Australia is in the middle of a privacy overhaul. The first tranche of reforms in 2024 added a statutory privacy tort, higher penalties and automated-decision transparency that starts in December 2026. A second tranche is in draft. Meanwhile, Australia runs one of the world’s most active online safety regulators and, since December 2025, a minimum age of 16 for social media.
For most startups, compliance means meeting the Australian Privacy Principles (APPs), running a breach response that meets the Notifiable Data Breaches scheme, getting marketing consent right and avoiding misleading claims under the Australian Consumer Law.
- Core data law
- Privacy Act 1988 & Australian Privacy Principles
- Regulator
- Office of the Australian Information Commissioner (OAIC)
- Breaches
- Notifiable Data Breaches scheme
- Online safety
- eSafety Commissioner; under-16 social media minimum age
- Small business exemption
- Under A$3m turnover (with exceptions)
- Next deadline
- ADM transparency in privacy policies from 10 Dec 2026
Who needs to comply
Startups with A$3 million+ turnover, or handling health data, or trading in personal information
The Privacy Act applies to these ‘APP entities’; the small business exemption has important exceptions.
Foreign companies with an Australian link
The Act applies to organisations carrying on business in Australia that collect or hold personal information there.
Social media platforms
Age-restricted platforms must take reasonable steps to prevent under-16s from having accounts.
Apps using automated decisions
Privacy policies must disclose substantially automated decisions that significantly affect individuals from December 2026.
Any business marketing by email or SMS
The Spam Act 2003 requires consent, identification and an unsubscribe facility.
The laws, in detail
01Privacy Act 1988 & Australian Privacy Principles
Thirteen APPs on collection, use, disclosure, quality, security, access, correction and cross-border disclosure.
When it applies
APP entities, including businesses above A$3m turnover and certain smaller ones.
What you must do
- APP privacy policy and collection notices
- Use and disclosure only for primary or permitted secondary purposes
- Reasonable steps to secure personal information
- Accountability for overseas recipients (APP 8)
- Disclose automated decision-making in privacy policies (from Dec 2026)
Regulator
OAIC
Penalties
For serious interferences, the greater of A$50 million, three times the benefit, or 30% of adjusted turnover; new mid-tier and infringement penalties.
02Notifiable Data Breaches scheme
Assessment and notification of eligible data breaches.
When it applies
APP entities experiencing a breach likely to result in serious harm.
What you must do
- Assess suspected breaches within 30 days
- Notify the OAIC and affected individuals as soon as practicable
Regulator
OAIC
Penalties
Privacy Act penalties for non-compliance.
03Statutory tort for serious invasions of privacy
A right to sue for serious, intentional or reckless invasions of privacy.
When it applies
Intrusion upon seclusion or misuse of information, from 10 June 2025.
What you must do
- Avoid intrusive monitoring and misuse of private information
Regulator
Courts
Penalties
Damages and injunctions.
04Online Safety Act 2021 & social media minimum age
Removal of harmful content, industry codes and a minimum age of 16 for social media accounts.
When it applies
Social media, messaging, gaming and other online services available in Australia.
What you must do
- Respond to eSafety removal notices
- Comply with registered industry codes and standards
- Take reasonable steps to keep under-16s off age-restricted platforms
Regulator
eSafety Commissioner
Penalties
Civil penalties up to A$49.5 million for the minimum age obligation.
05Spam Act 2003
Commercial electronic messages.
When it applies
Sending marketing emails or SMS with an Australian link.
What you must do
- Consent
- Sender identification
- Functional unsubscribe within 5 working days
Regulator
ACMA
Penalties
Civil penalties and infringement notices.
06Australian Consumer Law & cyber reporting
Misleading conduct, unfair contract terms, and ransomware payment reporting.
When it applies
Trading with Australian consumers; businesses above A$3m turnover making ransomware payments.
What you must do
- Accurate AI, privacy and security claims
- Avoid unfair terms in standard-form contracts
- Report ransomware payments within 72 hours (Cyber Security Act 2024)
Regulator
ACCC; Department of Home Affairs
Penalties
Significant civil penalties under the ACL.
Compliance checklist
01 · Before you launch
- Decide whether you are an APP entity
- Write an APP privacy policy and collection notices
- Check cross-border disclosure under APP 8
- Spam Act consent and unsubscribe
02 · At launch
- Notifiable Data Breaches response plan
- Age assurance if you run a social platform
- Review marketing claims under the ACL
03 · As you scale
- Add ADM disclosures before 10 Dec 2026
- Track tranche 2 privacy reforms
- Ransomware payment reporting process
Key dates
- Dec 2024Privacy and Other Legislation Amendment Act 2024
- 30 May 2025Ransomware payment reporting
- 10 Jun 2025Statutory privacy tort commences
- 10 Dec 2025Social media minimum age (16)
- 10 Dec 2026Automated decision-making transparency
- Aug 2026Tranche 2 exposure draft released
Common mistakes
- Assuming the small business exemption applies without checking its exceptions.
- No plan for the 30-day breach assessment window.
- Ignoring age assurance on social features.
FAQs
Does the Privacy Act apply to a foreign startup?
It can, if the organisation carries on business in Australia and collects or holds personal information there.
Is there an Australian AI law?
Not a standalone one. AI is governed through privacy, consumer, online safety and sector laws, plus voluntary guardrails.
In the law library
Sources
Reviewed 12 October 2026. General information, simplified for planning; not legal advice. Check current law before relying on any requirement, and get advice for your facts. For markets outside India, advice is coordinated with locally qualified counsel.