Updated 2 October 2026 to reflect the second tranche of reforms released for consultation in August 2026.
Introduction
As the digital landscape evolves, so does the regulatory framework surrounding data privacy in Australia. The Privacy Act 1988, the cornerstone of the protection of personal information, has now been amended by the Privacy and Other Legislation Amendment Act 2024, which received Royal Assent on 10 December 2024. A second, larger tranche of reforms is in draft. Together they affect all regulated entities, particularly those in heavily regulated industries such as finance, insurance and healthcare, where sensitive customer information is paramount. This guide sets out what has changed, what is still proposed, and why sensitive data management, data leakage prevention and insider risk mitigation matter more than ever.
What has already changed
Enhanced Security Obligations
Overview
The amended Act makes clear that the “reasonable steps” an organisation must take to protect personal information under Australian Privacy Principle 11 include technical and organisational measures (the new APP 11.3, in force since 11 December 2024). Security is no longer only about technology; it also covers governance, policies, training and board oversight.
Implications for Regulated Sectors
Organisations in finance, healthcare and insurance hold vast amounts of sensitive data, making them prime targets for cyberattacks and exposed to accidental and deliberate data loss by people inside the organisation. Strengthening data protection practices not only meets regulatory requirements but also builds trust with customers who are increasingly concerned about their privacy.
Importance for CEOs
For CEOs, this means prioritising data protection at the strategic level. That could involve allocating resources to improve data security, knowing where sensitive data is held and who can reach it, fostering a culture of privacy within the organisation, and staying informed about the latest guidance from the Office of the Australian Information Commissioner (OAIC).
New Penalties and Stronger Enforcement
Overview
The 2024 Act gave the OAIC new enforcement and investigation powers, including new tiers of civil penalties and the ability to issue infringement notices. There are now three tiers:
- Serious interferences with privacy, where the maximum penalty for a company remains the greater of $50 million, three times the benefit obtained, or 30% of adjusted turnover during the breach period (OAIC).
- A new mid-tier civil penalty for interferences with privacy that don’t meet the “serious” threshold.
- Infringement notices for administrative breaches, such as not having a compliant privacy policy.
The Act also lets the Minister make eligible data breach declarations, so that personal information can be shared quickly to reduce harm after a major breach.
Importance for CEOs
Penalties no longer apply only to the most serious failures. A non-compliant privacy policy or a slow, poorly handled response can now attract enforcement action. CEOs should make sure privacy compliance is reviewed as part of the organisation’s overall risk management.
Automated Decision-Making Transparency
Overview
From 10 December 2026, privacy policies must explain when personal information is used in substantially automated decisions that could significantly affect an individual’s rights or interests (OAIC).
Impact on Finance and Insurance
Automated decision-making is common in finance and insurance, particularly in areas like loan approvals and insurance underwriting. Transparency in these processes ensures accountability and builds customer trust.
Importance for CEOs
With the commencement date close, CEOs should check that the organisation knows where automated decisions are made, what personal information feeds them, and that the privacy policy says so.
Children’s Privacy
Overview
The 2024 Act requires the OAIC to develop and register a Children’s Online Privacy Code for social media platforms and other online services likely to be accessed by children. The OAIC released an exposure draft of the Code on 31 March 2026, and the Code must be registered by 10 December 2026.
Vigilance for Healthcare Providers
Healthcare providers and any organisation offering online services that children use must be vigilant in handling minors’ data, ensuring compliance with these enhanced protections to avoid penalties and maintain trust.
Importance for CEOs
CEOs should check whether the Code will apply to their organisation’s online services and, if so, review policies, procedures and staff training against the final Code.
Statutory Tort for Serious Invasions of Privacy
Overview
Since 10 June 2025, individuals have been able to sue for a serious invasion of privacy where someone intrudes upon their seclusion or misuses information about them, the invasion was intentional or reckless, and it was serious in the circumstances. The tort applies more broadly than the Privacy Act, including to people and organisations that are not covered by the Australian Privacy Principles.
Impact on Regulated Organisations
This increases the legal risks for organisations handling sensitive data. Individuals no longer have to rely on the OAIC to act on their behalf; they can take a privacy invasion to court themselves.
Importance for CEOs
CEOs must prioritise privacy compliance to manage legal risk. That means robust, regularly reviewed privacy policies, and being proactive in preventing the misuse of personal information, including by people inside the organisation.
Criminal Offences for Doxxing
The 2024 Act also created new criminal offences in the Criminal Code for “doxxing”: using a carriage service to publish or distribute someone’s personal data in a way that reasonable people would regard as menacing or harassing (Federal Register of Legislation). Organisations holding personal information about staff and customers should make sure access to it is limited to the people who need it.
What is still proposed
On 31 August 2026 the Attorney-General’s Department released an exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026 for public consultation, which closed on 18 September 2026. At the time of this update it is still a draft, so its details may change. Its proposals include:
Breach Notification Within 72 Hours
Overview
Today, an eligible data breach must be notified to the OAIC and affected individuals as soon as practicable. The draft would require the OAIC to be notified within 72 hours of an organisation having reasonable grounds to believe an eligible data breach has occurred, closer to international standards such as the General Data Protection Regulation (GDPR).
Importance for CEOs
Even before any deadline becomes law, CEOs must ensure their organisations are equipped to detect and assess data breaches promptly. That includes clear procedures, trained people, and the ability to see quickly what data was involved and where it went. A breach that isn’t detected can’t be assessed in 72 hours.
A “Fair and Reasonable” Test and a Right to Erasure
The draft would introduce a “fair and reasonable” test for collecting, using and disclosing personal information, modernise the definition of personal information, and give individuals a right to ask large digital platforms to delete their personal information.
The Small Business Exemption
In its 2023 response to the Privacy Act Review Report, the Government agreed in principle to remove the exemption for small businesses (generally those with an annual turnover of $3 million or less), subject to consultation and impact analysis. That has not happened yet: the exemption still applies, and the 2026 exposure draft does not remove it. Smaller entities in regulated sectors should still prepare, because the direction of travel is clear.
In Summary
The Australian Privacy Act already imposes stricter obligations than it did before the 2024 reforms, and more are coming. For CEOs of regulated entities, particularly in finance, insurance and healthcare, it is imperative to understand both what is law today and what is proposed. Sensitive data management, data leakage prevention and insider risk mitigation will be crucial in navigating the evolving regulatory landscape.
Investing in robust data protection, transparent privacy practices and comprehensive employee training will not only support compliance but also enhance customer trust and organisational resilience. By addressing these changes proactively, organisations can turn regulatory challenges into opportunities to strengthen their data protection and build a culture of privacy and security.
While these changes may seem daunting, they also present an opportunity to reassess and improve data management practices. Embracing them with a proactive and informed approach will position organisations to better protect their sensitive information and stay compliant in an increasingly stringent regulatory environment.