Australia: Data Protection

Australia's privacy law is undergoing significant reform, with new amendments requiring APP entities to provide greater transparency about automated decision-making systems that use personal information. From December 2026, businesses must disclose in their privacy policies how computer programs make decisions that could significantly affect individuals' rights or interests.

The Australian privacy regulator has fundamentally reframed how tracking pixels must be assessed under privacy law, particularly in sensitive contexts like healthcare. Recent enforcement actions reveal that common digital marketing tools can constitute the collection and disclosure of sensitive personal information, requiring explicit consent and robust governance frameworks that many organisations currently lack.

Australia's cyber security landscape continues to evolve rapidly with significant regulatory reforms, emerging threats, and technological developments. This monthly retrospect examines key developments including proposed SOCI Act amendments, the retirement of the Essential Eight framework, new AI model releases, and increased ransomware activity targeting Australian organizations.

Australia's Office of the Australian Information Commissioner is developing regulatory guidance on new automated decision-making transparency requirements under the Privacy Act.

EMIR reporting has transitioned to XML file structures with embedded XSD schema validation, introducing new complexity and potential error points. Understanding the nine most common XML validation errors—from incorrect element ordering to pattern constraint violations—is essential for maintaining smooth regulatory reporting processes and avoiding submission rejections.

Government agencies in New South Wales face mounting legal and regulatory challenges when deploying workplace surveillance technologies, from facial recognition systems to wearable devices and AI-driven digital...

Businesses should conduct regular stocktakes of their privacy risk exposure, and ensure their policies, controls, and systems are tailored appropriately to that level of risk.

The new statutory tort for serious invasion of privacy represents a significant change to the way that the Privacy Act 1988 (Cth) regulates privacy.

This decision raises the compliance bar and provides concrete guidance on how APP 11.1 and the NDB scheme apply in real‑world incidents.