--- title: "Australia Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/australia/ source_html: /jurisdictions/australia/index.html description: "Australia data protection and privacy regulation: 10 categories, 86 claims, updated 2026-11-04. Lawful processing, data subject rights, cross-border…" generated_at: 2026-11-07T14:58:19Z content_sha256: d287aefe31e0d463252b27d4043751de16bd6a91ea54e4a446420df1c1d8e199 generator: "fe-fleet/md-twin@1.0" --- # Australia Data Protection & Privacy Regulation | Data Protection Monitor Not every instrument is backed by its official text yet. At least one law or rulebook covered here has no official source (tier 1) retrieved for it yet. No finding on this page is shown with confidence above “Probable” until stronger sources are retrieved. # Australia Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed regulated (omnibus) overlaps: [Sentinel (AML/CFT)](https://sentinel.gi/jurisdictions/australia/), [World Payments](https://payments.gi/jurisdictions/australia/), artificial-intelligence Last updated 2026-11-04 · 10 categories · 86 claims · 54 sources in the cumulative register Download report (PDF) Expand all The Federal Court has ordered Australian Clinical Labs to pay $5.8 million in Australia's first-ever civil-penalty judgment under the Privacy Act, arising from breaches connected to the February 2022 Medlab Pathology breach that affected more than 223,000 individuals. Data collected 2026-11-02 · Data published 2026-11-04 AI-assembled from cited sources Not fully checked this cycle: Regulator & Framework, Enforcement & Redress (2 open gaps). Evidence re-verified: 2026-11-04 · Position last changed: 2026-11-04 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=AUSTRALIA)[Build Report](/reports/?j=AUSTRALIA)[Compare](/compare/?j=AUSTRALIA) Framework posture Regulated (omnibus) 10 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Office of the Australian Information Commissioner (OAIC) Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) 2026-12-10 APP 1.7-1.9 automated-decision-making transparency obligation commences Module coverage & confidence 10 / 10 modules assessed 0 Confirmed · 10 Probable · 0 Uncertain 10 Categories 0 Red categories 57 Sub-modules 86 Claims 33 Tier-1 sources Traffic-light mix 3 green 7 amber (sums to 10 rendered categories; click to filter) No red categories; 9 sub-modules are flagged red. ## Jurisdiction brief Jurisdiction lead brief 1,526 Full executive summary 495 ###### Latest update · 4 November 2026 #### Lead Signal Australia's data-protection regime is accelerating on two tracks at once. New APP 1.7-1.9 obligations, commencing 10 December 2026, will require many organisations to disclose in their privacy policy when a computer system, including artificial intelligence, is used in a decision that significantly affects an individual. The same 10 December 2026 date is the registration deadline for the OAIC's Children's Online Privacy Code, developed against the current Australian Privacy Principles. At the same time, the Office of the Australian Information Commissioner is pursuing an explicitly enforcement-first posture: on 7 October 2026 it opened an investigation into the maker of the 'HeyCyan' smart-glasses phone application, part of a broader pattern of scrutiny directed at smart glasses and other connected or surveillance-capable devices, with the Commissioner stating that entities can be liable as accessories for enabling such devices. This sits alongside a June 2026 determination against American Express Australia Limited, ordering compensation to a complainant after the OAIC found American Express had failed to adequately mitigate the risk of employees improperly accessing personal information. A more substantial legislative rewrite, the Privacy Amendment (Personal Data Protection) Bill 2026, remains at exposure-draft stage and had not been introduced to Parliament as at 9 October 2026. #### Other Developments The exposure draft would introduce a new overarching processing test. The Tranche 2 exposure draft would require that personal information be collected, used and disclosed only where it is fair and reasonable to do so — a new overarching test with no direct equivalent in the current Privacy Act. This is proposed, not enacted; the Bill has not been introduced to Parliament. A limited erasure right is proposed for the largest digital platforms. The same draft would create a proposed APP 14 erasure right, requiring 'large digital platforms' — defined as those with at least AU$500 million in gross group revenue or at least 2.5 million average monthly Australian end-users — to destroy personal information on request, subject to exceptions not yet individually itemised. Breach notification would tighten from an undefined standard to a 72-hour deadline. Current law contains no fixed-hour deadline: organisations must notify the OAIC of an eligible data breach 'as soon as practicable' once they assess it as likely to result in serious harm. The Tranche 2 draft would instead require notification within 72 hours of becoming aware of reasonable grounds to believe an eligible data breach has occurred, while retaining the existing 30-day assessment window for suspected breaches and expanding the content required in the notification statement. AML/CTF sectoral expansion is pulling previously exempt small businesses into Privacy Act coverage. Following the AML/CTF reforms' 1 July 2026 expansion of regulated-entity status to sectors including real estate, legal, accounting and trust and company service providers, entities in those newly captured sectors must comply with the Privacy Act for their AML/CTF-related data handling, including small businesses that would otherwise fall under the Act's small-business exemption. The specific statutory provision overriding the exemption was not independently located. #### Cross-Monitor Connections The AML/CTF sectoral expansion pulling small businesses into Privacy Act coverage is a direct overlap with financial-integrity's tracking of the same 1 July 2026 Tranche 2 enrolment regime, which that monitor is separately assessing from an enforcement and enabler-jurisdiction perspective; this brief addresses only the privacy-coverage consequence of that expansion and does not re-analyse the underlying AML/CTF enforcement action. The OAIC's enforcement-first posture toward connected and surveillance-capable devices, including the HeyCyan investigation, may also be of interest to the crypto and artificial-intelligence monitors to the extent such devices incorporate AI-driven decision systems, though this brief does not extend into those domains. #### Outlook 10 December 2026 is the date to watch most closely: both the APP 1.7-1.9 automated-decision-making disclosure duty and the Children's Online Privacy Code registration deadline land on that date, converting two separate reform strands into operative obligations simultaneously. Separately, whether the Privacy Amendment (Personal Data Protection) Bill 2026 is introduced to Parliament after 9 October 2026 remains unconfirmed and is the key gating event for the fair-and-reasonable test, the large-platform erasure right, and the 72-hour breach-notification deadline all becoming law. The OAIC's complaint-handling capacity constraint — newly lodged complaints unlikely to be substantially progressed for six to twelve months absent exceptional circumstances, as stated by the regulator in February 2026 — should also be read against its simultaneously active enforcement posture on investigations and determinations. 3 earlier updates not shown here. ###### Standing brief · as of 30 July 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal The Federal Court has ordered Australian Clinical Labs to pay $5.8 million in Australia's first-ever civil-penalty judgment under the Privacy Act, arising from breaches connected to the February 2022 Medlab Pathology breach that affected more than 223,000 individuals. The penalty lands against a backdrop of record regulatory activity: the OAIC received 1,205 data breach notifications in 2025, an 8% increase over 2024's 1,112 and the highest total since the Notifiable Data Breaches scheme began in 2018. The regulator has signalled it intends to continue civil-penalty proceedings against Optus and Medibank through 2026, alongside Commissioner-initiated investigations into rental-technology platforms, connected cars and tracking pixels. Taken together, these developments mark a clear escalation in Australia's enforcement posture under a regime whose maximum civil penalty for serious or repeated interference has stood, since December 2022, at the greater of $50 million, three times the value obtained from the misuse, or 30% of adjusted turnover. #### Other Developments A statutory tort for serious invasions of privacy commenced on 10 June 2025, giving individuals a direct court-based redress avenue independent of the OAIC and applicable to entities beyond those covered as APP entities. This avenue sits alongside existing representative-complaint powers, under which the Information Commissioner may investigate on behalf of a class and declare compensation entitlement for loss or damage including injury to feelings, as pursued in the Medibank and Optus representative complaints. Federal Court class actions such as Zoe Lee McClure v Medibank Private Limited are proceeding in parallel to the OAIC's representative complaint arising from the same 2022 breach, giving affected individuals a dual-track route to redress. Reform activity is also reshaping automated decision-making governance: from 10 December 2026, APP entities using computer-program decisions reasonably expected to significantly affect individuals' rights or interests will be required to disclose specified information about that automated decision-making in their privacy policies. The OAIC has said it intends to release guidance on this ADM Transparency Obligation by September 2026, following a consultation that closed 15 June 2026. In the children's privacy space, the Social Media Minimum Age scheme has required reasonable steps to prevent Australians under 16 from creating or keeping accounts on age-restricted social media platforms since 10 December 2025, and removes parental ability to consent to under-16 accounts on affected platforms including Facebook, Snapchat, Instagram and TikTok. A related Children's Online Privacy Code is understood to require registration by the OAIC by 10 December 2026, though the Code's own operative commencement date for regulated entities remains undetermined. On cross-border transfers, the POLA Act reforms establish a new mechanism to prescribe a 'white list' of countries and binding schemes recognised as having adequate privacy protections, though this mechanism has been enacted but is not yet operative and Australia is understood not to have obtained a formal EU adequacy decision of its own. In the health sector, the OAIC has been inspecting tracking-pixel use by 50 healthcare providers as part of a broader regulatory focus on online tracking technologies, and the OAIC published a report of preliminary inquiries into the 2025 Qantas Airways data breach on 16 July 2026. The Privacy Commissioner has also found that Medmate Australia Pty Ltd and Monash IVF Pty Ltd interfered with the privacy of individuals. Against this backdrop of expanding enforcement and reform, the OAIC has itself reported a significant individual-complaint backlog as of February 2026, with new complaints unlikely to be substantially progressed for six to twelve months absent exceptional circumstances. #### Cross-Monitor Connections The financial-integrity monitor should track the Australian Clinical Labs and Medibank enforcement actions alongside the Part IIIA credit-reporting civil-penalty overlay, which carries significance for financial-sector risk assessment beyond this monitor's own analytical scope. The world-payments monitor may wish to note the Privacy (Credit Related Research) Rule 2024, which permits credit reporting bodies to use or disclose de-identified information for research, alongside the ACMA's AUD 3.96 million fine against Latitude Finance for marketing messages lacking accurate contact information and a working unsubscribe function. The artificial-intelligence monitor should track the APP 1.7-1.9 automated-decision-making transparency obligation and the OAIC's associated guidance consultation directly, as these interact with AI-Act-style regulatory framings that sit outside this monitor's remit; this brief retains only the data-protection angle on that obligation. #### Outlook The trajectory across Australia's data-protection regime is toward tightening, driven by continuing high-value civil-penalty litigation, a live statutory tort, record breach notifications, and two forward-dated reforms keyed to 10 December 2026: the automated-decision-making transparency obligation and the Children's Online Privacy Code. Concurrent Optus and Medibank proceedings and the OAIC's own acknowledged complaint backlog suggest further enforcement and reform developments are likely before the Code's operative commencement date for regulated entities is confirmed. Read full brief · 1526 words ###### Latest update · 18 October 2026 #### Regulatory Status Australia's data-protection regime is moving on two distinct speeds. Tranche 1 obligations — the APP 1.7-1.9 automated-decision-making disclosure duty and the Children's Online Privacy Code registration deadline — both commence 10 December 2026, proceeding on schedule against the current Privacy Act 1988 framework. The more substantial Tranche 2 rewrite, carried in the Privacy Amendment (Personal Data Protection) Bill 2026 exposure draft, remains pre-parliamentary: it had not been introduced to Parliament as at 9 October 2026, and would carry the fair-and-reasonable processing test, the large-digital-platform erasure right, and the 72-hour breach-notification deadline, none of which is yet law. Separately, the OAIC is pursuing an active enforcement-first posture: a June 2026 determination against American Express Australia Limited, and an investigation opened 7 October 2026 into the maker of the 'HeyCyan' smart-glasses application as part of broader scrutiny of connected and surveillance-capable devices. This enforcement activity proceeds even as the OAIC acknowledges a structural capacity constraint on routine individual complaint handling, stated in February 2026 as a six-to-twelve-month delay for newly lodged complaints absent exceptional circumstances. A further sectoral effect flows from the AML/CTF Tranche 2 expansion of 1 July 2026: newly regulated entities in real estate, legal, accounting and related sectors, including small businesses otherwise exempt, must now comply with the Privacy Act for their AML/CTF data handling. #### Outlook 10 December 2026 is the pivotal date for Tranche 1 obligations landing simultaneously. Whether the Tranche 2 Bill is introduced to Parliament after 9 October 2026 remains the key unresolved question determining when, if at all, the fair-and-reasonable test, the large-platform erasure right and the 72-hour breach-notification deadline become law. 1 earlier update not shown here. ###### Standing brief · as of 30 July 2026 #### Regulatory Status Australia's data-protection regime is enforced by the Office of the Australian Information Commissioner under the Privacy Act 1988 (Cth), with the Privacy and Other Legislation Amendment Act 2024 phasing in reform through December 2026. Enforcement activity escalated sharply this cycle: the Federal Court ordered Australian Clinical Labs to pay $5.8 million in Australia's first-ever civil-penalty judgment under the Privacy Act, and the OAIC received a record 1,205 data breach notifications in 2025. A statutory tort for serious invasions of privacy has been in force since 10 June 2025, providing a court-based redress avenue independent of the OAIC. Forward-dated reforms include an automated-decision-making transparency obligation commencing 10 December 2026 and a Children's Online Privacy Code that is understood to require OAIC registration by the same date, though the Code's own commencement date for regulated entities remains undetermined. The Social Media Minimum Age scheme has required reasonable steps to prevent Australians under 16 from creating or keeping social media accounts since 10 December 2025. #### Outlook Australia's regulatory direction is tightening across enforcement, children's privacy and algorithmic-transparency modules, with the OAIC's own acknowledged complaint backlog the principal capacity constraint on this trajectory. Read full brief · 495 words Key regulatory facts for Australia Regulatory Dimension Australia Standing Position Jurisdiction Australia (AU) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 86 sourced findings) Regulator & Framework Comprehensive statute with an active, well-resourced regulator and a clear (if incrementally reforming) legal basis; amber-leaning only on registration/filing due to absence of DPO/DPIA/ROPA registration analogues. Lawful Processing & Special Data Functionally equivalent protections exist but are structured differently from GDPR (no unified 'special category' list with Article-9-style enumerated exceptions), producing interoperability friction. Data Subject Rights Core access/correction/portability rights exist and are enforceable, but erasure and objection/restriction rights are narrower or not yet legislated compared to GDPR. Controller/Processor Duties Strong security and breach-notification enforcement (Medibank, Optus, ACL) offsets the absence of formal DPIA/DPO/ROPA mechanisms. Primary Instruments Cited Office of the Australian Information Commissioner, Office of the Australian Information Commissioner, Office of the Australian Information Commissioner, Office of the Australian Information Commissioner, OneTrust DataGuidance Last Confirmed / Updated 2026-11-04 (54 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### Australia: D1 Regulator & Framework5 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Comprehensive statute with an active, well-resourced regulator and a clear (if incrementally reforming) legal basis; amber-leaning only on registration/filing due to absence of DPO/DPIA/ROPA registration analogues. Primary framework Privacy Act 1988 (Cth), as amended by the Privacy and Other Legislation Amendment Act 2024 Supervisory authority [Office of the Australian Information Commissioner (OAIC)](https://www.oaic.gov.au/) Traffic-light rationale — Green Comprehensive statute with an active, well-resourced regulator and a clear (if incrementally reforming) legal basis; amber-leaning only on registration/filing due to absence of DPO/DPIA/ROPA registration analogues. #### Sub-modules (5) #### Regulator And AuthorityGreen The OAIC, established under the Australian Information Commissioner Act 2010, is headed by the Australian Information Commissioner supported by the Privacy Commissioner and the Freedom of Information Commissioner. Claims (4): - The Office of the Australian Information Commissioner (OAIC), established under the Australian Information Commissioner Act 2010, is Australia's primary privacy regulator, headed by the Australian Information Commissioner supported by the Privacy Commissioner and Freedom of Information Commissioner. - Office of the Australian Information Commissioner — The OAIC administers the Privacy Act 1988 (Cth) and the Australian Privacy Principles as the sole federal privacy regulator; unchanged this cycle. - Tiered civil penalties, infringement and compliance notices, and doxxing offences in the Criminal Code have been in force since 11 December 2024, expanding OAIC's enforcement toolkit beyond the pre-existing serious-or-repeated-interference penalty. - Office of the Australian Information Commissioner — OAIC administers the Privacy Act 1988 (Cth) as the federal supervisory authority; no statutory restructuring identified this cycle #### Act And InstrumentsGreen Primary instrument is the Privacy Act 1988; the POLA Act 2024 is the most significant recent amending instrument. Claims (5): - The Privacy Act 1988 (Cth), as amended, contains 13 Australian Privacy Principles (APPs) applicable to APP entities comprising some private-sector organisations and most Australian Government agencies. - The Privacy and Other Legislation Amendment Act 2024 (POLA Act) commenced on 11 December 2024, implementing amendments to the Privacy Act within the Information Commissioner's remit. - Privacy Amendment (Personal Data Protection) Bill 2026 — No commencement date fixed for any Schedule as at late October 2026 - Privacy Amendment (Personal Data Protection) Bill 2026 — Exposure draft published late August 2026 proposing ~40 reforms across eight themes (core definitions, OAIC powers, consent, data breach/security, data trading/marketing/sensitive information, processor framework, erasure right for large digital platforms); submissions closed 18 September 2026; Government signalled intent to introduce before year-end 2026. - OAIC — APP Guidelines Chapter 1 version 2.0 (effective 29 September 2026) requires privacy policies to include information about computer-program/automated-decision usage, ahead of the ADM transparency obligation commencing 10 December 2026 #### Material ScopeGreen Scope is turnover-based ($3M+) for private-sector organisations, plus most Commonwealth agencies and certain always-covered entities (health service providers, credit reporting bodies). Claims (1): - The Privacy Act 1988 applies to Australian Government agencies and organisations with an annual turnover of more than $3 million, plus certain other prescribed organisations regardless of turnover. #### Territorial ScopeGreen Extraterritorial application turns on the 'Australian link' test, capturing foreign entities carrying on business in Australia online. Claims (1): - The Privacy Act's extraterritorial reach extends to entities with an 'Australian link', including foreign entities that carry on business in Australia by collecting personal information via a website from individuals physically located in Australia. #### Regulator Registration And FilingAmber No GDPR-style controller/processor registration, DPO appointment, or DPIA filing regime exists under the Privacy Act. Claims (2): - The Privacy Act does not impose a general controller/processor registration or filing obligation and does not explicitly reference 'data controllers'/'data processors' or mandate DPO appointment or formal DPIA filings. - No general APP-entity registration or filing-fee duty to the OAIC was located this cycle; the Privacy Act's threshold coverage test, not registration, determines in-scope status #### Key findings (3) - — source on file - — source on file - — source on file Australia's data-protection regime is anchored in the Privacy Act 1988 (Cth), a comprehensive omnibus statute containing 13 Australian Privacy Principles (APPs) applied and enforced by the Office of the Australian Information Commissioner (OAIC). The regime was substantially modernised by the Privacy and Other Legislation Amendment Act 2024 (POLA Act), most of whose Information-Commissioner-facing amendments commenced 11 December 2024, with further tranches (ADM transparency, Children's Online Privacy Code) commencing 10 December 2026. The Act applies extraterritorially via the 'Australian link' concept and does not require general controller/processor registration. Periodic update · new data 2026-10-18 #### Regulator & Framework The OAIC's enforcement toolkit has carried tiered civil penalties, infringement and compliance notices, and Criminal Code doxxing offences since these came into force on 11 December 2024, expanding the regulator's powers beyond the pre-existing penalty for serious or repeated interference with privacy. Against that established toolkit, two further reform strands are now converging on the same date. New APP 1.7-1.9 automated-decision-making disclosure duties and the OAIC's Children's Online Privacy Code registration deadline both land on 10 December 2026. The ADM disclosure duty, once operative, will require many organisations to disclose in their privacy policy when a computer system, including AI, is used in a decision that significantly affects an individual. A more substantial second tranche of reform sits behind these Tranche 1 obligations. The Privacy Amendment (Personal Data Protection) Bill 2026, released as an exposure draft, had not been introduced to Parliament as at 9 October 2026. This Bill would carry the fair-and-reasonable processing test, the large-platform erasure right, and the 72-hour breach-notification deadline described elsewhere in this brief. Its pre-parliamentary status means none of those more far-reaching changes is yet settled law, even as the narrower Tranche 1 obligations proceed toward their 10 December 2026 commencement on schedule. #### Outlook Whether the Tranche 2 Bill is introduced to Parliament after 9 October 2026 is the key event to watch; until introduction occurs, the fair-and-reasonable test, erasure right and 72-hour notification deadline remain proposals rather than law. Separately, 10 December 2026 will be the first real test of whether covered organisations are ready to meet the ADM disclosure duty and the finalised Children's Online Privacy Code simultaneously. 2 earlier distinct update(s) Periodic update · new data 2026-10-12 #### Regulator & Framework The Office of the Australian Information Commissioner continues to administer the Privacy Act 1988 (Cth) as Australia's federal supervisory authority. No statutory restructuring of the OAIC's mandate was identified this cycle. The more significant development sits at the guidance layer: the OAIC issued version 2.0 of Chapter 1 of its Australian Privacy Principles Guidelines, effective 29 September 2026, which requires privacy policies to include information about the use of computer programs and automated decision-making. This guidance update precedes, and prepares entities for, the statutory automated-decision-making transparency obligation under the Privacy and Other Legislation Amendment Act 2024, which commences 10 December 2026. On registration, no general APP-entity registration or filing-fee duty to the OAIC was located this cycle; coverage under the Privacy Act continues to be determined by the Act's threshold coverage test rather than by any registration requirement, a negative finding carried forward from prior research. #### Outlook The guidance-to-statute sequencing here is a marker rather than a conclusion: the OAIC's Chapter 1 v2.0 update effective 29 September 2026 is best read as preparation for the 10 December 2026 commencement of the ADM transparency obligation, and entities should expect the regulator's guidance posture to continue firming as that date approaches. Periodic update · new data 2026-10-05 #### Regulator & Framework The Office of the Australian Information Commissioner continues to administer the Privacy Act 1988 and the Australian Privacy Principles as the sole federal privacy regulator, a standing role unchanged this cycle. The material development is the advancement of the second-tranche Privacy Amendment (Personal Data Protection) Bill 2026, whose exposure draft was published in late August 2026. The draft proposes approximately 40 reforms spanning eight distinct themes: core definitions, OAIC powers, consent, data breach and security, data trading and marketing and sensitive information, a processor framework, and an erasure right targeted at large digital platforms. Public submissions on the exposure draft closed on 18 September 2026, placing the reform at a consultation-closed stage. The Government is understood to have signalled an intention to introduce the legislation to Parliament before the end of 2026, though formal introduction had not been confirmed as at the close of this cycle. Taken as a package, the reform is understood to represent the most substantial change proposed to the Privacy Act's lawful-processing and breach-notification architecture since the Act's original enactment. It would move the Australian regime structurally closer to the European Union's General Data Protection Regulation through mechanisms such as formal controller and processor role recognition and an erasure right, while nonetheless retaining a distinctly Australian architecture: the draft proposes a single fair-and-reasonable data-handling test rather than adopting the GDPR's lawful-basis structure outright. The scale of the proposed reform, covering eight separate thematic areas in a single package, signals an intent to modernise the framework comprehensively rather than through piecemeal amendment. This is consistent with the sustained international and domestic pressure for Australia's privacy framework to converge more closely with international standards, while preserving the Act's own doctrinal foundations rather than wholesale importing a foreign framework. #### Outlook The principal milestone to watch is whether the Bill is formally introduced to Parliament before the end of 2026, as the Government has signalled. Given that consultation closed only on 18 September 2026, the timeline from exposure draft to introduction is compressed, and any slippage into 2027 would not be surprising given the scale of the proposed changes across eight thematic areas. Once introduced, the Bill would then need to proceed through the ordinary parliamentary process, meaning enactment and commencement dates remain considerably further out than the introduction milestone itself. Sources and claims (13) - [Office of the Australian Information Commissioner](https://www.oaic.gov.au/privacy/privacy-legislation/the-privacy-act/history-of-the-privacy-act) — The Office of the Australian Information Commissioner (OAIC), established under the Australian Information Commissioner Act 2010, is Australia's primary privacy regulator, headed by the Australian Information Commissioner supported by the Privacy Commissioner and Freedom of Information Commissioner. - [Office of the Australian Information Commissioner](https://www.oaic.gov.au/privacy/privacy-legislation/the-privacy-act) — The Privacy Act 1988 (Cth), as amended, contains 13 Australian Privacy Principles (APPs) applicable to APP entities comprising some private-sector organisations and most Australian Government agencies. - [Office of the Australian Information Commissioner](https://www.oaic.gov.au/privacy/privacy-legislation/the-privacy-act/history-of-the-privacy-act) — The Privacy and Other Legislation Amendment Act 2024 (POLA Act) commenced on 11 December 2024, implementing amendments to the Privacy Act within the Information Commissioner's remit. - [Office of the Australian Information Commissioner](https://www.oaic.gov.au/privacy/privacy-legislation) — The Privacy Act 1988 applies to Australian Government agencies and organisations with an annual turnover of more than $3 million, plus certain other prescribed organisations regardless of turnover. - [Office of the Australian Information Commissioner](https://www.oaic.gov.au/engage-with-us/submissions/privacy-act-review-issues-paper-submission/part-11-statutory-tort) — The Privacy Act's extraterritorial reach extends to entities with an 'Australian link', including foreign entities that carry on business in Australia by collecting personal information via a website from individuals physically located in Australia. - [OneTrust DataGuidance](https://www.dataguidance.com/jurisdictions/australia) — The Privacy Act does not impose a general controller/processor registration or filing obligation and does not explicitly reference 'data controllers'/'data processors' or mandate DPO appointment or formal DPIA filings. - [AusGPT](https://ausgpt.com.au/resources/privacy-act-reforms-2026-ai) — Privacy Amendment (Personal Data Protection) Bill 2026 — No commencement date fixed for any Schedule as at late October 2026 - [Office of the Australian Information Commissioner (OAIC)](https://www.oaic.gov.au/about-the-OAIC/our-regulatory-approach/privacy-regulatory-action-policy) — Office of the Australian Information Commissioner — The OAIC administers the Privacy Act 1988 (Cth) and the Australian Privacy Principles as the sole federal privacy regulator; unchanged this cycle. - [Allens](https://www.allens.com.au/insights-news/insights/2026/09/a-new-era-for-privacy-what-the-proposed-privacy-act-reforms-mean-in-practice/) — Privacy Amendment (Personal Data Protection) Bill 2026 — Exposure draft published late August 2026 proposing ~40 reforms across eight themes (core definitions, OAIC powers, consent, data breach/security, data trading/marketing/sensitive information, processor framework, erasure right for large digital platforms); submissions closed 18 September 2026; Government signalled intent to introduce before year-end 2026. - [OAIC](https://www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-guidelines/summary-of-version-changes-to-app-guidelines) — OAIC — APP Guidelines Chapter 1 version 2.0 (effective 29 September 2026) requires privacy policies to include information about computer-program/automated-decision usage, ahead of the ADM transparency obligation commencing 10 December 2026 - Primary statutory record — No general APP-entity registration or filing-fee duty to the OAIC was located this cycle; the Privacy Act's threshold coverage test, not registration, determines in-scope status - [https://privacypros.com.au/privacy-hub/articles/australia-privacy-law-changes-2026/](https://privacypros.com.au/privacy-hub/articles/australia-privacy-law-changes-2026/) — Tiered civil penalties, infringement and compliance notices, and doxxing offences in the Criminal Code have been in force since 11 December 2024, expanding OAIC's enforcement toolkit beyond the pre-existing serious-or-repeated-interference penalty. - [OAIC](https://www.oaic.gov.au/) — Office of the Australian Information Commissioner — OAIC administers the Privacy Act 1988 (Cth) as the federal supervisory authority; no statutory restructuring identified this cycle ### Australia: D2 Lawful Processing & Special Data4 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Functionally equivalent protections exist but are structured differently from GDPR (no unified 'special category' list with Article-9-style enumerated exceptions), producing interoperability friction. Primary framework Privacy Act 1988 (Cth) — Australian Privacy Principles 3, 6 and 7 Supervisory authority [Office of the Australian Information Commissioner (OAIC)](https://www.oaic.gov.au/) Traffic-light rationale — Amber Functionally equivalent protections exist but are structured differently from GDPR (no unified 'special category' list with Article-9-style enumerated exceptions), producing interoperability friction. Periodic update · new data 2026-10-18 #### Lawful Processing & Special Data The Privacy Amendment (Personal Data Protection) Bill 2026, released as an exposure draft, would introduce a requirement that personal information be collected, used and disclosed only where doing so is fair and reasonable — an overarching test that has no direct equivalent in the current Privacy Act, which instead relies on specific Australian Privacy Principle obligations without a general fairness-and-reasonableness threshold. As at 9 October 2026 the Bill had not been introduced to Parliament, so this test remains proposed rather than law, and no legal-effective date exists for it. If enacted, the fair-and-reasonable test would sit above the existing APP framework as an additional threshold condition on collection, use and disclosure, meaning organisations could satisfy existing specific APP obligations while still failing a new general fairness standard. This structural feature — a general test layered on top of specific rules, rather than replacing them — is the aspect of the proposal most likely to require operational reassessment of existing data-handling practices once and if it becomes law. #### Outlook Introduction of the Bill to Parliament is the gating event for this reform. Until that occurs, organisations have no legal obligation to apply a fair-and-reasonable test beyond their existing APP compliance, though the proposal's direction is a signal of where the regulatory standard for lawful processing in Australia is heading. Periodic update · new data 2026-10-05 #### Lawful Processing & Special Data The second-tranche exposure draft proposes to replace the current architecture of lawful-processing concepts, specifically the distinctions between solicited and unsolicited information, the reasonable-necessity test, and the primary-purpose/secondary-purpose distinction, with a single fair-and-reasonable data-handling test. This is a structural simplification in form but a potentially significant substantive shift: rather than requiring entities to characterise information collection and use against several discrete tests, the proposed single test would ask whether handling of personal information is fair and reasonable in the circumstances, a standard with more interpretive latitude for the regulator and the courts going forward. Alongside this restructuring, the exposure draft proposes tightening the consent standard applicable under the Act. Consent would be required to be voluntary, informed, current, specific and unambiguous, an explicit uplift on the current standard, which has historically been read more loosely by entities relying on bundled or broad consents. Notably, the draft would continue to allow consent to be given either expressly or impliedly, meaning the uplift targets the quality of consent obtained rather than eliminating the availability of implied consent altogether. Together, these two changes point toward a Privacy Act that, if enacted as proposed, would narrow the room for entities to rely on broadly worded, loosely obtained consents or an expansive secondary-purpose justification for using personal information beyond its original collection purpose. The fair-and-reasonable test in particular would introduce an overarching reasonableness check that applies regardless of whether a specific exemption or consent basis is also satisfied, a structural feature with some resemblance to proportionality-style tests used in comparable overseas frameworks, while remaining its own distinct Australian formulation rather than a direct transplant. Neither change has yet taken legal effect; both remain at the exposure-draft, proposed stage, pending formal introduction to Parliament and subsequent passage. #### Outlook The practical effect of the fair-and-reasonable test, once and if introduced, will depend heavily on guidance the OAIC issues interpreting the standard, since reasonableness-based tests tend to generate greater initial compliance uncertainty than the more mechanical rules they would replace. The consent uplift is comparatively more concrete and likely easier for entities to operationalise once the Bill's final text is settled. Both provisions remain contingent on the Bill's introduction, which the Government has signalled is intended before the end of 2026. D2 · Lawful Processing — Full Module Record 4 sub-modules · 50 words · 7 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Australia: D3 Data Subject Rights5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Core access/correction/portability rights exist and are enforceable, but erasure and objection/restriction rights are narrower or not yet legislated compared to GDPR. Primary framework Privacy Act 1988 (Cth) APPs 12–13; Treasury Laws Amendment (Consumer Data Right) Act 2019 Supervisory authority [Office of the Australian Information Commissioner (OAIC)](https://www.oaic.gov.au/) Traffic-light rationale — Amber Core access/correction/portability rights exist and are enforceable, but erasure and objection/restriction rights are narrower or not yet legislated compared to GDPR. #### Sub-modules (5) #### Access RightGreen General right to access and be informed about held personal information. Claims (1): - The Privacy Act and APPs provide individuals a general right to access and be informed about personal information held about them by APP entities. #### Rectification And ErasureAmber Correction right exists; general erasure right not yet enacted (flagged for future tranche). Claims (3): - Commentators noted the 2024 reform bill 'doesn't touch most of the substantive principles' and that a general right to erasure and improved consent models were expected only in a later legislative tranche not materialising before mid-2025 at the earliest. - Privacy Amendment (Personal Data Protection) Bill 2026 — The second-tranche exposure draft proposes a new right of erasure applicable to 'large digital platforms' (broadly defined); the current Privacy Act 1988 has no equivalent general erasure right. - proposed APP 14 (Tranche 2 exposure draft) — Would require 'large digital platforms' — at least AU$500 million gross group revenue or at least 2.5 million average monthly Australian end-users — to destroy personal information on request, subject to exceptions. #### Restriction And ObjectionAmber Objection right limited mainly to direct-marketing opt-out under APP 7. Claims (1): - APP 7 requires organisations to provide individuals an easy means to opt out of direct marketing communications. #### Data PortabilityGreen Portability delivered via the sectoral Consumer Data Right rather than a general Privacy Act right. Claims (1): - The Consumer Data Right, introduced via the Treasury Laws Amendment (Consumer Data Right) Bill/Act 2019, provides consumers with the right to data portability to switch between products and services. #### Deadlines And Response WindowsGreen NDB scheme imposes a 30-day reasonable assessment window plus 'as soon as practicable' notification. Claims (1): - The Privacy Act requires organisations to take reasonable steps to conduct a data breach assessment within 30 days of becoming aware of grounds to suspect an eligible data breach, and to notify affected individuals and the OAIC as soon as practicable thereafter. #### Key findings (3) - — source on file - — source on file - — source on file Individuals have access and correction rights under the APPs, a portability right via the Consumer Data Right (CDR), and an opt-out right for direct marketing. A general 'right to be forgotten'/erasure was not introduced by the 2024 reform tranche and remains a proposed future reform. Response deadlines are anchored in the Notifiable Data Breaches (NDB) scheme's 30-day assessment window. Periodic update · new data 2026-11-04 #### Data Subject Rights The Tranche 2 exposure draft would create a proposed APP 14 erasure right, but one deliberately scoped to the largest market participants rather than applying universally. 'Large digital platforms' are defined, under the proposal, as those with at least AU$500 million in gross group revenue or at least 2.5 million average monthly Australian end-users. Entities meeting either threshold would be required to destroy personal information on request, subject to exceptions that have not been individually itemised in the sources reviewed. This scoping choice is itself notable: rather than a general erasure right applying to all APP entities, the draft targets a defined population of large platforms, leaving smaller organisations outside the proposed erasure obligation entirely. As with the fair-and-reasonable test, this right exists only in exposure-draft form; the Bill had not been introduced to Parliament as at 9 October 2026, and no legal-effective date has been established. #### Outlook The exceptions to the proposed APP 14 erasure right, and whether the AU$500 million revenue or 2.5 million monthly-user thresholds are adjusted before introduction, are the details to watch as the Bill moves, if it does, toward parliamentary introduction. 2 earlier distinct update(s) Periodic update · new data 2026-10-18 #### Data Subject Rights The Tranche 2 exposure draft would create a proposed APP 14 erasure right, but one deliberately scoped to the largest market participants rather than applying universally. 'Large digital platforms' are defined, under the proposal, as those with at least AU$500 million in gross group revenue or at least 2.5 million average monthly Australian end-users. Entities meeting either threshold would be required to destroy personal information on request, subject to exceptions that have not been individually itemised in the sources reviewed this cycle. This scoping choice is itself notable: rather than a general erasure right applying to all APP entities, the draft targets a defined population of large platforms, leaving smaller organisations outside the proposed erasure obligation entirely. As with the fair-and-reasonable test, this right exists only in exposure-draft form; the Bill had not been introduced to Parliament as at 9 October 2026, and no legal-effective date has been established. #### Outlook The exceptions to the proposed APP 14 erasure right, and whether the AU$500 million revenue or 2.5 million monthly-user thresholds are adjusted before introduction, are the details to watch as the Bill moves, if it does, toward parliamentary introduction. Periodic update · new data 2026-10-05 #### Data Subject Rights The second-tranche exposure draft proposes a new right of erasure applicable to "large digital platforms," a broadly defined category under the draft. This would be a genuinely new right: the current Privacy Act 1988 contains no general equivalent to a right of erasure, meaning Australian individuals currently have no statutory mechanism comparable to the erasure rights available under frameworks such as the EU's General Data Protection Regulation, except insofar as they may negotiate deletion informally or rely on narrower existing mechanisms within the Australian Privacy Principles. The scope limitation to "large digital platforms" is a notable design choice. Rather than creating a universal erasure right applicable to all APP entities regardless of size or sector, the proposal targets a specific category of entity, understood to be defined broadly enough to capture major platform operators. This suggests the drafters are seeking to address a particular perceived problem, concentration of personal information within a small number of very large platform operators, rather than imposing an erasure obligation uniformly across the entire regulated population, which would include many small businesses otherwise exempt from parts of the Privacy Act. The erasure right sits within the broader package of reforms discussed under regulator and framework, including the proposed controller/processor framework, and would be one of several mechanisms bringing the Australian regime into closer structural alignment with GDPR-style frameworks, while the proposal remains at the exposure-draft stage and has not been legislated. #### Outlook If introduced and enacted as proposed, the erasure right's practical reach will depend substantially on how "large digital platforms" is ultimately defined in the Bill's final text, a definitional question not yet settled as at this cycle. Entities uncertain about whether they would fall within that category will need to await further detail as the Bill, if introduced before the end of 2026 as the Government has signalled, proceeds through Parliament. Sources and claims (7) - [OneTrust DataGuidance](https://www.dataguidance.com/jurisdictions/australia) — The Privacy Act and APPs provide individuals a general right to access and be informed about personal information held about them by APP entities. - [International Association of Privacy Professionals](https://iapp.org/news/a/australia-introduces-initial-privacy-act-reforms) — Commentators noted the 2024 reform bill 'doesn't touch most of the substantive principles' and that a general right to erasure and improved consent models were expected only in a later legislative tranche not materialising before mid-2025 at the earliest. - [International Association of Privacy Professionals](https://iapp.org/news/a/overview-of-the-newly-enacted-australian-privacy-principles) — APP 7 requires organisations to provide individuals an easy means to opt out of direct marketing communications. - [OneTrust DataGuidance](https://www.dataguidance.com/jurisdictions/australia) — The Consumer Data Right, introduced via the Treasury Laws Amendment (Consumer Data Right) Bill/Act 2019, provides consumers with the right to data portability to switch between products and services. - [Office of the Australian Information Commissioner](https://www.oaic.gov.au/news/media-centre/report-shows-highest-number-of-data-breaches-in-3.5-years) — The Privacy Act requires organisations to take reasonable steps to conduct a data breach assessment within 30 days of becoming aware of grounds to suspect an eligible data breach, and to notify affected individuals and the OAIC as soon as practicable thereafter. - [Allens](https://www.allens.com.au/insights-news/insights/2026/09/a-new-era-for-privacy-what-the-proposed-privacy-act-reforms-mean-in-practice/) — Privacy Amendment (Personal Data Protection) Bill 2026 — The second-tranche exposure draft proposes a new right of erasure applicable to 'large digital platforms' (broadly defined); the current Privacy Act 1988 has no equivalent general erasure right. - [LK Law](https://www.lk.law/2026/09/australias-privacy-act-reforms-inside-the-second-tranche/) — proposed APP 14 (Tranche 2 exposure draft) — Would require 'large digital platforms' — at least AU$500 million gross group revenue or at least 2.5 million average monthly Australian end-users — to destroy personal information on request, subject to exceptions. ### Australia: D4 Controller/Processor Duties7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Strong security and breach-notification enforcement (Medibank, Optus, ACL) offsets the absence of formal DPIA/DPO/ROPA mechanisms. Primary framework Privacy Act 1988 (Cth) APPs 1, 11; Notifiable Data Breaches scheme (Part IIIC) Supervisory authority [Office of the Australian Information Commissioner (OAIC)](https://www.oaic.gov.au/) Traffic-light rationale — Amber Strong security and breach-notification enforcement (Medibank, Optus, ACL) offsets the absence of formal DPIA/DPO/ROPA mechanisms. Periodic update · new data 2026-10-18 #### Controller/Processor Duties Australia's current breach-notification standard under the Notifiable Data Breaches scheme contains no fixed-hour deadline: organisations must notify the OAIC when a breach is likely to result in serious harm, acting 'as soon as practicable' rather than within a defined number of hours. The Tranche 2 exposure draft would change this materially, requiring notification to the OAIC within 72 hours of becoming aware of reasonable grounds to believe an eligible data breach has occurred. The draft would retain the existing 30-day assessment window that currently applies to suspected breaches, and would expand the content required in the notification statement itself. The practical effect, if enacted, would be to compress the timeframe between an organisation forming reasonable grounds to believe a breach has occurred and its obligation to notify the regulator, bringing Australia's regime closer to fixed-deadline models used elsewhere. As at 9 October 2026 the Bill carrying this change had not been introduced to Parliament, so the current 'as soon as practicable' standard remains the operative law. #### Outlook Until the Tranche 2 Bill is introduced and passed, the current serious-harm-triggered, no-fixed-hour notification standard remains in force. Organisations should watch for parliamentary introduction as the point at which a genuine 72-hour compliance clock would begin to apply. Periodic update · new data 2026-10-05 #### Controller/Processor Duties Two distinct proposals under the second-tranche exposure draft affect controller and processor duties. First, the draft introduces a formal, GDPR-like recognition of controller and processor roles, a structural concept not currently present in the Privacy Act 1988. The current Act applies its obligations to "APP entities" without distinguishing between an entity that determines the purposes and means of processing and an entity that processes personal information on another's behalf or instruction; the proposed framework would introduce that distinction formally, which would bring role-based clarity but also potentially shift where specific statutory obligations attach within a data-handling chain involving outsourced processors or service providers. Second, the draft proposes shortening the breach-notification timeline substantially: entities would be required to notify the OAIC within 72 hours of becoming aware of reasonable grounds to believe an eligible data breach has occurred. This proposed timeline is understood to align with equivalent notification windows already in place under the Security of Critical Infrastructure Act 2018 and the Cyber Security Act 2024, suggesting a deliberate effort to harmonise breach-notification timing across Australia's several overlapping breach-reporting regimes rather than operate the privacy regime's timeline in isolation. Importantly, the existing 30-day window for assessing whether a suspected breach is in fact an eligible data breach would remain unaffected; the 72-hour clock would apply only once that assessment concludes with reasonable grounds to believe an eligible breach occurred. The content required within the notification statement itself would also expand under the proposal. Together, the controller/processor framework and the accelerated notification timeline would represent a meaningful tightening of entities' obligations once a breach, or a service-provider relationship involving personal information, is identified. Neither proposal has yet taken legal effect. #### Outlook The harmonisation rationale behind the proposed 72-hour notification window, aligning with the Security of Critical Infrastructure Act and Cyber Security Act timeframes, suggests this element of the reform may face less resistance during the Bill's passage than more novel elements such as the controller/processor framework, since entities subject to multiple overlapping breach regimes already operate to comparable timeframes under those other Acts. The exact clause numbering and final drafting of the 72-hour requirement had not been retrieved as at this cycle and will become clearer once the Bill, if introduced as the Government has signalled before the end of 2026, is formally tabled. D4 · Controller & Processor — Full Module Record 7 sub-modules · 64 words · 11 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Australia: D5 Cross-Border & Adequacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ A functioning accountability-based transfer framework exists but lacks a mutual EU adequacy finding and a fully operative statutory whitelist, and has no general data-localisation mandate. Primary framework Privacy Act 1988 (Cth) — Australian Privacy Principle 8 and s16C Supervisory authority [Office of the Australian Information Commissioner (OAIC)](https://www.oaic.gov.au/) Traffic-light rationale — Amber A functioning accountability-based transfer framework exists but lacks a mutual EU adequacy finding and a fully operative statutory whitelist, and has no general data-localisation mandate. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 85 words · 6 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Australia: D6 Sectoral Watch7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Financial, health and telecoms/online-safety overlays are well documented and actively enforced; employment and education sector-specific DP rules are an evidentiary gap. Primary framework Privacy Act 1988 (Cth) Part IIIA; My Health Records Act 2012 (Cth); Online Safety Act 2021 (Cth) Part 4A Supervisory authority [Office of the Australian Information Commissioner (OAIC)](https://www.oaic.gov.au/) Traffic-light rationale — Amber Financial, health and telecoms/online-safety overlays are well documented and actively enforced; employment and education sector-specific DP rules are an evidentiary gap. Periodic update · new data 2026-11-04 #### Sectoral Watch The 1 July 2026 expansion of AML/CTF obligations to Tranche 2 sectors — real estate, legal, accounting, conveyancing, and trust and company service providers — has a direct Privacy Act consequence: entities in these newly captured sectors must now comply with the Privacy Act in respect of their AML/CTF-related data handling, including small businesses that would otherwise fall under the Act's general small-business exemption. This is a sectoral overlay effect rather than a standalone privacy reform: the AML/CTF expansion itself is the primary regulatory event, with Privacy Act coverage of newly regulated small businesses following as a consequence of that expansion rather than as an independent privacy-law change. The specific statutory provision that overrides the small-business exemption for these entities was not independently located, so the precise legal mechanism by which coverage is extended remains to be confirmed, though the practical effect — Privacy Act obligations now reaching small businesses in these sectors for their AML/CTF data handling — is reported with confidence. #### Outlook Locating the specific statutory provision effecting this exemption override would clarify the precise scope of newly covered small businesses' Privacy Act obligations. This sectoral overlay should be read alongside the AML/CTF Tranche 2 enrolment-enforcement activity being tracked separately, since the same population of newly regulated entities is subject to both AML/CTF enrolment duties and this Privacy Act coverage consequence. Periodic update · new data 2026-10-18 #### Sectoral Watch The 1 July 2026 expansion of AML/CTF obligations to Tranche 2 sectors — real estate, legal, accounting, conveyancing, and trust and company service providers — has a direct Privacy Act consequence: entities in these newly captured sectors must now comply with the Privacy Act in respect of their AML/CTF-related data handling, including small businesses that would otherwise fall under the Act's general small-business exemption. This is a sectoral overlay effect rather than a standalone privacy reform: the AML/CTF expansion itself is the primary regulatory event, with Privacy Act coverage of newly regulated small businesses following as a consequence of that expansion rather than as an independent privacy-law change. The specific statutory provision that overrides the small-business exemption for these entities was not independently located this cycle, so the precise legal mechanism by which coverage is extended remains to be confirmed, though the practical effect — Privacy Act obligations now reaching small businesses in these sectors for their AML/CTF data handling — is reported with confidence. #### Outlook Locating the specific statutory provision effecting this exemption override would clarify the precise scope of newly covered small businesses' Privacy Act obligations. This sectoral overlay should be read alongside the AML/CTF Tranche 2 enrolment-enforcement activity being tracked separately, since the same population of newly regulated entities is subject to both AML/CTF enrolment duties and this Privacy Act coverage consequence. D6 · Sectoral Watch — Full Module Record 7 sub-modules · 54 words · 6 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Australia: D7 AdTech & Commercial Privacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Direct marketing and tracking-technology oversight exist and are being actively enforced, but dark-pattern-specific rules, recognised opt-out signals, clean-room rules and cross-context-advertising concepts (as distinct legal categories) were not evidenced. Primary framework Privacy Act 1988 (Cth) APP 7; Spam Act 2003 (Cth) (adjacent, ACMA-administered) Supervisory authority [Office of the Australian Information Commissioner (OAIC)](https://www.oaic.gov.au/) Traffic-light rationale — Amber Direct marketing and tracking-technology oversight exist and are being actively enforced, but dark-pattern-specific rules, recognised opt-out signals, clean-room rules and cross-context-advertising concepts (as distinct legal categories) were not evidenced. D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 48 words · 3 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Australia: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Meaningful ADM transparency reform is enacted but not yet in force, and biometric governance currently relies on case-by-case enforcement rather than a dedicated statute. Primary framework Privacy Act 1988 (Cth) APP 1.7–1.9 (from 10 December 2026) Supervisory authority [Office of the Australian Information Commissioner (OAIC)](https://www.oaic.gov.au/) Traffic-light rationale — Amber Meaningful ADM transparency reform is enacted but not yet in force, and biometric governance currently relies on case-by-case enforcement rather than a dedicated statute. Periodic update · new data 2026-10-18 #### Algorithmic, Biometric & Surveillance Governance Two distinct developments define this module's current posture: a forward-looking disclosure duty approaching its commencement date, and an active enforcement investigation already underway. New APP 1.7-1.9, commencing 10 December 2026, will require many organisations to disclose in their privacy policy when a computer system, including AI, is used in a decision that significantly affects an individual. This is a transparency obligation rather than a substantive restriction on automated decision-making itself. Separately, and already active, the OAIC opened an investigation on 7 October 2026 into the maker of the 'HeyCyan' smart-glasses phone application. This sits within a broader pattern of increasing OAIC scrutiny of smart glasses and other connected or surveillance-capable devices. The Commissioner has stated that entities can be liable as accessories for enabling such devices, a theory of liability that would extend OAIC enforcement reach beyond the device manufacturer itself to other entities facilitating the device's surveillance-capable functionality. Taken together, the ADM disclosure duty and the active HeyCyan investigation indicate the OAIC is pursuing both a prospective transparency framework and present-tense enforcement against surveillance-capable technology simultaneously, rather than waiting for the Tranche 1 obligations to commence before acting on device-related privacy risk. #### Outlook The HeyCyan investigation's outcome will be an early test of the OAIC's accessory-liability theory for connected and surveillance-capable devices. Separately, 10 December 2026 will bring the ADM disclosure duty into force, requiring covered organisations to update privacy-policy disclosures for AI-driven significant decisions. Periodic update · new data 2026-10-12 #### Algorithmic, Biometric & Surveillance Governance From 10 December 2026, APP entities that use automated decision-making significantly affecting individuals must disclose in their privacy policy which decision types are made by automated means and what personal information is used in making them. This obligation is enacted under the Privacy and Other Legislation Amendment Act 2024 but has not yet taken legal effect; it commences on the stated date. The OAIC has already moved to operationalise the coming duty at the guidance level, issuing Australian Privacy Principles Guidelines Chapter 1 version 2.0, effective 29 September 2026, which requires privacy policies to address computer-program and automated-decision usage ahead of the statutory obligation's commencement. Together these two instruments, one a guidance document and one a commenced-but-not-yet-effective Act provision, form the current shape of Australia's algorithmic-transparency regime: a disclosure duty tied specifically to privacy-policy content, applying where automated decision-making significantly affects an individual, rather than a broader algorithmic-accountability or audit regime. #### Outlook The obligation's legal effective date of 10 December 2026 is the determinative marker. Entities relying on automated decision-making that significantly affects individuals have until that date to align privacy-policy disclosures with both the statutory requirement and the OAIC's Chapter 1 v2.0 guidance; no further legislative change to this specific obligation was identified this cycle. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 63 words · 7 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Australia: D9 Children & Vulnerable Groups5 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Binding, in-force age-verification law plus a legislatively mandated forthcoming Children's Code represent strong and active regulatory attention to children's privacy. Primary framework Online Safety Act 2021 (Cth) Part 4A; Privacy Act 1988 (Cth) (Children's Online Privacy Code, pending) Supervisory authority [Office of the Australian Information Commissioner (OAIC)](https://www.oaic.gov.au/) Traffic-light rationale — Green Binding, in-force age-verification law plus a legislatively mandated forthcoming Children's Code represent strong and active regulatory attention to children's privacy. Periodic update · new data 2026-10-18 #### Children & Vulnerable Groups The OAIC's Children's Online Privacy Code, developed against the current Australian Privacy Principles rather than against the Tranche 2 reform framework, must be registered by 10 December 2026. This registration deadline places the Code on the same operative timeline as the new APP 1.7-1.9 automated-decision-making disclosure duties, meaning organisations serving children will face two converging compliance obligations on the same date: the finalised Children's Code itself, and the ADM disclosure duty where applicable to services used by children. Because the Code is developed against the current APPs rather than the still-pre-parliamentary Tranche 2 framework, its content and obligations are not contingent on the Tranche 2 Bill's introduction or passage; it proceeds on its own statutory basis toward the 10 December 2026 registration deadline regardless of the broader reform's progress. #### Outlook The period immediately before 10 December 2026 is the key compliance-preparation window for organisations providing services to children in Australia, as the Code's registration converts its content from developed-but-unregistered guidance into a binding instrument. Periodic update · new data 2026-10-05 #### Children & Vulnerable Groups Under Tranche 1 of the Privacy Act reforms, already enacted ahead of this cycle, the OAIC is statutorily required to develop and register a Children's Online Privacy Code by 10 December 2026. As at this cycle, the Code is understood to remain in draft, meaning registration has not yet occurred, though the statutory deadline remains in force and approaching. This is a distinct development track from the second-tranche exposure draft discussed elsewhere in this brief: the Children's Online Privacy Code obligation derives from already-enacted Tranche 1 provisions, placing it on a firmer legal footing than the still-proposed second-tranche reforms, even though the Code's content has not yet been finalised or registered. The practical effect of the Code, once registered, would be to impose specific obligations on entities handling children's personal information online, a vulnerable-group protection mechanism with some conceptual parallel to children's codes operating in other jurisdictions, adapted to the Australian Privacy Principles framework. The approaching deadline means this is one of the more concretely dated developments in Australia's current privacy reform landscape, in contrast to the second-tranche Bill's introduction timeline, which remains contingent on parliamentary scheduling. Because the Code derives its legal requirement from already-enacted provisions, its 10 December 2026 deadline is not dependent on the second-tranche Bill's progress or ultimate enactment. #### Outlook The statutory deadline of 10 December 2026 for registering the Children's Online Privacy Code falls within the current reporting period's near horizon and is independent of whether the second-tranche Bill is introduced to Parliament on the Government's signalled timeline. Given the Code remains in draft, the key near-term question is whether the OAIC will register it by the statutory deadline or whether a delay occurs; no information available this cycle indicates which outcome is more likely. D9 · Children's Privacy — Full Module Record 5 sub-modules · 79 words · 6 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Australia: D10 Enforcement & Redress6 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Well-resourced, increasingly assertive enforcement with escalating penalties, multiple concurrent major proceedings, and new private/collective redress avenues, tempered by acknowledged case-backlog capacity constraints. Primary framework Privacy Act 1988 (Cth) Part IIIC / ss 13G–13K, 80U–80W; Schedule 2 (statutory tort) Supervisory authority [Office of the Australian Information Commissioner (OAIC)](https://www.oaic.gov.au/) Traffic-light rationale — Green Well-resourced, increasingly assertive enforcement with escalating penalties, multiple concurrent major proceedings, and new private/collective redress avenues, tempered by acknowledged case-backlog capacity constraints. Periodic update · new data 2026-10-18 #### Enforcement & Redress The OAIC is pursuing an explicitly enforcement-first posture in 2026, visible across several simultaneous strands. On 15 June 2026 the OAIC published a determination ordering American Express Australia Limited to compensate a complainant, having found that American Express failed to adequately mitigate the risk of employees improperly accessing personal information. On 7 October 2026 the OAIC opened a new investigation into the maker of the 'HeyCyan' smart-glasses application, part of a wider pattern of scrutiny of connected and surveillance-capable devices. This active enforcement posture sits in tension with a separate, structural capacity constraint: as at February 2026, the OAIC stated it is unlikely to substantially progress newly lodged, validly-made individual privacy complaints for around six to twelve months after lodgement, absent exceptional circumstances. The combination is analytically significant — the regulator is simultaneously escalating high-profile, higher-materiality enforcement actions (determinations, new investigations) while acknowledging a multi-month structural delay for ordinary individual complaint handling, indicating a prioritisation of resources toward systemic or higher-impact matters over routine individual redress. #### Outlook Whether the OAIC's complaint-handling backlog narrows over the coming months, even as its enforcement-first posture on higher-profile matters like HeyCyan continues, is the key operational question for this module. The outcome of the HeyCyan investigation will also be a signal of how the OAIC's accessory-liability theory for connected devices develops in practice. Periodic update · new data 2026-10-12 #### Enforcement & Redress Australia's civil-penalty architecture under the Privacy Act 1988 (Cth) remains tiered: serious interferences with privacy carry civil penalties up to the greater of AUD 50 million, three times the benefit obtained, or 30 percent of adjusted turnover, non-serious interferences carry penalties up to AUD 3.3 million, and administrative breaches carry penalties up to AUD 330,000. This penalty structure was carried from the first Privacy Act reform tranche and was not independently re-verified this cycle beyond the APP Guidelines update. Separately, a statutory tort for serious invasions of privacy, which commenced 10 June 2025, continues to permit individuals to bring direct action regardless of whether the OAIC is involved, subject to exemptions for journalism, law enforcement and intelligence activity; no change to the tort was identified this cycle. On the reform horizon, public consultation on the exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026, comprising around forty proposed reforms including a fair-and-reasonable handling test and a right of erasure for large digital platforms, closed 18 September 2026. The government has signalled an intention to introduce the Bill before the end of 2026, but no introduction to Parliament was confirmed this cycle. #### Outlook Whether the Privacy Amendment (Personal Data Protection) Bill 2026 is introduced to Parliament before the end of 2026, as the government has signalled, is the key marker to watch. If introduced, the Bill's roughly forty proposed reforms, including the fair-and-reasonable test and the large-platform erasure right, would represent the next material escalation in Australia's enforcement and redress architecture beyond the existing tiered civil-penalty regime and statutory tort. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 100 words · 20 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (38 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) deadlines and response windows Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy received Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 81 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties