Australia: Data Protection

Customers requesting access to their information is now a routine consequence of operating in a data‑driven economy. Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), individuals are entitled to request access to personal information held about them by organisations.

The recent Hugging Face/OpenAI incident reveals critical lessons about AI agent security and confidential information exposure. When AI systems gain access to internal repositories containing source code, patent materials, and trade secrets, businesses face unprecedented risks that require deliberate controls and IP-focused governance before deployment.

The Administrative Review Tribunal’s decision on Bunnings’ use of Facial Recognition Technology (FRT) in February this year may have gone under the radar for government lawyers given the affected organisation was a retail giant and the scenario appeared unrelated to the day-to-day activities of an Australian government agency.

In a key decision against an Australian financial services licence (AFSL) holder, the Federal Court of Australia has ordered the AFSL holder to pay AU$2.5 million in penalties for inadequate cybersecurity measures.

Explore the latest regulatory developments across Asia-Pacific financial markets, from Australia's scam prevention framework and ASIC's cybersecurity warnings to Hong Kong's stablecoin regime implementation and Singapore's enhanced market conduct controls. This comprehensive update covers critical changes in banking supervision, digital asset regulation, and investor protection measures that are reshaping the region's financial landscape.

A recent Administrative Review Tribunal decision has clarified the boundaries of facial recognition technology use in Australian retail, examining Bunnings' controversial trial system that scanned customers to identify repeat offenders.

2026 is shaping up to be an even more challenging year for privacy compliance in Australia.

The Office of the Australian Information Commissioner (OAIC), Australia's privacy regulator, is conducting its first ever privacy compliance sweep...

As announced in late 2025, the Office of the Australian Information Commissioner (OAIC) will in this month commence a crackdown on the privacy policies of organisations that collect information in-person.