landscape has shifted more in the last eighteen months than in the previous thirty years, and it’s still moving. The statutory tort for serious invasions of privacy is now live. Tranche 1 reforms have re-armed the OAIC with infringement notices, mid-tier penalties and search-and-seizure powers. Tranche 2 is on the runway. Automated decision-making transparency obligations land on 10 December 2026. The small business exemption is on borrowed time.
At TechLawyers.com.au, we’re Australian privacy, data and cyber security lawyers who advise founders, boards, CISOs, fintechs, HealthTech operators, AI businesses and listed companies on what the law actually requires of them. Not a textbook recital of the Australian Privacy Principles. Real, commercial advice on how to build, defend and recover — without it dragging on for six months and three retainers.
Why 2026 Is the Year Australian Privacy Law Grew Up
For decades, Australian privacy law sat in the regulatory background. Most businesses had a privacy policy buried in their footer, a vague reference to the Australian Privacy Principles, and not much else. That era is over.
Three things have happened in quick succession:
The Privacy and Other Legislation Amendment Act 2024 (Cth) received Royal Assent on 10 December 2024 — the first substantive amendment to the Privacy Act since 2012. It introduced a statutory tort, criminal offences for doxxing, infringement-notice and compliance-notice powers for the OAIC, a Children’s Online Privacy Code, and new automated decision-making transparency obligations.
The Tier 3 civil penalty for serious or repeated interferences with privacy now stands at the greater of $50 million, three times the benefit obtained, or 30% of adjusted turnover during the contravention period. Mid-tier penalties of up to $3.3 million apply for non-serious interferences — a lower threshold that the OAIC is expected to use far more frequently than the rarely-deployed top tier.
The tranche 2 reform agenda is now firmly on the legislative pipeline: a ‘fair and reasonable’ test for collection and use; likely narrowing or removal of the small business and employee record exemptions; new individual rights modelled on the GDPR (including erasure); and an expanded definition of personal information that captures online identifiers, location data and inferred attributes.
The result: most Australian organisations now face a privacy regime that looks and bites very differently to the one they last updated their policies for. This is what we help our clients navigate, every day.
Who We Help
Our privacy, data and cyber security practice serves a specific cross-section of the Australian and international market.
Listed and large private companies dealing with board-level privacy governance, ASIC’s cyber security expectations, data breach response and class action exposure.
Fintechs and financial services businesses navigating overlapping obligations under the Privacy Act, the AML/CTF regime, CDR data rules, ASIC’s cyber resilience framework and APP 8 cross-border disclosure.
HealthTech and digital health providers handling sensitive health information under the Privacy Act, the My Health Records Act 2012 (Cth), state health records legislation and the Therapeutic Goods Administration’s expectations of software as a medical device.
AI and machine learning businesses grappling with the automated decision-making transparency obligations commencing 10 December 2026, the Voluntary AI Safety Standard’s ten guardrails, and the privacy implications of training data, inference and agentic systems. This is the convergence we spend a lot of time thinking about — see our work at the intersection of AI and digital assets for context.
SaaS, e-commerce and digital platforms dealing with cookie consent, marketing law, the Spam Act, behavioural advertising, online tracking and the Children’s Online Privacy Code (registration due by 10 December 2026).
Professional services firms (now in-scope under AML/CTF tranche 2) — lawyers, accountants, real estate agents, dealers in precious metals — needing privacy and AML/CTF frameworks that work together rather than against each other from 1 July 2026.
International businesses with Australian customers assessing whether they have an ‘Australian link’, what GDPR compliance does and doesn’t get them, and how to operate here without triggering disproportionate compliance overhead.
Our Privacy, Data and Cyber Security Services
Privacy Compliance Frameworks
Building a privacy framework that actually works means more than dropping a template policy on your website. Australian Privacy Principle 1.2 requires entities to implement practices, procedures and systems that demonstrably comply with the APPs — a structural obligation that the OAIC now treats as a standalone basis for enforcement.
We design end-to-end privacy programs that include:
- Australian Privacy Principles (APP) gap analysis against your current operations
- Privacy policies, collection notices, consent flows and just-in-time disclosures
- Data inventories, records of processing and retention schedules
- Internal privacy governance, breach response playbooks and staff training
- Privacy Impact Assessments (PIAs) for new products, integrations and AI deployments
- Privacy management plans that align to OAIC expectations and board reporting needs
The goal is a framework your team will actually use — not a 90-page document that lives in SharePoint and never gets opened.
Data Breach Response and Notifiable Data Breaches
It’s late on a Friday. Your incident response team has confirmed unauthorised access to a customer database. The clock has started. Whom do you notify? When? How? What goes in the statement? What gets disclosed to the regulator versus to the market? What gets said internally to staff before someone leaks it externally?
We provide immediate, actionable counsel during a live incident, including:
- Assessing whether the incident is an ‘eligible data breach’ under the Notifiable Data Breaches scheme
- Managing the 30-day assessment window the OAIC treats as the maximum
- Drafting the notification to affected individuals and the OAIC statement
- Coordinating with the Australian Cyber Security Centre, AFP, state regulators and (where relevant) overseas authorities
- Engaging with insurers, forensic investigators and incident response vendors under privilege
- Managing media, customer and stakeholder communications
- Post-incident review, regulatory engagement and class action defence preparation
For listed entities, we also coordinate with continuous disclosure obligations under the ASX Listing Rules. For APRA-regulated entities, we manage CPS 234 reporting in parallel.
Cyber Security and Information Security Law
Privacy and cyber security are two sides of the same regulatory coin. The Privacy Act’s APP 11 obligation to take ‘reasonable steps’ to protect personal information was clarified in 2024 to expressly require technical and organisational measures. ASIC has elevated cyber resilience to a core compliance obligation for licensees. APRA’s CPS 234 and the proposed CPS 230 operational risk standard add their own layers.
We advise on:
- Cyber security policy frameworks aligned to the Essential Eight, NIST CSF and ISO 27001
- Board reporting and director duties in relation to cyber risk (post-RI Advice)
- Incident response retainers and tabletop exercises with legal privilege architecture built in
- Critical infrastructure obligations under the Security of Critical Infrastructure Act 2018 (Cth)
- Ransomware response, payment decisions and Department of Home Affairs reporting
- Supply chain and vendor cyber due diligence
AI, Automated Decision-Making and Algorithmic Accountability
From 10 December 2026, organisations using computer programs to make — or do something substantially and directly related to — decisions that significantly affect individuals must disclose specified information about those automated processes in their privacy policies. The provision was drafted broadly. It will catch far more AI and algorithmic systems than most operators currently appreciate.
We advise on:
- Whether your AI or algorithmic systems trigger the automated decision-making transparency obligation
- Privacy policy uplift to meet the new disclosure requirements
- Privacy Impact Assessments for AI deployments, including training data lawfulness
- The Voluntary AI Safety Standard’s ten guardrails and how to operationalise them
- Discrimination, consumer law and financial services overlays on automated decisions
- Vendor diligence on third-party AI tools and the privacy commitments their providers can actually meet
For businesses operating at the intersection of AI and digital assets, see our cryptocurrency, blockchain and AI services page.
Sensitive Information, Health Data and Biometrics
Health information, biometric identifiers, sexual orientation, racial or ethnic origin, religious beliefs, criminal history and union membership are all ‘sensitive information’ under the Privacy Act, attracting heightened collection, use and disclosure standards. A breach in this domain is catastrophic — operationally, reputationally and financially.
We support healthcare providers, HealthTech firms, employers running biometric access controls, and AI businesses deploying facial recognition or voice biometrics in navigating the My Health Records Act 2012 (Cth), state health records legislation, and the OAIC’s active enforcement posture on facial recognition (including the Bunnings determination and its appeal).
Commercial Contracts and Vendor Risk
No business wants to discover that an agreement exposes them to liability for a vendor’s security failure — particularly when the regulator views your business, not the vendor, as accountable to the affected individuals.
We draft and negotiate:
- Data processing addenda and data sharing agreements
- APP 8 cross-border disclosure clauses and standard contractual clauses
- Breach notification and cooperation provisions
- Audit rights, security warranties and remediation obligations
- Liability caps, indemnities and insurance flow-down requirements
- AI-specific contract terms covering training data, model outputs, IP and confidentiality
Your agreements should be a shield, not a vulnerability. The same diligence matters when these data and security risks are tested in a transaction — see our technology M&A services.
Cross-Border Data Transfers and Data Sovereignty
APP 8 is one of the most misunderstood provisions in the Privacy Act. Most Australian businesses now use overseas cloud providers, offshore support, foreign-headquartered SaaS tools or international data analytics platforms. Each of those constitutes a disclosure of personal information overseas, with the disclosing entity generally remaining accountable in Australia for any breach by the overseas recipient.
We advise on:
- Whether a particular arrangement is a ‘disclosure’ or merely a ‘use’ (the distinction is critical)
- The exceptions to APP 8 accountability — and which actually apply to your circumstances
- Contractual and operational safeguards for overseas disclosures
- The new ministerial ‘whitelisting’ framework for jurisdictions with substantially similar protections
- Data sovereignty obligations for government, defence and critical infrastructure contracts
- Interaction with the GDPR, UK GDPR, Singapore PDPA and other foreign privacy regimes your business may also face
Statutory Tort and Privacy Litigation
The statutory tort for serious invasions of privacy commenced on 10 June 2025 and has fundamentally changed the litigation landscape. For the first time in Australia, individuals can sue directly — and seek damages including for emotional distress — for intrusion upon seclusion or misuse of personal information. The Act expressly contemplates class actions.
We act for both plaintiffs and respondents in:
- Statutory tort claims and class action defence
- OAIC investigations, determinations and Federal Court enforcement proceedings
- ASIC and APRA engagement on cyber and privacy matters
- Defamation and privacy interplay (including the new media exemption questions)
- Pre-action privilege strategy for organisations under investigation
Why a Specialist Privacy and Cyber Lawyer Matters
The penalty exposure for getting this wrong is no longer theoretical. The OAIC commenced its first-ever compliance sweep in December 2025, has been pursuing more matters in the Federal Court, and now has infringement notice powers it can use without going to court at all. The statutory tort opens the door to plaintiff law firms in a way Australian privacy litigation has never seen before. ASIC has accelerated enforcement of cyber resilience obligations as a core licensee duty. Civil penalties for serious interferences with privacy reach $50 million per contravention.
Generic legal advice — or, worse, a template downloaded from the internet and tweaked over a weekend — does not survive contact with this regulatory environment. Specialist advice at the right moment changes the trajectory of a matter. The wrong advice, or no advice, can end one.
We work with organisations that take this seriously. That means frameworks that are tailored, not templated. Advice that’s specific to your data, your systems and your sector, not generic to your industry. And a working relationship where we already know your business when the regulator’s email lands — or the breach happens at 11pm on a Saturday.
How We Work
The same approach runs through everything we do across privacy, technology, intellectual property and the broader digital regulatory landscape.
Commercial. Compliance has to be operationally workable. A framework your team can’t follow is a framework a regulator will find a gap in — and a plaintiff lawyer will turn into a case study.
Technically literate. We understand cloud architectures, data flows, encryption-at-rest versus encryption-in-transit, the difference between disclosure and use, what a SOC 2 report actually tells you, and what ‘agentic AI’ really means in 2026. The advice reflects the technology because we understand the technology.
Direct. Where the law is clear, we say so. Where it’s ambiguous, we tell you the range and our recommended position. We don’t pile on caveats to make our advice unfalsifiable.
Responsive. The 30-day NDB assessment window doesn’t pause for weekends. When you need an opinion delivered, a notification drafted or a regulator response filed, we move at the speed the matter demands.
Frequently Asked Questions
What is the Privacy Act 1988 and who does it apply to?
The Privacy Act 1988 (Cth) is Australia’s primary data protection legislation. It applies to most Australian Government agencies, all private-sector health service providers, and businesses with an annual turnover above $3 million. It also applies to certain smaller businesses — those that trade in personal information, are contracted Commonwealth service providers, or are credit providers or credit reporting bodies. The small business exemption is on the legislative reform agenda and is widely expected to be narrowed or removed under tranche 2 reforms.
Do I need to notify the OAIC about a data breach?
Under the Notifiable Data Breaches (NDB) scheme, you must notify both affected individuals and the OAIC if a data breach is likely to result in serious harm and you cannot mitigate that harm through remedial action. You must complete a ‘reasonable and expeditious’ assessment, and the OAIC treats 30 days as the maximum window — shorter where the circumstances allow.
What are the penalties for breaching the Privacy Act?
Australia now operates a tiered civil penalty regime. Tier 1 infringement notices reach $330,000 per contravention for corporations. Tier 2 mid-tier penalties for non-serious interferences with privacy reach $3.3 million for corporations. Tier 3 penalties for serious or repeated interferences are the greater of $50 million, three times the benefit obtained, or 30% of adjusted turnover during the contravention period. Beyond civil penalties, organisations face direct rights of action by individuals, the statutory tort, and class action exposure.
What is the statutory tort for serious invasions of privacy?
Commenced on 10 June 2025, the statutory tort allows individuals to sue directly where another person or organisation intentionally or recklessly intrudes upon their seclusion or misuses information about them, where the invasion is serious, privacy was reasonably expected, and the public interest does not weigh against protection. It opens the door to privacy class actions in Australia for the first time and applies even where the conduct does not breach an Australian Privacy Principle.
What is ‘Privacy by Design’?
Privacy by Design is the practice of embedding privacy and data protection into the architecture of products, systems and business processes from the outset, rather than retrofitting it after launch. Australian Privacy Principle 1.2 effectively codifies the concept by requiring entities to implement practices, procedures and systems that demonstrably comply with the APPs. Failure to do so can itself be a breach of the Privacy Act.
How does Australian privacy law differ from the GDPR?
While both regimes regulate personal data, the Australian Privacy Principles and the GDPR differ in several material respects. The APPs operate on a ‘reasonable steps’ standard rather than the GDPR’s more prescriptive accountability obligations; consent thresholds and definitions of personal information differ; the GDPR offers explicit individual rights such as the right to erasure that Australian law does not yet match (though tranche 2 reforms are expected to introduce them); and cross-border transfer rules under APP 8 take a different approach to the GDPR’s adequacy and standard contractual clause framework. Businesses already GDPR-compliant still need to ‘Australianise’ their policies and operations.
When do automated decision-making transparency obligations commence?
From 10 December 2026, organisations using computer programs to make — or do something substantially and directly related to — decisions that significantly affect individuals must disclose specified information about those automated processes in their privacy policies. The requirement was introduced under tranche 1 of the Privacy Act reforms and applies to a wide range of AI and algorithmic decision systems used in employment, credit, insurance, financial services and online platforms.
Does my overseas cloud provider create a privacy compliance problem?
Disclosing personal information to an overseas recipient is regulated by Australian Privacy Principle 8. In most cases your business remains accountable in Australia for any breach of the APPs by that overseas recipient, unless an exception applies. Practical compliance involves contractual safeguards, due diligence on the overseas provider, accurate disclosure in your privacy policy, and ongoing oversight. The 2024 reforms introduced a ‘whitelisting’ mechanism for jurisdictions with substantially similar protections, although no countries have been formally whitelisted at the time of writing.
Are small businesses still exempt from the Privacy Act?
The small business exemption (for businesses with turnover at or below $3 million) still exists, but its scope is narrowing. A 2024 amendment will bring an estimated 100,000+ additional small businesses within the Privacy Act from 1 July 2026, and the exemption itself is widely expected to be repealed or significantly narrowed under tranche 2 reforms. Even small businesses that remain outside the Act face commercial pressure to demonstrate privacy compliance to enterprise customers, government clients and platform partners.
What is the Children’s Online Privacy Code?
The Children’s Online Privacy Code is a binding APP code to be developed and registered by the OAIC by 10 December 2026. It will apply to APP entities that provide online or electronic services likely to be accessed by children, with social media services and designated internet services the primary initial focus. The Code will impose additional, child-specific obligations on top of the APPs and will draw on comparable instruments such as the UK’s Age Appropriate Design Code.
Ready to Talk to a Privacy and Cyber Security Lawyer?
Whether you’re scoping a privacy compliance program, mid-incident, preparing for a tranche 2 reform world, embedding privacy into an AI deployment, or responding to an OAIC inquiry, get in touch with our team.
We’ll give you a clear-eyed read on where you sit, what’s required, what’s optional, what’s urgent and what can wait. No padded scopes. No fear-selling. Just the straight answer you need to make your next move with confidence.
TechLawyers.com.au is operated by Rubicon Law and advises clients in Brisbane, the Gold Coast, Sydney, Melbourne, Perth and across Australia, as well as international clients with Australian regulatory obligations. Contact us for a confidential conversation.
For official guidance, see the Office of the Australian Information Commissioner (OAIC), the Australian Cyber Security Centre, the Australian Privacy Principles, and the Notifiable Data Breaches scheme.
This page is general information about Australian privacy, data and cyber security law and is not legal advice. For advice on your specific circumstances, please contact us directly.