Australia Privacy and Other Legislation Amendment Act 2024

Enacted November 2024. Introduces a statutory privacy tort, children online privacy protections, tiered penalties up to AUD 50 million, and enhanced OAIC investigative powers.

JurisdictionAustralia
CategoryPrivacy & Data Protection
StatusActive
Effective date
Latest development

Analysis

The Privacy and Other Legislation Amendment Act 2024 is now in force and is the key federal privacy reform measure that introduced a statutory tort for serious invasions of privacy, new doxxing offences, expanded OAIC powers, a Children’s Online Privacy Code framework, and a staged set of transparency and penalty reforms under the Privacy Act 1988.[5][1][8]

Key Requirements

  • Statutory tort for serious invasions of privacy: The Act creates a new private right of action where a person intentionally or recklessly invades privacy by intruding on seclusion or misusing personal information, and the invasion is serious.[7][1]
  • Children’s Online Privacy Code: The Act requires development of a children-focused online privacy code, creating a dedicated compliance framework for services likely to be accessed by children.[1][7]
  • Expanded OAIC enforcement powers: The Act gives the OAIC stronger investigative and compliance tools, including compliance notices, infringement notices, and broader enforcement pathways.[2][3][1]
  • Tiered civil penalty framework: The reform introduces a tiered approach to penalties, including lower-level infringement mechanisms and stronger civil penalty options for privacy interferences.[2][3][7]
  • Automated decision-making transparency: Entities must update privacy policies to disclose certain automated decision-making practices using personal information; this obligation has a transition period and is scheduled to apply from 10 December 2026.[2][3][4]
  • Doxxing offences: The Act creates criminal offences for releasing personal data using a carriage service in a menacing or harassing way.[1][2][6]
  • Overseas disclosure protections: The reforms include measures affecting overseas disclosures of personal information, including mechanisms to support stronger cross-border privacy protections.[1][2][7]
  • Information sharing in emergencies and eligible data breaches: The Act facilitates limited sharing of information in emergency situations or after eligible data breaches, subject to statutory conditions.[1][7]

Compliance Challenges

  • Mapping what counts as “serious” privacy risk: Organizations must assess when conduct could meet the statutory tort threshold, which requires careful legal and factual review of seclusion, misuse, intent/recklessness, and seriousness.[7][3]
  • Updating privacy notices and policies for automated decision-making: Many organizations use AI or rule-based decision systems, and the new disclosure obligations require privacy policy reviews, data-flow mapping, and internal governance updates.[2][3]
  • Children’s services and age assurance: Digital platforms, apps, adtech providers, and online publishers may need to redesign consent, profiling, and default privacy settings for child users once the code is finalized.[1][7]
  • Cross-border transfer controls: Firms sending personal information offshore must reassess vendor contracts, transfer safeguards, and accountability arrangements in light of the new overseas disclosure measures.[1][2]
  • Incident response and breach handling: The new enforcement environment increases pressure to improve breach triage, investigation readiness, and regulator-facing documentation after eligible data breaches.[1][7]
  • Governance over data sharing and retention: Expanded powers and penalties raise the cost of weak data governance, especially where personal information is reused beyond the original purpose.[1][3]
  • Real-world example: sector-wide response to privacy reform: Major Australian law firms reported that the reforms are forcing organizations to review automated decision-making, child-facing products, and privacy governance in advance of the 2026 deadline.[2][3]
  • Real-world example: OAIC compliance focus: The OAIC’s updated Privacy Act history page states that the agency is adjusting its privacy functions to reflect the 2024 amendments, indicating active supervisory implementation.[4]

Implementation Best Practices

  • Run a privacy gap assessment against the amended Privacy Act, focusing first on children’s data, automated decision-making, cross-border disclosures, and enforcement exposure.[4][5][7]
  • Maintain a data inventory that identifies what personal information you collect, where it flows, which systems make automated decisions, and which vendors receive it.[2][3]
  • Rewrite privacy notices and policies so they clearly disclose automated decision-making in the manner required by the new obligations.[2][3]
  • Strengthen incident response playbooks to support fast escalation, legal review, and OAIC engagement after an eligible data breach.[1][7]
  • Implement privacy-by-design controls for child-facing products, including default minimization, age-appropriate design, and profiling restrictions once the code is issued.[1][7]
  • Review contracts with processors and overseas recipients to ensure privacy obligations, security controls, audit rights, and breach notification duties are explicit.[1][2]
  • Train legal, product, security, and marketing teams on the new tort, doxxing offences, and compliance notice risks so responsibilities are understood across functions.[2][3]

Recent Updates

  • 10 December 2024: The Act received Royal Assent and became law as the Privacy and Other Legislation Amendment Act 2024.[5][1][3]
  • 11 December 2024: The majority of amendments within the OAIC’s remit commenced, according to the OAIC’s history page.[4]
  • 10 December 2024 onward: Most amendments commenced immediately or the next day, while some provisions were staged.[2][3][4]
  • 10 June 2025 or by proclamation: The statutory tort for serious invasions of privacy was designed to commence on the earlier of proclamation or six months after commencement, which points to a 10 June 2025 backstop date.[3][7]
  • 10 December 2026: The automated decision-making transparency obligations have a 24-month grace period and are scheduled to apply from this date.[2][3]
  • 10 December 2026: The Children’s Online Privacy Code is to be developed and registered within the two-year window described in commentary on the Act.[2]

Related Regulations

  • Privacy Act 1988 (Cth): The amended Act sits inside the Privacy Act framework and changes how the Act operates for personal information handling, enforcement, and civil remedies.[5][4]
  • Australian Privacy Principles (APPs): The reforms interact with the APPs by strengthening disclosure, security, and handling obligations tied to personal information management.[1][7]
  • Notifiable Data Breaches scheme: The new enforcement and information-sharing measures overlap with the existing breach notification regime and increase the importance of breach readiness.[1][7]
  • Criminal Code Act 1995 (Cth): The doxxing reforms amend criminal law to create offences targeting harmful disclosure of personal data.[1][6]
  • Children’s privacy frameworks: The new Children’s Online Privacy Code is intended to operate alongside existing privacy obligations and sector-specific child safety rules.[1][7]
  • Overseas transfer rules: The overseas disclosure reforms interact with cross-border transfer controls and contractual accountability for foreign recipients.[1][2]

Industry Impact

  • Technology and digital platforms: The automated decision-making disclosure rules and children’s privacy framework materially affect product design, analytics, personalization, adtech, and recommender systems.[2][3][7]
  • Healthcare, finance, and other high-data industries: These sectors face heightened exposure because they handle sensitive personal information and are more likely to rely on automated workflows and third-party processors.[1][2]
  • Media and social platforms: The new doxxing offence and privacy tort increase litigation and moderation risk for user-generated content and disclosure practices.[1][6]
  • Cross-border vendors and cloud providers: Privacy governance, contractual controls, and offshore transfer documentation become more important under the strengthened disclosure and enforcement framework.[1][2]
  • Compliance and legal functions: Organizations will likely need more recurring legal review, DPIA-style assessments, and board reporting because the reform increases potential liability and regulator scrutiny.[2][3][4]
  • Industry analysis: legal market analyses from MinterEllison and Norton Rose Fulbright explain the practical impact on governance, automated decision-making, and enforcement exposure.[2][3]
  • Official oversight context: the OAIC’s Privacy Act history page confirms the agency is updating its privacy functions to align with the reform package.[4]

Sources

Recent developments

  • — Overview of the Privacy and Other Legislation Amendment Act 2024, highlighting key reforms now operative and upcoming commencement dates for the tort of serious invasions of privacy (by 2025-06-10) and automated decision transparency obligations (effective 2026-12-10), with practical guidance for entities on compliance and technical/organisational measures.[3] (source)
  • — Analysis of the Act’s implementation and staged commencement, focusing on expanded OAIC enforcement powers, new civil penalty tiers and compliance notices, children’s online privacy obligations, cross‑border “white list” mechanism, and the strategic impact on governance, AI/automated decision‑making and incident response for organisations.[2] (source)
  • — OAIC media update reiterating the significance of the Act’s passage and outlining regulatory priorities around the new statutory tort, strengthened enforcement (including infringement and compliance notices), development of the Children’s Online Privacy Code, and transparency for substantially automated decisions that significantly affect individuals.[4] (source)
  • — Industry legal commentary on how the Act’s reforms to APPs 1, 8 and 11 and the strengthened enforcement regime will require entities to demonstrate compliance, respond to OAIC compliance notices, and manage litigation risk under the new statutory tort, framing the changes as a material but first‑stage uplift in Australia’s privacy framework.[7] (source)
  • — Update emphasising operational impacts of the Act’s doxxing offence (in force since 2024-12-11), including up to seven years’ imprisonment for harmful disclosure of personal information, and advising organisations to review online conduct policies, content moderation, and incident handling where user or employee data may be weaponised.[3] (source)
  • — Sector‑focused briefing on how the Act’s enhanced OAIC powers, mandatory transparency for automated decisions and stronger child privacy protections are reshaping risk assessments and compliance programs in data‑intensive industries such as digital platforms, financial services and health, with recommendations on updating privacy policies and governance.[2] (source)
  • — Post‑implementation commentary noting that most provisions took effect on 2024-12-10 and discussing immediate obligations (technical and organisational security measures, overseas disclosure safeguards) versus deferred obligations (children’s online privacy code and automated decisions transparency), and how organisations are phasing their compliance work.[3] (source)
  • — OAIC communication outlining how it will use new investigative and enforcement tools under the Act, including tiered penalties and compulsory infringement/compliance notices, signalling a more proactive regulatory posture that is prompting regulated entities to strengthen documentation and evidence of Privacy Act compliance.[4] (source)
  • — Publication of the as‑made text of the Privacy and Other Legislation Amendment Act 2024, confirming commencement of most amendments on 2024-12-10, including clarified requirements for “reasonable steps” to secure personal information via technical and organisational measures and new criminal provisions targeting doxxing.[5] (source)
  • — Announcement and analysis of Parliament’s passage of the Privacy and Other Legislation Amendment Bill 2024, describing it as a significant milestone in modernising Australian privacy law and detailing industry reactions around the new statutory tort, increased accountability in data handling, and expectations for a second tranche of reforms.[7] (source)

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates