Privacy Act Reforms: What Australian Organisations Need to Know

What's Already In Force

Two changes matter right now, not eventually.

The statutory tort for serious invasions of privacy has applied since 10 June 2025. It gives any individual the right to sue directly for a serious invasion of privacy - through intrusion on their seclusion or misuse of their private information - without going through the OAIC first. Critically, this right doesn't depend on whether your organisation is formally covered by the Privacy Act. Exemption status offers no shelter from this particular exposure.

The AML/CTF "Tranche 2" expansion took effect on 1 July 2026, bringing real estate agents, lawyers, accountants, conveyancers, trust and company service providers, and dealers in precious metals and stones under the Act for the first time - regardless of their turnover. If your organisation sits in one of these sectors, the small business exemption no longer helps you, however large or small you are.

What's Proposed, Not Yet Law

The change generating the most conversation - full removal of the long-standing exemption for businesses with turnover under $3 million - has not been legislated as of the date of this article. The government agreed "in principle" to remove it following the 2023 Privacy Act Review, and the OAIC has said publicly it no longer sees the exemption as appropriate given the privacy risks smaller entities can pose. But no commencement date has been confirmed, and some marketing content circulating online states a specific date with more confidence than the legislation currently supports. Treat any firm date you see for general exemption removal with caution until it's actually before Parliament.

The same "agreed but not yet enacted" status applies to a proposed right to erasure and a "fair and reasonable" test for handling personal information - both flagged as likely in a future tranche of reform.

Why Waiting for the Fine Print Is a Risky Strategy

Even without a confirmed repeal date, the direction of travel is unmistakable, and the practical exposure is already building from multiple directions:

• The statutory tort already lets individuals bypass the exemption entirely.
• Tranche 2 has already pulled entire sectors into scope regardless of size.
• Maximum penalties for corporate breaches now reach $50 million, three times the benefit obtained, or 30% of adjusted domestic turnover - whichever is greatest.
• The OAIC has been explicit about where it thinks the exemption should go.

An organisation that waits for the formal repeal before starting to build a privacy program is choosing to do the work under pressure, on someone else's timeline, instead of on its own.

Who Should Be Paying Attention Now

• SMEs currently relying on the $3 million turnover exemption
• Not-for-profits and schools handling donor, family, or student data
• Public sector suppliers and contractors under Commonwealth agreements (a separate existing carve-out already removes their exemption)
• Real estate, legal, accounting, conveyancing, trust and company service, and precious metals businesses newly caught by Tranche 2
• Any organisation, of any size, whose activities could expose it to a statutory tort claim

A Practical Readiness Checklist

1. Map what personal information you actually collect, from whom, and why
2. Write or update a privacy policy that addresses all 13 Australian Privacy Principles, not a generic template
3. Document a data breach response process aligned to the Notifiable Data Breaches scheme
4. Review contracts with any third party that processes personal data on your behalf, including offshore providers
5. Assign clear ownership for privacy obligations, rather than leaving them to "whoever has time"
6. Keep a record of what you've done and when - regulators and litigants both expect evidence, not intent

How Pali GRC Helps

The recurring theme across every one of these reforms is that being compliant and being able to prove it are two different things. Pali's Obligations Register lets you track privacy obligations as they change, assign ownership, and attach the evidence an auditor or regulator would actually ask for - rather than reconstructing it after the fact. Paired with Pali's Document Management module and the Law Compliance legislative feed, your privacy obligations stay current without someone having to monitor Parliament for you.

Learn more about the Obligations Register

Frequently Asked Questions

Has the small business exemption under the Privacy Act been removed?

No. As at the date of this article, the $3 million turnover exemption remains in force. Removal has government in-principle support and OAIC backing, but no legislated commencement date has been set.

Does the statutory tort apply to businesses that are exempt from the Privacy Act?

Yes. The statutory tort for serious invasions of privacy, in force since 10 June 2025, applies regardless of whether an organisation is otherwise covered by the Privacy Act.

Which businesses lost their exemption on 1 July 2026?

Real estate agents, lawyers, accountants, conveyancers, trust and company service providers, and dealers in precious metals and stones came under the Privacy Act through AML/CTF Tranche 2 reforms, regardless of turnover.

What are the maximum penalties for a serious privacy breach?

For a body corporate, the greater of $50 million, three times the benefit obtained from the breach, or 30% of adjusted domestic turnover during the breach period.

If my business is still exempt, do I need to do anything yet?

Given the direction of reform and the exposure already created by the statutory tort and Tranche 2, building basic privacy practices now - a real privacy policy, a breach response plan, clear data handling records - is far easier than doing it under a compliance deadline later.

How can a GRC platform help with privacy compliance specifically?

A GRC platform like Pali centralises your privacy obligations, tracks changes as legislation moves, assigns accountability, and stores the evidence you'd need to demonstrate compliance - turning a moving regulatory target into a manageable, auditable process.

If your organisation needs to track privacy obligations as they change, assign ownership, and keep the evidence an auditor or regulator would actually ask for, Pali GRC's Obligations Register is built for that work - included as standard, with legislative updates via the Law Compliance feed.

Contact us today to arrange a conversation about your needs, see the platform in action, and understand how our approach might fit your organisation.

This information is correct to the best of our knowledge at the time of publication. Readers should do their own research and should not rely on it for legal advice.