Blog

Australia Privacy Laws Explained: A Complete Guide to Regulations and Compliance

Australia’s privacy framework continues to evolve, with reforms, new codes, and expanding obligations shaping how organizations govern personal data.

Keshawna Campbell
Privacy Research Manager, OneTrust Center of Excellence
April 7, 2026

The Australia’s Privacy Framework in 2026
Key Laws and Regulatory Components
Scope, Applicability, and Enforcement
Sensitive Data, Employment, and Data Transfers
Expanding Data Rights and Data Sharing Models
The OAIC Draft Online Privacy Code
Next Steps for Compliance
Key Questions on Australia Privacy Laws

Understanding Australia’s Privacy Framework in 2026

Australia’s privacy landscape is built on a comprehensive regulatory framework that combines federal law, sector-specific rules, and state-level legislation. At its core sits the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), which establish how personal information must be collected, used, disclosed, and protected.

Significant reforms introduced in November 2024, with most changes effective from December 11, 2024, have strengthened this framework. These updates place greater emphasis on accountability, transparency, and enforceability, aligning Australia more closely with global privacy expectations while maintaining its own regulatory structure.

The law applies broadly to private-sector organizations and federal government agencies, with some exemptions for small businesses under specific thresholds. At the same time, certain obligations, such as notifiable data breach requirements involving Tax File Numbers, extend beyond these exemptions.

For many organizations, the challenge lies in navigating how these rules interact across multiple layers. Federal requirements establish the baseline, while sector-specific codes, state laws, and emerging frameworks such as the Consumer Data Right introduce additional obligations that must be operationalized together.

Key Laws and Regulatory Components

Australia’s privacy regime extends beyond a single law. It operates as a layered system, where multiple instruments apply depending on the type of data, industry, and use case.

The Privacy Act and APPs remain the foundation. They define core principles such as lawful collection, purpose limitation, data quality, security, and accountability. Organizations are expected to take reasonable steps to protect personal information and ensure it is handled in line with these principles throughout its lifecycle.

Alongside this, the Privacy Regulation 2013, the Privacy (Credit Reporting) Code, and specific rules governing areas such as medical research and Tax File Numbers introduce more targeted obligations. These frameworks apply where organizations process particular categories of data or operate in regulated sectors.

The Consumer Data Right (CDR) adds another layer. Introduced in 2020 and expanding across sectors including banking, energy, telecommunications, and financial services, the CDR establishes a data-sharing regime supported by its own privacy safeguards. These safeguards operate similarly to the APPs but are tailored to the controlled sharing of consumer data between accredited participants.

At the state and territory level, privacy laws regulate government agencies and, in some cases, private contractors handling public sector data. These laws operate alongside the federal framework, requiring organizations to align obligations across jurisdictions where activities intersect.

Scope, Applicability, and Enforcement

The Privacy Act applies to most private-sector organizations, referred to as APP entities, as well as federal agencies. Organizations with annual turnover below AUD 3 million may fall outside scope unless they handle certain types of data, such as health information, or derive benefit from personal information.

Enforcement sits with the Office of the Australian Information Commissioner (OAIC), which plays a central role in shaping how the law operates in practice. The OAIC can investigate complaints, issue infringement and non-compliance notices, impose penalties, and seek court orders to compel organizations to meet their obligations.

Reforms have strengthened these enforcement powers, introducing greater regulatory scrutiny and expanding the consequences for non-compliance. The introduction of a statutory tort for serious invasions of privacy also creates a pathway for individuals to seek redress directly, reinforcing accountability beyond regulatory enforcement alone.

This shift has practical implications. Privacy programs are expected to demonstrate not only that policies exist, but that controls are implemented, monitored, and consistently applied across systems and processes.

Sensitive Data, Employment, and Data Transfers

Australia’s framework distinguishes between different categories of personal information, applying stricter requirements where risk is higher.

Sensitive information, which includes data such as health records, biometric information, political opinions, and criminal history, is subject to more restrictive rules around collection, use, and disclosure. Credit information and Tax File Number data are also governed by specific provisions, each with their own compliance requirements.

In employment contexts, the Privacy Act and APPs regulate how employee data is collected and managed. Guidance from the OAIC and the Fair Work Ombudsman provides additional clarity on how organizations should handle employee information in practice.

Data transfers, including disclosures to overseas recipients, are governed by APPs 3, 6, and 8. Organizations disclosing personal information outside Australia must take reasonable steps to ensure that the recipient handles the data in line with Australian privacy standards. This introduces an operational requirement to assess third parties, establish safeguards, and maintain oversight of how data is processed beyond national borders.

Consumer Data Right and Expanding Data Sharing Models

The Consumer Data Right represents a shift in how personal data is shared and controlled.

Initially introduced in the banking sector, the CDR enables consumers to direct organizations to share their data with accredited third parties. This model has expanded into energy and continues to extend into other sectors, including telecommunications and insurance.

The CDR Privacy Safeguard Guidelines establish a distinct set of obligations for participants, covering areas such as consent, data use, and security. These safeguards operate alongside the APPs, requiring organizations to manage both frameworks simultaneously.

For organizations, this introduces a more dynamic data environment. Data is no longer only collected and stored; it is actively shared and reused within regulated ecosystems. Governance models must account for this movement, ensuring that consent, access, and accountability are maintained across each stage of the data lifecycle.

Children’s Privacy and the OAIC Draft Online Privacy Code

Children’s data protection has become a central focus of Australia’s evolving privacy framework.

On March 31, 2026, the OAIC published an exposure draft of the Children’s Online Privacy Code for public consultation. The draft Code expands the scope of children’s privacy protections beyond social media platforms, covering a wide range of online services including apps, games, and websites used by children and teenagers.

The Code introduces a set of obligations designed to ensure that personal information is handled in line with the best interests of the child. Organizations would be required to assess how their data practices affect children and ensure that collection, use, and disclosure align with this standard.

Direct marketing would only be permitted where consent is obtained, the activity serves the child’s best interests, and the data is collected directly from the child. The draft also introduces enhanced rights and controls, including the ability for children to request the destruction of their personal information.

Transparency requirements are also strengthened. Privacy notices and policies must be written in clear, accessible, and age-appropriate language, ensuring that children can understand how their data is used. Consent mechanisms would also need to be more robust, including informing children when consent is provided on their behalf by a parent.

The OAIC has developed a range of supporting materials, including guides tailored to different age groups and educational resources. The consultation process is open until June 5, 2026, with the aim of registering the Code by December 10, 2026.

For organizations, this introduces a new layer of operational requirements. Services that interact with children will need to reassess how data is collected, how consent is obtained, and how experiences are designed to align with regulatory expectations.

Operationalizing Privacy Compliance in Australia

As Australia’s privacy framework continues to evolve, the focus shifts from understanding the law to applying it in practice.

Organizations need a clear view of how personal data moves across systems, how obligations apply at each stage, and how controls are enforced. This includes maintaining accurate data inventories, aligning policies with operational workflows, and ensuring that decisions can be documented and explained when required.

A company deploying AI-driven personalization, for instance, must consider how transparency requirements apply to automated decision-making, how consent is captured and managed, and how data flows across marketing, analytics, and third-party platforms. At the same time, it must ensure that sensitive data is handled appropriately and that any international transfers meet APP requirements.

This level of coordination requires more than policies alone. It depends on connecting privacy requirements to day-to-day operations, where decisions are made and data is actively used.

Next Steps for Compliance

Australia’s privacy laws continue to develop through reforms, new codes, and expanding data-sharing frameworks. The Privacy Act and Australian Privacy Principles provide the foundation, while instruments such as the Consumer Data Right and the proposed Children’s Online Privacy Code introduce more specific requirements that shape how data is handled in practice.

Organizations operating in Australia need to align governance models with this layered structure, ensuring that obligations are applied consistently across systems, use cases, and jurisdictions. This includes managing sensitive data, overseeing international transfers, and adapting to emerging requirements around children’s privacy and data sharing.

For deeper analysis of Australia’s privacy regulations and global developments, explore OneTrust DataGuidance.

Key Questions on Australia Privacy Laws

The Privacy Act 1988 (Cth), supported by the Australian Privacy Principles, forms the foundation of Australia’s privacy framework.

Most private-sector organizations and federal government agencies must comply, with some exemptions for small businesses unless specific conditions apply.

The CDR is a regulated data-sharing framework that allows consumers to direct organizations to share their data with accredited third parties, supported by its own privacy safeguards.

Organizations must take reasonable steps to ensure that overseas recipients handle personal information in line with Australian privacy standards.

It is a proposed regulatory code that introduces stricter requirements for handling children’s data, including best interest obligations, stronger consent mechanisms, and clearer privacy notices.

Organizations should focus on understanding data flows, aligning policies with operational processes, and ensuring that controls are consistently applied across systems and use cases.

Blog

Australia Privacy Laws Explained: A Complete Guide to Regulations and Compliance

Table of contents

Understanding Australia’s Privacy Framework in 2026

Key Laws and Regulatory Components

Scope, Applicability, and Enforcement

Sensitive Data, Employment, and Data Transfers

Consumer Data Right and Expanding Data Sharing Models

Children’s Privacy and the OAIC Draft Online Privacy Code

Operationalizing Privacy Compliance in Australia

Next Steps for Compliance

Key Questions on Australia Privacy Laws

What is the main privacy law in Australia?

Who must comply with the Privacy Act?

What is the Consumer Data Right (CDR)?

How are international data transfers regulated?

What is the Children’s Online Privacy Code?

What should organizations prioritize for compliance?

You may also like

Technology Risk & Compliance

How OneTrust solves the ‘Why should I care?’ of risk insights​

Discover how OneTrust aggregates and contextualizes risk data, models business and technical impact, and delivers board-ready dashboards that translate technical risk into clear, executive-level decisions.

May 19, 2026

Third-Party Risk

How OneTrust solves inconsistent and subjective risk scoring​

Learn how OneTrust enables structured, transparent risk scoring by standardizing questionnaires, distinguishing inherent and residual risk, creating explainable scores, and turning risk data into actionable business insights.

May 05, 2026

AI Governance

Operationalizing AI Governance: From Complexity to Control

Join our webinar to learn how to architect a scalable AI governance stack, connecting risk, compliance, and development for responsible AI adoption.

April 14, 2026

Third-Party Risk

The Shift from Periodic Reviews to Continuous Risk Management

Digital supply chains are shifting daily and traditional risk management programs aren’t built to keep up.

April 09, 2026

Third-Party Risk

How OneTrust solves manual, ad-hoc third-party risk processes​

See how OneTrust automates vendor onboarding, due diligence, and ongoing reviews—standardizing intake, speeding approvals, improving collaboration, and reducing risk so teams move faster without losing control.

April 08, 2026

Third-Party Risk

How OneTrust solves visibility gaps and standardizes risk management​

Learn how OneTrust helps security and risk teams replace fragmented vendor data with a centralized risk architecture, delivering a single source of truth, mapped vendors, full visibility, and scalable, proactive risk management.

March 31, 2026

Technology Risk & Compliance

Smarter TPRM in action: Using AI to drive efficiency and better risk outcomes

See how AI‑enabled TPRM transforms traditional vendor risk programs in this live demo, showcasing faster assessments, reduced manual effort, clearer risk insights, and smarter prioritization across the third‑party lifecycle to build a more scalable, outcome‑driven TPRM program.

March 25, 2026

Privacy Automation

Data Protection Leader Magazine | March 2026

Data Protection Leader March 2026 explores EU digital reform, US and California AI regulation, NIS2 enforcement, ISO 42001, and modern AI governance.

March 24, 2026

Technology Risk & Compliance

TPRM in the age of AI: Managing risk while scaling smarter programs

Discover how AI is transforming third‑party risk management in this webinar, exploring governance of third‑party AI from intake to monitoring and how TPRM leaders use AI.

March 11, 2026

Third-Party Risk

Simplifying Risk and Compliance: From Chaos to Clarity Webinar Series

Join our demo webinar series to see how OneTrust simplifies third-party management and technology risk & compliance.

March 02, 2026

Third-Party Risk

Accelerate growth: Uniting AI governance and risk management

AI risk can’t be managed in silos. Effective AI governance brings security, privacy, risk, and the business together to reduce exposure and accelerate innovation.

February 16, 2026

Third-Party Risk

Third-Party operational risk: Shifting from reliance to resilience

In this session, we’ll explore how leading enterprises are moving from reactive vendor oversight to a programmatic, data-driven approach that strengthens resilience across the entire supply ecosystem.

January 27, 2026

Third-Party Risk

A day in the life of a risk assessor — Yesterday, today, tomorrow

Join seasoned practitioners from OneTrust as we explore how risk assessment has changed, where it stands today, and what the future will demand of risk professionals.

January 21, 2026

Privacy Automation

From compliance to impact: Embedding privacy across the tech lifecycle

In this webinar, learn how organizations operationalize privacy at scale by embedding privacy across the tech lifecycle.

January 20, 2026

Third-Party Risk

The business value of automated third-party risk management

January 14, 2026

Responsible AI

Future of Third-Party Risk Management: AI, Governance, and Strategic Transformation

How OneTrust solves the ‘Why should I care?’ of risk insights

How OneTrust solves inconsistent and subjective risk scoring

How OneTrust solves manual, ad-hoc third-party risk processes

How OneTrust solves visibility gaps and standardizes risk management