OAIC

From 10 December 2026, APP entities that use computer programs to make or substantially assist decisions that significantly affect individuals must say so in their APP privacy policy.

Under the NDB scheme, APP entities must notify the OAIC and affected individuals of an eligible data breach likely to cause serious harm — assessed within 30 days.

APP 3 bars collecting sensitive information — health, race, religion, sexual orientation and more — without consent. What counts as sensitive, the exceptions and penalties.

CDR Action Initiation lets accredited recipients initiate payments + actions on consumer behalf.

Every APP entity needs a clearly-expressed Privacy Policy covering APP 1.4 requirements.

Individuals can ask to access (APP 12) and correct (APP 13) the personal information you hold — the strict response times, allowable refusals and how to comply.

Banking, energy and (soon) non-bank lending data sharing — accredited participants must comply with privacy safeguards.

APP 5 requires notice of identity, purposes, recipients, consequences of not providing info, and where Privacy Policy lives.

Banking data holders must share consumer data with accredited recipients on consumer consent.

APP 7 restricts using or disclosing personal information for direct marketing and requires a simple opt-out — when it applies, the exceptions and penalties.

Energy retailers + distributors must share data via CDR.

OAIC developing a mandatory children's online privacy code — must be registered by 10 December 2026 (commencement not yet fixed).

Tranche 2 reforms in scoping — information controllers + processors regime.

FOI Act 1982 — Commonwealth agencies + ministers must respond to access requests within 30 days.

Removing the Privacy Act small business exemption (<$3M turnover) is proposed for a future reform tranche — agreed in principle, not yet law.

Credit providers and CRBs must adhere to the CR Code on collection, use, disclosure, hardship and dispute resolution.

Before disclosing personal information overseas, APP 8 requires reasonable steps so the recipient meets the APPs — unless an exception applies. Steps and exceptions.

Where reasonable, individuals must be able to deal with you anonymously or under a pseudonym.

Australian Privacy Commissioner orders American Express Australia Limited to compensate complainant following interference in privacy

Commissioner Initiated Investigation into Monash IVF Pty Ltd (Privacy) [2026] AICmr 40 (11 June 2026). Finding: breach of APP 3.3; 5.1; 5.2 and 7.1. Remedies: Must not repeat or continue acts and practices found to be an interference with individuals’ privacy — Specified steps to address interference.

Commissioner Initiated Investigation into Medmate Australia Pty Ltd (Privacy) [2026] AICmr 41 (11 June 2026). Finding: breach. OAIC's listing gives the legislative provision as APP 11.1, while its catchword summary for the entry lists APP 3.3, 5.1, 5.2 and 7.1 (collection of sensitive information via third-party tracking pixels). Remedies: Must not repeat or continue acts and practices found to be an interference with individuals' privacy — Specified steps to address interference.

Commissioner Initiated Investigation into IRE Pty Ltd (Privacy) [2026] AICmr 24 (1 April 2026). Finding: breach of APP 3.2; 3.5. Remedies: Must not repeat or continue acts and practices found to be an interference with individuals’ privacy — Specified steps to address interference.

Commissioner Initiated Investigation into Singtel Optus Pty Ltd (Privacy) [2026] AICmr 22 (20 March 2026). Finding: breach of APP 11.1.

Commissioner Initiated Investigation into Vinomofo Pty Ltd (Privacy) [2025] AICmr 175 (17 October 2025). Finding: breach of APP 11. Remedies: Must not repeat or continue acts and practices found to be an interference with individuals’ privacy — Specified steps to address interference.

A Feb 2022 cyberattack on ACL's Medlab Pathology systems led to data on over 223,000 people being exfiltrated. ACL failed to take reasonable security steps, did not assess the suspected eligible data breach quickly enough and was slow to notify the Commissioner. First civil penalties ordered under the Privacy Act; ACL admitted liability and penalty was jointly proposed.

September 2022 Optus breach exposed ~10M customer records. OAIC alleges APP 11 failures + delayed notification.

OAIC investigated multiple SMB-scale breaches in 2024 — including in legal, retail, healthcare. Most resolved without penalty but documented APP 11 reasonable-steps + NDB notification expectations.

Class action + OAIC determination on Medibank Oct 2022 data breach affecting ~9.7M customers + their families.

Class action by ~9.8M Optus customers affected by September 2022 data breach.

Bunnings operated facial recognition in stores for loss prevention without proper notice + consent for sensitive (biometric) information.

Both retailers operated in-store facial recognition systems for loss-prevention. OAIC found inadequate notification and unjustified breach of APP 3.3 (sensitive information).

Kmart operated facial recognition for loss prevention; same proceedings as Bunnings determination 2024.

Following the February 2022 Medlab Pathology breach, OAIC alleges ACL failed to take reasonable steps to protect personal information and failed to properly notify the breach.

March 2023 Latitude breach exposed personal info of ~14M customers including 7.9M driver licences.

Follow-up compliance from 2021 determination + ongoing biometric processing detected.

The October 2022 Medibank breach exposed personal information of approximately 9.7 million current and former customers. OAIC alleges Medibank failed to take reasonable steps to protect personal information.

Health Engine forwarded patient data to insurance brokers without proper consent.

Clearview AI scraped publicly available images from the web and used them to build a facial-recognition tool that was offered to Australian police agencies.

7-Eleven collected facial images and faceprints from customers via in-store tablets as part of a customer feedback program. Consent processes were inadequate.

Uber failed to protect personal information of 1.2M Australian customers/drivers in the 2016 breach, and concealed the breach for over a year by paying the attacker as a 'bug bounty'.

PageUp HR software experienced a security incident potentially exposing recruitment data of major Australian employers (CBA, Telstra, Coles, NAB). Quick public notification.