Data, privacy and AI rules

Due in 60 days12Regulations190

12 due in 60 days · 190 regulations

Jurisdiction

Australia: data, AI and cyber laws

Part of APAC.

Regulations

Add to calendar
Apple Calendar or OutlookGoogle Calendar Download .ics
Amended
Australia Privacy ActAustralia's federal privacy law (13 Australian Privacy Principles, Notifiable Data Breaches scheme). The 2024 amendment adds a statutory tort for serious invasions of privacy, tiered civil penalties and infringement notices, a mandate for a Children's Online Privacy Code, clearer security duties, and privacy-policy transparency for substantially automated decisions from 10 December 2026. It also adds criminal doxxing offences.Next: Dec 10 Children's Online Privacy Code must be registered · in 44 days
In force
Australia Cyber Security Act (ransomware reporting)Australia's first standalone cyber law: mandatory reporting of ransomware or cyber-extortion payments within 72 hours, security standards for consumer smart devices, 'limited use' protections for information shared with ASD and the National Cyber Security Coordinator, and a Cyber Incident Review Board. Ransomware payment reporting has applied since 30 May 2025.In effect since Nov 30, 2024
Amended
Australia Online Safety ActSets up the eSafety Commissioner and removal schemes for cyber-bullying of children, adult cyber-abuse, non-consensual intimate images and abhorrent violent material. It also sets Basic Online Safety Expectations with reporting duties, and binding industry codes and standards. The Unlawful Material codes and standards cover class 1A and 1B material such as child sexual exploitation and pro-terror content. The Age-Restricted Material codes cover class 1C and class 2 material such as online pornography, and require age assurance and other measures to protect children.In effect since Jan 23, 2022
Amended
Australia SOCI ActAustralia's critical infrastructure security law. Owners and operators of critical infrastructure assets must register ownership and operational information, and many must report cyber security incidents to the Australian Signals Directorate. Responsible entities for many asset classes must also keep a critical infrastructure risk management program. Systems of national significance face enhanced cyber security obligations, and the government has step-in and assistance powers.In effect since Jul 11, 2018
In force
Australia Social Media Minimum AgeRequires providers of age-restricted social media platforms to take reasonable steps to stop Australians under 16 from having accounts. Platforms may not rely only on government ID for age assurance, and must protect data collected for age checks and destroy it after use. eSafety has named platforms including Facebook, Instagram, Snapchat, TikTok, X, YouTube, Reddit, Threads, Twitch and Kick.In effect since Dec 10, 2025

Upcoming deadlines

ComplianceDec 10 · in 44 days
Australia Privacy ActChildren's Online Privacy Code must be registeredOAIC must develop and register the Children's Online Privacy Code within 24 months of Royal Assent.Australia
ComplianceDec 10 · in 44 days
Australia Privacy ActAutomated decision-making transparency appliesPrivacy policies must disclose the kinds of personal information used in substantially automated decisions that significantly affect individuals (24 months after assent).Australia

Past deadlines

EnforcementSep 12 · 45 days ago
Australia Social Media Minimum AgeStrengthened enforcement amendments commenceThe Online Safety Amendment (Strengthening Enforcement for the Social Media Minimum Age) Act 2026 (No. 83, 2026) commences. The maximum civil penalty for platforms doubles from 30,000 to 60,000 penalty units, and eSafety gains new information-gathering powers.Australia
ComplianceMar 4 · 8 months ago
Australia Cyber Security Act (ransomware reporting)Smart device security standard appliesPart 2 and Schedule 1 of the Cyber Security (Security Standards for Smart Devices) Rules 2025 commence. Manufacturers and suppliers of relevant connectable products must meet the security standard.Australia
EnforcementJan 1 · 10 months ago
Australia Cyber Security Act (ransomware reporting)Ransomware reporting moves to compliance phaseThe education-first phase (30 May-31 Dec 2025) ends; Home Affairs moves to a compliance and education approach for missed reports.Australia
Takes effectDec 10, 2025 · 11 months ago
Australia Social Media Minimum AgeSocial media minimum age obligation appliesAge-restricted platforms must take reasonable steps to prevent under-16s from holding accounts.Australia
Takes effectJun 10, 2025 · 17 months ago
Australia Privacy ActStatutory tort for serious invasions of privacy commencesIndividuals can sue for serious invasions of privacy (Schedule 2), 6 months after Royal Assent.Australia
Takes effectMay 30, 2025 · 17 months ago
Australia Cyber Security Act (ransomware reporting)Ransomware payment reporting startsReporting business entities must report ransomware/cyber-extortion payments to ASD within 72 hours of payment.Australia
Takes effectDec 11, 2024 · 23 months ago
Australia Privacy ActMost POLA Act 2024 amendments commenceTiered penalties, infringement notices, OAIC powers, security and overseas-transfer clarifications and doxxing offences commence the day after Royal Assent.Australia
ComplianceTentativeJul 8, 2022 · 4.3 years ago
Australia SOCI ActMandatory cyber incident reporting starts for most assetsThe Application Rules registered on 7 April 2022 gave most asset classes a 3-month grace period before Part 2B incident reporting applied. The date is worked out from that grace period.Australia
Takes effectJan 23, 2022 · 4.8 years ago
Australia Online Safety ActOnline Safety Act commencesThe whole Act commences by Proclamation.Australia
Takes effectJul 11, 2018 · 8.3 years ago
Australia SOCI ActSOCI Act commencesThe whole Act commences by Proclamation.Australia