The first tranche of Australia's privacy reforms is law. Further proposals need to be considered separately. This summary was updated on 23 October 2026 to distinguish enacted measures, future commencement dates, and proposed changes. It is practical guidance for software teams, not legal advice.
What the 2024 legislation enacted
The Privacy and Other Legislation Amendment Act 2024 introduced changes with different commencement dates. An enacted provision does not necessarily mean an obligation is already operating.
A statutory tort for serious invasions of privacy
The statutory tort commenced on 10 June 2025. It gives individuals a route to seek redress in court for serious invasions of privacy, subject to legal thresholds, defences and exemptions. Its application can extend beyond organisations covered by the Australian Privacy Principles. See the OAIC's explanation of the tort.
For builders, access controls, audit trails and careful handling of personal information are practical priorities. Ask legal counsel to assess how the tort applies to your product.
A Children's Online Privacy Code
The legislation requires the OAIC to develop a Children's Online Privacy Code. The code must be finalised and registered by 10 December 2026. It concerns specified online services likely to be accessed by children or primarily concerned with children's activities. Development of the code and its final requirements should be distinguished from rules already in force. Follow the OAIC's code updates.
For builders, identify whether children use your service and review the code's scope with counsel. Do not assume that every product needs the same age-verification or parental-consent flow.
Transparency about automated decisions from December 2026
From 10 December 2026, affected APP entities must include specified information in their privacy policies about relevant automated decision-making. The obligation concerns the use of personal information by computer programs to make, or perform work substantially and directly related to making, decisions that could reasonably be expected to significantly affect individuals' rights or interests. The OAIC explains the transparency obligation and its scope.
For builders, inventory relevant decision systems and document the kinds of personal information and decisions involved. Include systems that inform decisions as well as those that make them.
Additional OAIC enforcement and penalty powers
The 2024 Act strengthened the regulator's enforcement toolkit, including additional civil penalty provisions, infringement notices and compliance notices. These are enacted changes, separate from proposed future reforms. The OAIC's regulatory action guide identifies the legislative changes and notes that some provisions commence later.
For builders, keep evidence of security, retention and remediation decisions. Make privacy controls something the team can demonstrate and test.
What remains proposed in tranche two
The government's 31 August 2026 reform announcement describes draft legislation and consultation proposals, including:
- A fair and reasonable test for handling personal information.
- A right to erasure directed at large digital platforms, such as social media and search platforms.
- Stronger consent standards and restrictions on trading personal information without clear permission.
These proposals should not be described as obligations enacted by the 2024 Act. Their final wording, scope and commencement depend on the legislative process. In particular, the proposed erasure right should not be presented as an existing universal right to account deletion.
What software teams can do now
Start with an inventory: what personal information do you collect, where does it go, who can access it, and how long is it retained?
Review each collection field and integration with your privacy adviser. Build retention and deletion processes around applicable duties, legitimate retention needs and the actual behaviour of your storage, backups and third-party systems. Avoid promising instant deletion everywhere unless the system can deliver it.
Test incident response, access controls and recovery procedures. Keep a record of decisions and owners. Review privacy-policy disclosures against what the product actually does, including the forthcoming automated-decision transparency requirements where they apply.
Treat proposed reforms as planning inputs. Track their progress and seek advice before turning them into claims about current compliance duties.
If you would like help mapping privacy requirements to an existing product, book a discovery call.
