Data, privacy and AI rules

Due in 60 days12Regulations190

12 due in 60 days · 190 regulations

Australia Privacy Act

Amended Australia · In force Dec 11, 2024 · next deadline Dec 10, 2026 (in 44 days)

Official text
Add to calendar
Apple Calendar or OutlookGoogle Calendar Download .ics

Deadlines

Coming up
ComplianceDec 10 · in 44 days · Source
Children's Online Privacy Code must be registeredOAIC must develop and register the Children's Online Privacy Code within 24 months of Royal Assent.
ComplianceDec 10 · in 44 days · Source
Automated decision-making transparency appliesPrivacy policies must disclose the kinds of personal information used in substantially automated decisions that significantly affect individuals (24 months after assent).
Already passed
Takes effectJun 10, 2025 · 17 months ago · Source
Statutory tort for serious invasions of privacy commencesIndividuals can sue for serious invasions of privacy (Schedule 2), 6 months after Royal Assent.
Takes effectDec 11, 2024 · 23 months ago · Source
Most POLA Act 2024 amendments commenceTiered penalties, infringement notices, OAIC powers, security and overseas-transfer clarifications and doxxing offences commence the day after Royal Assent.

Summaries for reference, not legal advice. Check the official text.

What it does

Australia's federal privacy law (13 Australian Privacy Principles, Notifiable Data Breaches scheme). The 2024 amendment adds a statutory tort for serious invasions of privacy, tiered civil penalties and infringement notices, a mandate for a Children's Online Privacy Code, clearer security duties, and privacy-policy transparency for substantially automated decisions from 10 December 2026. It also adds criminal doxxing offences.

Who it applies to
APP entities: Australian Government agencies and organizations with annual turnover above AUD 3 million, plus some smaller businesses (e.g. health service providers, data traders). The statutory tort applies to anyone, not only APP entities. The Children's Online Privacy Code will cover social media, relevant electronic and designated internet services likely to be accessed by children.
Penalties
Serious interference with privacy: for bodies corporate, the greater of AUD 50 million, 3x the benefit obtained, or 30% of adjusted turnover. New mid-tier civil penalty for interferences with privacy (up to AUD 3.3 million for bodies corporate) and infringement notices for administrative breaches. Statutory tort: court-awarded damages, with a cap on damages for non-economic loss.
Enforced by
Office of the Australian Information Commissioner (OAIC); courts (statutory tort)
Official name
Privacy Act 1988 (Cth), as amended by the Privacy and Other Legislation Amendment Act 2024
Citation
Privacy Act 1988 (Cth); Privacy and Other Legislation Amendment Act 2024 (No. 128, 2024)
Topics
Privacy, Children, Breach notification, AI
Verified 2026-09-22 oaic.gov.au legislation.gov.au ministers.ag.gov.au
Research notes

The OAIC released an exposure draft Privacy (Children's Online Privacy) Code 2026 for consultation from 31 Mar to 5 Jun 2026; it was not registered as of Aug 2026, and its commencement date for regulated entities is not yet set. 'Tranche 2' reforms (e.g. removing the small business exemption, a fair and reasonable test) are not yet legislated. The mid-tier and tort cap figures come from the Act and secondary summaries; check against the current indexed penalty unit value.

Related

In forceAustralia
Australia Cyber Security Act (ransomware reporting)Australia's first standalone cyber law: mandatory reporting of ransomware or cyber-extortion payments within 72 hours, security standards for consumer smart devices, 'limited use' protections for information shared with ASD and the National Cyber Security Coordinator, and a Cyber Incident Review Board. Ransomware payment reporting has applied since 30 May 2025.In effect since Nov 30, 2024
AmendedAustralia
Australia Online Safety ActSets up the eSafety Commissioner and removal schemes for cyber-bullying of children, adult cyber-abuse, non-consensual intimate images and abhorrent violent material. It also sets Basic Online Safety Expectations with reporting duties, and binding industry codes and standards. The Unlawful Material codes and standards cover class 1A and 1B material such as child sexual exploitation and pro-terror content. The Age-Restricted Material codes cover class 1C and class 2 material such as online pornography, and require age assurance and other measures to protect children.In effect since Jan 23, 2022
AmendedAustralia
Australia SOCI ActAustralia's critical infrastructure security law. Owners and operators of critical infrastructure assets must register ownership and operational information, and many must report cyber security incidents to the Australian Signals Directorate. Responsible entities for many asset classes must also keep a critical infrastructure risk management program. Systems of national significance face enhanced cyber security obligations, and the government has step-in and assistance powers.In effect since Jul 11, 2018
In forceAustralia
Australia Social Media Minimum AgeRequires providers of age-restricted social media platforms to take reasonable steps to stop Australians under 16 from having accounts. Platforms may not rely only on government ID for age assurance, and must protect data collected for age checks and destroy it after use. eSafety has named platforms including Facebook, Instagram, Snapchat, TikTok, X, YouTube, Reddit, Threads, Twitch and Kick.In effect since Dec 10, 2025
In forceChina
China AI Content Labeling MeasuresRequires generative AI service providers to add explicit (visible) labels to AI-generated text, images, audio, video and virtual scenes, and implicit labels (metadata) to generated files. Content distribution platforms must detect and label AI-generated content, and app stores must check labeling functions when apps are listed. A mandatory national standard (GB 45438-2025) takes effect on the same date.In effect since Sep 1, 2025
In forceChina
China Algorithmic Recommendation ProvisionsRegulates recommendation, ranking, personalization, generation and dispatch algorithms used in internet services in China. Users must be able to switch off personalized recommendations and manage tags, and providers may not use algorithms for price discrimination or to induce addiction. Providers with public opinion attributes or social mobilization capacity must file their algorithms with the CAC within 10 working days of launching a service.In effect since Mar 1, 2022
In forceChina
China Anthropomorphic AI MeasuresRegulates AI companion and emotional interaction services that simulate human personality. Providers must tell users they are talking to AI, remind users after every 2 hours of use, intervene in crises such as self-harm, offer easy exit, and may not offer virtual partner or relative services to minors. Users' interaction data may not be shared or used for training on sensitive data without consent, and services with 1 million registered or 100,000 monthly active users need a security assessment filed with the provincial CAC.In effect since Jul 15, 2026
In forceChina
China Cross-Border Data Flow ProvisionsRelaxes China's data export regime by exempting common transfers (contracts with the individual, cross-border HR, emergencies, and non-CII transfers of PI of fewer than 100,000 people a year) and setting volume thresholds for when a CAC security assessment, standard contract or certification is needed. Data is not 'important data' unless regulators have notified or published it as such.In effect since Mar 22, 2024
Questions about Australia Privacy Act
What are the Australia Privacy Act compliance deadlines?
Dec 11, 2024: Most POLA Act 2024 amendments commence. Jun 10, 2025: Statutory tort for serious invasions of privacy commences. Dec 10, 2026: Children's Online Privacy Code must be registered. Dec 10, 2026: Automated decision-making transparency applies.
When does Australia Privacy Act take effect?
Australia Privacy Act took effect on Dec 11, 2024. The next milestone is Dec 10, 2026: Children's Online Privacy Code must be registered.
Who does Australia Privacy Act apply to?
APP entities: Australian Government agencies and organizations with annual turnover above AUD 3 million, plus some smaller businesses (e.g. health service providers, data traders). The statutory tort applies to anyone, not only APP entities. The Children's Online Privacy Code will cover social media, relevant electronic and designated internet services likely to be accessed by children.
What are the penalties under Australia Privacy Act?
Serious interference with privacy: for bodies corporate, the greater of AUD 50 million, 3x the benefit obtained, or 30% of adjusted turnover. New mid-tier civil penalty for interferences with privacy (up to AUD 3.3 million for bodies corporate) and infringement notices for administrative breaches. Statutory tort: court-awarded damages, with a cap on damages for non-economic loss.