Australia's Privacy Act Reforms: What Businesses Need to Do Now

Australia's Privacy Act 1988 has undergone its most significant reform in decades. The Privacy and Other Legislation Amendment Act 2024 introduced a series of changes that affect almost every Australian business that handles personal information.

Here is what has changed and what businesses need to do in response.

Why the reforms happened

The reforms follow a series of high-profile data breaches affecting millions of Australians - Optus, Medibank, Latitude Financial and others. The government concluded that existing privacy law was not strong enough to incentivise organisations to protect personal information adequately, and that penalties were insufficient to deter poor practices.

Higher civil penalties

The maximum civil penalty for a serious or repeated privacy breach has increased substantially. For organisations, the penalty can reach the greater of $50 million, three times the value of any benefit obtained, or 30 per cent of adjusted turnover during the breach period.

These are no longer token fines. For mid-market and large organisations, the financial exposure from a serious breach is now significant enough to warrant board-level attention.

New criminal offences

The reforms introduced a new criminal offence for the malicious use or disclosure of personal information - commonly referred to as doxxing when it involves the public release of someone's personal data to facilitate harm. This is a separate offence from civil privacy breaches.

Stronger Notifiable Data Breaches scheme

The Notifiable Data Breaches (NDB) scheme, which requires organisations to notify the Office of the Australian Information Commissioner (OAIC) and affected individuals of eligible data breaches, has been strengthened. The OAIC now has greater powers to investigate and direct organisations to take remedial action.

Organisations must notify affected individuals directly where it is reasonable to do so - not just notify the regulator.

Enhanced individual rights

The reforms introduce a new right for individuals to request that an organisation erase their personal information in certain circumstances. Organisations will need processes to receive, assess and respond to erasure requests within defined timeframes.

Individuals also have enhanced rights to opt out of direct marketing and to request that their information not be used for targeted advertising based on tracking or profiling.

Children's Online Privacy Code

A new Children's Online Privacy Code is being developed. It will impose additional requirements on online services likely to be accessed by children, including stricter limits on the collection and use of children's personal information.

What businesses need to do

At a minimum, Australian businesses should:

• Review and update their privacy policy to reflect the new individual rights
• Ensure their data breach response plan covers the enhanced NDB notification obligations
• Assess whether their data retention practices can support erasure requests
• Review direct marketing and profiling practices against the new opt-out rights
• Conduct a data mapping exercise to understand what personal information they hold and where

The role of cybersecurity in privacy compliance

Privacy compliance is not just a legal exercise - it depends on having adequate security controls. An organisation that cannot prevent unauthorised access to personal information cannot meet its obligations under the Privacy Act. Technical controls, access management, encryption and security monitoring are all part of the compliance picture.

Find privacy and compliance specialists on CyberAtlas

CyberAtlas lists Australian cybersecurity and GRC specialists who can assist with privacy impact assessments, data mapping, breach response planning, and security controls that support Privacy Act compliance.