Australia: Privacy Protection

Almost two years after a relatively modest set of Privacy Act reforms were passed in late 2024 (Tranche 1 Reforms) (more on these here), the Australian Government has released an exposure draft...

The Australian Government has released an exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026, proposing the most substantial reforms to the Privacy Act 1988 in recent times. These changes introduce a fair and reasonable test for data handling, enhanced consent requirements, expanded breach notification obligations, and new rights including data erasure for large digital platforms.

Australia's Privacy Act reform has reached a critical milestone with the release of exposure draft legislation proposing fundamental changes to how organisations handle personal information. The reforms introduce a new 'fair and reasonable' test for data collection and use, a right of erasure for large digital platforms, strengthened consent standards, a statutory controller/processor framework, restrictions on trading personal data, and enhanced data breach obligations. These changes come at a time when em

Australia's Notifiable Data Breaches scheme has evolved from a compliance checkbox into a critical governance issue, with annual breach notifications reaching record highs.

Customers requesting access to their information is now a routine consequence of operating in a data‑driven economy. Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), individuals are entitled to request access to personal information held about them by organisations.

The Administrative Review Tribunal’s decision on Bunnings’ use of Facial Recognition Technology (FRT) in February this year may have gone under the radar for government lawyers given the affected organisation was a retail giant and the scenario appeared unrelated to the day-to-day activities of an Australian government agency.

AI service agreements in Australia should clearly define the scope of AI services, ownership of outputs, and liability for errors or unexpected results.

For the first time, an Australian tribunal has ruled on the legality of facial recognition technology and the collection and use of biometric information under the Australian Privacy Act 1988 (Cth) (the Act). The case involved Australian hardware retailer, Bunnings Group Ltd (Bunnings), known for its large warehouse-style stores and car park sausage sizzles.

The IPOLA Act reforms Qld information laws, requiring agencies to prepare for new privacy and data breach obligations.