Australia: Privacy Protection

Businesses that qualify as APP entities under the Privacy Act 1988 (Cth), generally those with annual turnover above $3 million or those handling health information or fulfilling Commonwealth contracts, must comply with the Australian Privacy Principles, including maintaining a privacy policy, issuing privacy collection notices and notifying the OAIC of eligible data breaches.

Australian privacy law is not standing still. In 2026, businesses face a wave of new compliance obligations: mandatory disclosure requirements for automated decision-making systems, a Children’s Online Privacy Code that reaches far beyond kids’ apps, and a landmark tribunal decision that redefines what ‘collection’ means for even the most fleeting data processing.

Japan, as Australia’s fourth-largest foreign investor, has agreed to strengthen bilateral collaboration with Australia, including in the growing technology sector. This will facilitate closer collaboration between the two countries on critical technologies, artificial intelligence, digital ecosystems, research and development and cybersecurity.

Purchasers should also consider the extent to which data and technology enables (or is integral to) the business.

Where collection of sensitive information represents a serious intrusion of privacy, businesses should conduct a formal, structured and documented risk assessment of the FRT system from the outset.

Re-evaluate commercial electronic messages & review the validity your marketing consents on an ongoing basis to avoid the risk of increased Spam Act enforcement.

This decision raises the compliance bar and provides concrete guidance on how APP 11.1 and the NDB scheme apply in real‑world incidents.

Where employees work remotely, the employer can lawfully monitor productivity if the surveillance complies with federal, state and territory legislation.

As a business owner, your treatment of customer's personal and sensitive information is extremely important.