Privacy Act reform tracker: what has changed and what's next

Privacy Act reform keeps getting announced, which makes it hard to tell what is actually law. Here is the short version. The first tranche passed in December 2024 and most of it is already in force. Two more pieces start on 10 December 2026. The second tranche is still only a draft bill. Consultation closed on 18 September 2026, and the small business exemption has not been removed.

If you run a small or medium business, the useful question is which changes already bind you and which are still someone's proposal. This tracker splits them, with the dates.

Which Privacy Act changes are already law?

December 2024: bigger penalties and a new infringement notice power. The Privacy and Other Legislation Amendment Act 2024 (Cth) added a mid-tier civil penalty for interferences with privacy that are not serious, plus a low-level penalty for specific administrative breaches with infringement notices attached. That is the change behind the OAIC's privacy policy compliance sweep. If your privacy policy is missing content the APPs require, the OAIC can now issue a compliance notice or an infringement notice without going to court. In practice it means the OAIC no longer has to reserve action for catastrophes.

December 2024: doxxing became a criminal offence. New offences in the Criminal Code cover the malicious release of someone's personal data.

December 2024: security obligations spelled out. APP 11 now expressly refers to technical and organisational measures, so things like access controls, encryption and staff training are named rather than implied.

10 June 2025: the statutory tort commenced. People can now sue directly for a serious invasion of privacy, either intrusion into seclusion or misuse of information. It runs alongside the complaints process rather than replacing it, and the OAIC has no direct role in it.

January 2026: the OAIC started checking without being asked. Its first compliance sweep is reviewing about 60 privacy policies across six sectors that collect details face to face. You do not need to have had a breach to come under scrutiny.

1 July 2026: a large group of small businesses came under the Privacy Act. This one came through the anti-money laundering reforms, not the privacy reforms, and it caught a lot of people by surprise. Real estate professionals, lawyers, conveyancers, accountants, trust and company service providers, and dealers in precious metals and stones became reporting entities under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth). Where you provide one of those designated services, the Privacy Act applies to the personal information you handle for it, whatever your turnover. The OAIC has published specific guidance for reporting entities, including advice not to keep copies of full identity documents.

Which Privacy Act changes start on 10 December 2026?

10 December 2026: automated decisions go in your privacy policy

If you use a computer program to make, or substantially help make, decisions that could significantly affect someone's rights or interests, your privacy policy will have to say so. It needs to cover the kinds of personal information used and the kinds of decisions made that way.

"Computer program" is broad. It is not limited to artificial intelligence, so a rules-based screening tool or a scoring spreadsheet can be caught. The work is mapping where those tools sit in your business, which takes longer than the writing does. Our guide to what a privacy policy has to include covers the rest of the page this sits on.

10 December 2026: the Children's Online Privacy Code

The OAIC has to finalise and register the code by that date. It applies to online services likely to be accessed by children, including social media services, messaging and games with chat, and services that let users access content. The OAIC released an exposure draft on 31 March 2026 and consulted until 5 June 2026, receiving 135 written submissions. The registration deadline is fixed, but the date the code itself starts applying has not been settled.

Is the second tranche of Privacy Act reform law yet?

On 31 August 2026 the Attorney-General's Department released an exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026, along with a consultation paper covering roughly 40 proposals. Submissions closed on Friday 18 September 2026. As at 31 October 2026, the bill has not been introduced to Parliament, and the draft sets no start dates. Nothing in it is law, and the department has said the bill remains subject to further consideration by government.

What would the draft second tranche change?

A fair and reasonable test. Collection, use and disclosure would have to be fair and reasonable in the circumstances, whether or not you got consent. Consent would stop being a complete answer.

A wider definition of personal information. The test would shift from information "about" someone to information that "relates to" an identified or reasonably identifiable individual, which brings Australia closer to the European position.

Consent for some direct marketing disclosures. The consultation paper names cookie and pixel disclosures in programmatic advertising as the kind of conduct in scope.

Precise location as sensitive information. A new category keyed to a radius of 500 metres.

A right to erasure on large platforms. Limited to platforms above a revenue or user threshold, not a general right for everyone.

Just as useful is what the draft leaves out. It does not remove the small business exemption or the employee records exemption, and it does not introduce a universal right to erasure, mandatory privacy impact assessments or a direct right of action. Those were all in the Privacy Act Review and none of them are in this draft.

What should a small business do about Privacy Act reform now?

1. Sort what applies to you now from what does not

If you are a reporting entity under the anti-money laundering rules, you are covered today and that is the priority. If your only exposure is the second tranche, you have time.

2. Book the December work now

Automated decision-making disclosures and the children's code both land on 10 December 2026. Map your automated tools first, then write. Doing it the other way round produces a policy that describes systems you do not have.

3. Read your privacy policy against what you actually do

This is the cheapest thing on the list and it is what the regulator is currently checking. Every tool that touches customer data, every supplier, every overseas transfer.

4. Read the consultation paper

Submissions closed on 18 September 2026, but the consultation paper is a fair preview of where this is heading.

This is general information, not legal advice. Every business handles information a bit differently, so if you're not sure how this applies to yours, it's worth checking with a lawyer or privacy adviser.