Australia: Data Protection

Western Australian local governments face new obligations under the Privacy and Responsible Information Sharing Act 2024, which introduces Information Privacy Principles and mandatory serious data-breach reporting. How should councils prepare their governance frameworks, policies, and incident-response capabilities to meet these requirements by the July 2026 and January 2027 deadlines?

The Australian Government's proposed digital duty of care reforms would extend online safety obligations far beyond social media platforms to encompass any business operating websites, digital platforms, or AI-enabled tools. Rather than simply responding to complaints, businesses would need to proactively identify foreseeable risks and implement safeguards, with substantial penalties for non-compliance reaching up to $109.2 million for companies. The exposure draft introduces a fundamental shift from reacti

The Australian Government's exposure draft proposes a proactive, systems-based digital duty of care for online service providers, requiring them to ensure a 'safe online environment' so far as reasonably practicable.

Australia's Privacy Act reform has reached a critical milestone with the release of exposure draft legislation proposing fundamental changes to how organisations handle personal information. The reforms introduce a new 'fair and reasonable' test for data collection and use, a right of erasure for large digital platforms, strengthened consent standards, a statutory controller/processor framework, restrictions on trading personal data, and enhanced data breach obligations. These changes come at a time when em

Australia's privacy framework is undergoing its most significant transformation in nearly four decades with the release of the Privacy Amendment (Personal Data Protection) Bill 2026. The Bill introduces a new "fair and reasonable" test for handling personal information, establishes a controller-processor framework, and creates a right of erasure for large digital platforms. Core definitions including personal information, sensitive information, consent, and de-identification are being comprehensively overha

Australia's privacy laws are undergoing significant reform, with new automated decision-making transparency requirements commencing in December 2026 and further substantial changes under consideration. Businesses must prepare for enhanced regulatory scrutiny, increased litigation risk through the new statutory tort for serious privacy invasions, and potential expansion of obligations to small businesses and employee records.

As electric vehicles and connected car technologies become increasingly prevalent in commercial and everyday use, they generate unprecedented volumes of data about driver behaviour, location patterns and personal activities. With approximately 80% of EVs sold in Australia manufactured in China, questions surrounding data privacy, cybersecurity vulnerabilities and potential surveillance risks are emerging as critical concerns for businesses and individuals alike. This analysis examines the complex intersecti

A Queensland tribunal has ruled that an anaesthetist who photographed patients and clinical records without consent and published them in a self-authored book committed professional misconduct. The case examines the boundaries of patient confidentiality in an era of accessible publishing platforms and social media, particularly in regional healthcare settings where contextual details can lead to patient identification.

Australia's existing technology-neutral legal frameworks readily apply to AI systems, yet AI procurement contracts remain critical tools for managing developer risk. From copyright exposure in training data to privacy compliance and regulatory change mechanisms, organisations commissioning bespoke AI solutions must address unique challenges across the development lifecycle through carefully structured contractual protections.