You have privacy rights in Australia in 2026. The Privacy Act 1988 and the 13 Australian Privacy Principles let you ask why information was collected, ask for a copy, ask for a correction, opt out of most direct marketing, and complain to the Office of the Australian Information Commissioner (OAIC). Since 10 June 2025 you can also take a serious invasion of privacy to court. Those rights do not stop a stock phone sending data to Google, Apple or Samsung, and they do not give you a general right to delete everything.
The gap is simple. You can use the law after something has gone wrong. You cannot use it to stop the phone in your pocket from reporting home in the first place.
Quick answer
It applies to most Australian Government agencies, private organisations with turnover above $3 million, every health service provider, and businesses that trade in personal information.
The small-business exemption under $3 million was not removed in the 2024 reforms. Health services are covered anyway. State and territory public-sector rules sit beside the federal Act.
Personal information means information or an opinion about an identified person, or someone who is reasonably identifiable. A name, email, phone number, location history, photo, device ID and many behavioural profiles qualify.
Australia does not give you a European-style “delete me everywhere” right. It does give you tools.
You can generally be told why information is collected and who it may go to. You can sometimes deal anonymously, where that is lawful and practical. You can ask for a copy, ask for a correction, and opt out of a lot of direct marketing. If a covered organisation mishandles your information, write to them first, then the OAIC.
Since 10 June 2025 you can also go to court for a serious invasion of privacy. 5 things have to be met:
For most problems, write to the organisation first and keep a copy. Then use oaic.gov.au. Get legal advice before you treat the court path as the first step. Practical deletion steps are in Delete Your Personal Data in Australia.
The Act can require a covered organisation to collect fairly, store securely, and tell you about an eligible breach. From 10 December 2026 it must also say when a computer system, including AI, is used in a significant decision about you. In serious cases it can support a court claim.
It does not stop a normal phone sending data to Google, Apple or Samsung. It does not stop trackers inside apps you already installed. It does not stop an AI system that has already learned from a file you uploaded. It does not give you a general erasure right against every shop, broker or app. It does not stop two-year telco metadata retention. It does not turn a long terms box into a real choice.
The OAIC’s 2026 community survey of 1,504 adults matches that gap. 93% say protecting personal information is important. 87% are more concerned than five years ago. 78% feel they have little or no real control. 93% say using information collected for a service to train AI is not fair. 93% support a legal right to ask for deletion.
Australians want control. Default technology is not built to give it.
Already in force: stronger OAIC powers from 11 December 2024, the court path for a serious invasion from 10 June 2025, and the under-16 social media rule from 10 December 2025.
From 10 December 2026: covered organisations must describe relevant automated decisions in their privacy policy. The OAIC must register a Children’s Online Privacy Code for many services children are likely to use.
Still draft: a limited right to ask large social media and search companies to destroy personal information, with news publishers exempt. IDLock on myGov for licence and passport checks. A fair-and-reasonable collection test. Extra rules on AI training and wearable cameras. The draft was released on 31 August 2026. Consultation closed 18 September 2026. As of 9 October 2026, Parliament has not passed it. . As of 1 November 2026 the bill has not been introduced.
Full detail is in Australia’s Privacy Law Changes in 2026.
Read the notice before you hand over a licence, a Medicare number or a passport scan. Close accounts you no longer use. After a breach notice, change the password, turn on an authenticator app, and check Equifax and Experian. Complain in writing if a covered organisation ignores you. See What to Do After a Data Breach for the full order.
Then, in order:
You don’t need every layer on day one. Most people get the largest drop from the accounts and the phone. The law is what you use after data has been mishandled. The phone is what you use so less data exists to mishandle.
The Privacy Act 1988 and the 13 Australian Privacy Principles. The OAIC oversees them.
Not as a general law against every organisation. You can delete accounts you control and ask covered organisations to destroy information they no longer need. A limited erasure right aimed at large platforms is still draft. See Delete Your Personal Data in Australia.
No. The Act regulates many organisations that handle personal information. It does not remove telemetry from a consumer operating system.
Covered organisations must say in their privacy policy when a computer system, including AI, helps make a significant decision about you. A Children’s Online Privacy Code must also be registered.
Yes. GrapheneOS is a legal operating system. You own the hardware.
You have real privacy rights in Australia in 2026. Use them when a covered organisation mishandles your information. They do not stop the phone in your pocket from reporting home.
Lock the accounts first. Then reduce what the device gives away at the source. That combination is what actually moves the needle.
-> See Privacy Phones
-> See Privacy Laptops
-> Discover free Privacy Tools
[Last updated: 1 November 2026. Educational only – not legal advice].
