--- title: "Australia — Data Subject Rights | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/australia/data-subject-rights/ source_html: /jurisdictions/australia/data-subject-rights/index.html description: "Australia — Data Subject Rights: data_subject_rights Data Subject Rights 5 sub-modules 5 claims Amber ▾ # Core access/correction/portability rights exist and are enforceable, but erasure and objection/restriction righ" generated_at: 2026-10-25T04:46:50Z content_sha256: 50a914d56015fe0a4911f738d93b5e33e70798d941646c9a4299c9bfef98e598 generator: "fe-fleet/md-twin@1.0" --- # Australia — Data Subject Rights | Data Protection Monitor ### D3Data Subject Rights5 sub-modules5 claimsAmber▾# Core access/correction/portability rights exist and are enforceable, but erasure and objection/restriction rights are narrower or not yet legislated compared to GDPR. Primary framework Privacy Act 1988 (Cth) APPs 12–13; Treasury Laws Amendment (Consumer Data Right) Act 2019 Supervisory authority [Office of the Australian Information Commissioner (OAIC)](https://www.oaic.gov.au/) Traffic-light rationale — Amber Core access/correction/portability rights exist and are enforceable, but erasure and objection/restriction rights are narrower or not yet legislated compared to GDPR. #### Sub-modules (5) #### Access RightGreen General right to access and be informed about held personal information. Claims (1): - The Privacy Act and APPs provide individuals a general right to access and be informed about personal information held about them by APP entities. #### Rectification And ErasureAmber Correction right exists; general erasure right not yet enacted (flagged for future tranche). Claims (1): - Commentators noted the 2024 reform bill 'doesn't touch most of the substantive principles' and that a general right to erasure and improved consent models were expected only in a later legislative tranche not materialising before mid-2025 at the earliest. #### Restriction And ObjectionAmber Objection right limited mainly to direct-marketing opt-out under APP 7. Claims (1): - APP 7 requires organisations to provide individuals an easy means to opt out of direct marketing communications. #### Data PortabilityGreen Portability delivered via the sectoral Consumer Data Right rather than a general Privacy Act right. Claims (1): - The Consumer Data Right, introduced via the Treasury Laws Amendment (Consumer Data Right) Bill/Act 2019, provides consumers with the right to data portability to switch between products and services. #### Deadlines And Response WindowsGreen NDB scheme imposes a 30-day reasonable assessment window plus 'as soon as practicable' notification. Claims (1): - The Privacy Act requires organisations to take reasonable steps to conduct a data breach assessment within 30 days of becoming aware of grounds to suspect an eligible data breach, and to notify affected individuals and the OAIC as soon as practicable thereafter. #### Key findings (3) - — source on file - — source on file - — source on file Category narrative 59 words Individuals have access and correction rights under the APPs, a portability right via the Consumer Data Right (CDR), and an opt-out right for direct marketing. A general 'right to be forgotten'/erasure was not introduced by the 2024 reform tranche and remains a proposed future reform. Response deadlines are anchored in the Notifiable Data Breaches (NDB) scheme's 30-day assessment window. Periodic update · new data 2026-10-18 #### Data Subject Rights The Tranche 2 exposure draft would create a proposed APP 14 erasure right, but one deliberately scoped to the largest market participants rather than applying universally. 'Large digital platforms' are defined, under the proposal, as those with at least AU$500 million in gross group revenue or at least 2.5 million average monthly Australian end-users. Entities meeting either threshold would be required to destroy personal information on request, subject to exceptions that have not been individually itemised in the sources reviewed this cycle. This scoping choice is itself notable: rather than a general erasure right applying to all APP entities, the draft targets a defined population of large platforms, leaving smaller organisations outside the proposed erasure obligation entirely. As with the fair-and-reasonable test, this right exists only in exposure-draft form; the Bill had not been introduced to Parliament as at 9 October 2026, and no legal-effective date has been established. #### Outlook The exceptions to the proposed APP 14 erasure right, and whether the AU$500 million revenue or 2.5 million monthly-user thresholds are adjusted before introduction, are the details to watch as the Bill moves, if it does, toward parliamentary introduction. 1 earlier distinct update(s) Periodic update · new data 2026-10-05 #### Data Subject Rights The second-tranche exposure draft proposes a new right of erasure applicable to "large digital platforms," a broadly defined category under the draft. This would be a genuinely new right: the current Privacy Act 1988 contains no general equivalent to a right of erasure, meaning Australian individuals currently have no statutory mechanism comparable to the erasure rights available under frameworks such as the EU's General Data Protection Regulation, except insofar as they may negotiate deletion informally or rely on narrower existing mechanisms within the Australian Privacy Principles. The scope limitation to "large digital platforms" is a notable design choice. Rather than creating a universal erasure right applicable to all APP entities regardless of size or sector, the proposal targets a specific category of entity, understood to be defined broadly enough to capture major platform operators. This suggests the drafters are seeking to address a particular perceived problem, concentration of personal information within a small number of very large platform operators, rather than imposing an erasure obligation uniformly across the entire regulated population, which would include many small businesses otherwise exempt from parts of the Privacy Act. The erasure right sits within the broader package of reforms discussed under regulator and framework, including the proposed controller/processor framework, and would be one of several mechanisms bringing the Australian regime into closer structural alignment with GDPR-style frameworks, while the proposal remains at the exposure-draft stage and has not been legislated. #### Outlook If introduced and enacted as proposed, the erasure right's practical reach will depend substantially on how "large digital platforms" is ultimately defined in the Bill's final text, a definitional question not yet settled as at this cycle. Entities uncertain about whether they would fall within that category will need to await further detail as the Bill, if introduced before the end of 2026 as the Government has signalled, proceeds through Parliament. Evidence 5 Sources and claims (5) - Probable[OneTrust DataGuidance](https://www.dataguidance.com/jurisdictions/australia) — The Privacy Act and APPs provide individuals a general right to access and be informed about personal information held about them by APP entities.observed 2026-07-29 - Probable[International Association of Privacy Professionals](https://iapp.org/news/a/australia-introduces-initial-privacy-act-reforms) — Commentators noted the 2024 reform bill 'doesn't touch most of the substantive principles' and that a general right to erasure and improved consent models were expected only in a later legislative tranche not materialising before mid-2025 at the earliest.observed 2026-07-29 - Probable[International Association of Privacy Professionals](https://iapp.org/news/a/overview-of-the-newly-enacted-australian-privacy-principles) — APP 7 requires organisations to provide individuals an easy means to opt out of direct marketing communications.observed 2026-07-29 - Probable[OneTrust DataGuidance](https://www.dataguidance.com/jurisdictions/australia) — The Consumer Data Right, introduced via the Treasury Laws Amendment (Consumer Data Right) Bill/Act 2019, provides consumers with the right to data portability to switch between products and services.observed 2026-07-29 - Probable[Office of the Australian Information Commissioner](https://www.oaic.gov.au/news/media-centre/report-shows-highest-number-of-data-breaches-in-3.5-years) — The Privacy Act requires organisations to take reasonable steps to conduct a data breach assessment within 30 days of becoming aware of grounds to suspect an eligible data breach, and to notify affected individuals and the OAIC as soon as practicable thereafter.observed 2026-07-29