Privacy & data protection

APP 3 bars collecting sensitive information — health, race, religion, sexual orientation and more — without consent. What counts as sensitive, the exceptions and penalties.

From 10 December 2026, APP entities that use computer programs to make or substantially assist decisions that significantly affect individuals must say so in their APP privacy policy.

Under the NDB scheme, APP entities must notify the OAIC and affected individuals of an eligible data breach likely to cause serious harm — assessed within 30 days.

Before disclosing personal information overseas, APP 8 requires reasonable steps so the recipient meets the APPs — unless an exception applies. Steps and exceptions.

Large businesses (>$100M revenue) must report payment times to small business suppliers every 6 months.

From 11 December 2024, using a carriage service to dox personal data with menace is criminal.

Every APP entity needs a clearly-expressed Privacy Policy covering APP 1.4 requirements.

NSW employers conducting workplace surveillance must give notice + meet specific conditions.

ACT employers must follow ACT workplace surveillance + privacy framework.

Individuals can ask to access (APP 12) and correct (APP 13) the personal information you hold — the strict response times, allowable refusals and how to comply.

Banking, energy and (soon) non-bank lending data sharing — accredited participants must comply with privacy safeguards.

Small companies (<$1M liabilities) can use SDR to restructure without full external admin.

APP 5 requires notice of identity, purposes, recipients, consequences of not providing info, and where Privacy Policy lives.

All commercial electronic messages must have consent, identify the sender, and offer a working unsubscribe.

APP 7 restricts using or disclosing personal information for direct marketing and requires a simple opt-out — when it applies, the exceptions and penalties.

Energy retailers + distributors must share data via CDR.

Credit card limit increase offers cannot be sent without prior written consent.

Tranche 2 reforms in scoping — information controllers + processors regime.

Removing the Privacy Act small business exemption (<$3M turnover) is proposed for a future reform tranche — agreed in principle, not yet law.

Credit providers and CRBs must adhere to the CR Code on collection, use, disclosure, hardship and dispute resolution.

From June 2025 — serious invasion of privacy actionable in tort.

OAIC developing a mandatory children's online privacy code — must be registered by 10 December 2026 (commencement not yet fixed).

Where reasonable, individuals must be able to deal with you anonymously or under a pseudonym.

SBE asset write-off threshold reset annually; $20,000 for FY25-26.

Commonwealth data sharing regime — accredited users + entities.

Australian Privacy Commissioner orders American Express Australia Limited to compensate complainant following interference in privacy

Commissioner Initiated Investigation into Monash IVF Pty Ltd (Privacy) [2026] AICmr 40 (11 June 2026). Finding: breach of APP 3.3; 5.1; 5.2 and 7.1. Remedies: Must not repeat or continue acts and practices found to be an interference with individuals’ privacy — Specified steps to address interference.

Commissioner Initiated Investigation into Medmate Australia Pty Ltd (Privacy) [2026] AICmr 41 (11 June 2026). Finding: breach. OAIC's listing gives the legislative provision as APP 11.1, while its catchword summary for the entry lists APP 3.3, 5.1, 5.2 and 7.1 (collection of sensitive information via third-party tracking pixels). Remedies: Must not repeat or continue acts and practices found to be an interference with individuals' privacy — Specified steps to address interference.

Commissioner Initiated Investigation into IRE Pty Ltd (Privacy) [2026] AICmr 24 (1 April 2026). Finding: breach of APP 3.2; 3.5. Remedies: Must not repeat or continue acts and practices found to be an interference with individuals’ privacy — Specified steps to address interference.

Commissioner Initiated Investigation into Singtel Optus Pty Ltd (Privacy) [2026] AICmr 22 (20 March 2026). Finding: breach of APP 11.1.

Commissioner Initiated Investigation into Vinomofo Pty Ltd (Privacy) [2025] AICmr 175 (17 October 2025). Finding: breach of APP 11. Remedies: Must not repeat or continue acts and practices found to be an interference with individuals’ privacy — Specified steps to address interference.

A Feb 2022 cyberattack on ACL's Medlab Pathology systems led to data on over 223,000 people being exfiltrated. ACL failed to take reasonable security steps, did not assess the suspected eligible data breach quickly enough and was slow to notify the Commissioner. First civil penalties ordered under the Privacy Act; ACL admitted liability and penalty was jointly proposed.

ACCC + OAIC CDR enforcement progressed in 2024-2025 — first civil penalty proceedings + significant infringement notices.

September 2022 Optus breach exposed ~10M customer records. OAIC alleges APP 11 failures + delayed notification.

OAIC investigated multiple SMB-scale breaches in 2024 — including in legal, retail, healthcare. Most resolved without penalty but documented APP 11 reasonable-steps + NDB notification expectations.

Class action + OAIC determination on Medibank Oct 2022 data breach affecting ~9.7M customers + their families.

Class action by ~9.8M Optus customers affected by September 2022 data breach.

Bunnings operated facial recognition in stores for loss prevention without proper notice + consent for sensitive (biometric) information.

Both retailers operated in-store facial recognition systems for loss-prevention. OAIC found inadequate notification and unjustified breach of APP 3.3 (sensitive information).

Kmart operated facial recognition for loss prevention; same proceedings as Bunnings determination 2024.

Multiple NSW government agency privacy reviews including data breaches + PPIPA failures.

Following the February 2022 Medlab Pathology breach, OAIC alleges ACL failed to take reasonable steps to protect personal information and failed to properly notify the breach.

Periodic ACCC + OAIC compliance reviews of CDR Banking data holders + accredited recipients.

March 2023 Latitude breach exposed personal info of ~14M customers including 7.9M driver licences.

Follow-up compliance from 2021 determination + ongoing biometric processing detected.