The Privacy Act reforms are tightening data protection requirements for Australian businesses. Here is what you need to know and how to prepare your IT systems.
Australia’s Privacy Act 1988 has undergone its most significant reform in decades. Following the Optus and Medibank breaches that exposed tens of millions of Australians’ personal data, the federal government accelerated its review and introduced amendments that significantly increase both the obligations on businesses and the penalties for non-compliance.
For Melbourne SMBs, the question is not whether the Privacy Act applies to you — it is whether your current IT practices are consistent with your obligations under the reformed Act.
Does the Privacy Act Apply to Your Business?
The Privacy Act currently applies to:
- All private sector organisations with annual turnover exceeding $3 million
- All health service providers (regardless of turnover)
- All organisations that handle health information
- All organisations with government contracts
- Credit reporting bodies and credit providers
The 2024 reform proposals include expanding coverage to all private sector organisations — removing the $3 million turnover threshold entirely. If enacted, this will bring hundreds of thousands of additional Australian SMBs under direct Privacy Act obligations.
Even if your business is currently below the threshold, the direction of reform is clear. Building compliant practices now is prudent.
What the Reforms Change
Significantly Increased Penalties
The maximum penalties for serious or repeated privacy breaches increased from $2.22 million to the greater of:
- $50 million
- Three times the benefit obtained from the breach
- 30% of the entity’s domestic turnover in the relevant period
These penalties apply to serious or repeated breaches — not every minor compliance failure. But the scale change signals the government’s intent to make privacy compliance meaningful for large organisations.
For SMBs, the more relevant change is the increased penalty range for less serious breaches (up to $3 million for individuals, higher for organisations) and the OAIC’s expanded enforcement powers.
Direct Action Right
The reforms propose allowing individuals to bring direct actions against organisations for privacy breaches without needing to go through the OAIC. This creates a new litigation risk for businesses that have experienced breaches.
Strengthened Notifiable Data Breaches Scheme
The NDB scheme already requires notification to the OAIC and affected individuals when a breach is likely to cause serious harm. The reforms clarify and potentially expand notification obligations, and increase OAIC’s investigative powers to assess whether notifications were timely and complete.
Children’s Privacy
Enhanced protections for children’s personal information — higher standards apply when collecting, using, or disclosing information about individuals under 18. Businesses that interact with minors need to review their data collection practices.
The 13 Australian Privacy Principles: Your IT Obligations
The Australian Privacy Principles (APPs) are the operational requirements of the Privacy Act. Several have direct IT implications:
APP 1: Open and Transparent Management
You must have a clearly expressed, up-to-date privacy policy that covers what personal information you collect, how you use it, who you disclose it to, and how people can access and correct their information.
IT implication: Your website must have a current privacy policy. If you have a privacy policy from five years ago that does not reflect your current data practices, it needs updating.
APP 3: Collection of Solicited Personal Information
You should only collect personal information that is reasonably necessary for your functions or activities.
IT implication: Review your website forms, intake processes, and data collection workflows. Are you collecting information you do not use? Remove unnecessary fields.
APP 6: Use or Disclosure of Personal Information
You generally must only use or disclose personal information for the primary purpose for which it was collected.
IT implication: Using client email addresses for marketing when they were collected for service delivery may breach APP 6 without appropriate consent. Review your email marketing lists and consent records.
APP 8: Cross-Border Disclosure
Before disclosing personal information to an overseas recipient, you must take reasonable steps to ensure they handle it consistently with the APPs — or obtain the individual’s consent.
IT implication: Any cloud service that stores or processes Australian personal information outside Australia potentially triggers APP 8 obligations. Microsoft 365 with Australian data residency, AWS Sydney region, and similar choices provide Australian data residency for core data.
APP 11: Security of Personal Information
You must take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access.
IT implication: “Reasonable steps” in 2026 includes MFA, encryption at rest and in transit, access controls, patch management, and security monitoring. The Essential Eight Maturity Level 2 represents a reasonable benchmark for APP 11 compliance for most SMBs.
Practical Compliance Steps for Melbourne SMBs
1. Map Your Data
Identify what personal information your business holds, where it is stored, who has access, and how it is used. You cannot manage what you have not mapped.
2. Review Access Controls
Personal information should only be accessible to staff who need it for their role. Review SharePoint permissions, CRM access, and HR system access. Apply the principle of least privilege.
3. Implement Data Retention and Deletion
The Privacy Act requires that personal information be destroyed or de-identified when no longer needed for its primary purpose (with exceptions for legal and regulatory retention requirements). Define retention periods for different data categories and implement processes to delete or de-identify data that has passed its retention period.
4. Assess Your Cloud Providers
For each cloud service that holds personal information, understand: where is the data stored? What are the vendor’s data handling and breach notification practices? Are they covered by appropriate privacy certifications?
5. Prepare Your Breach Response
The NDB scheme requires notification within 72 hours of becoming aware of an eligible data breach. Have a documented breach response plan: who is responsible, what steps are taken, when legal and OAIC notification obligations are assessed.
6. Update Your Privacy Policy
Your privacy policy should accurately reflect your current data practices. If it is generic, outdated, or missing key disclosures, update it now rather than after a complaint triggers an OAIC review.
CX IT Services helps Melbourne businesses assess their privacy compliance posture and implement the IT controls required under the Privacy Act. Book a Right Fit Call to discuss your current compliance situation.
