Australia’s privacy law changes in 2026 are real but incomplete. Some rules already apply. Two more start on 10 December 2026. The bigger package is still a draft Parliament has not passed. The gap means organisations can still collect more than many Australians expect, and a stock phone still reports home in the background.
The Office of the Australian Information Commissioner (OAIC) oversees the Privacy Act 1988 and the 13 Australian Privacy Principles. On 31 August 2026 the government released the Privacy Amendment (Personal Data Protection) Bill 2026 as a draft for comment. Consultation closed on 18 September 2026. As of 1 November 2026 the bill has not been introduced.
Parents and ordinary Australians can still cut what gets collected today without waiting for Parliament. Most everyday apps, banking, SMS and calls still work on a properly configured privacy phone.
Quick answer
The Privacy Act and Australian Privacy Principles already let you ask why information was collected, ask for a copy, ask for a correction, and complain to the OAIC. Covered organisations must respond. Health services are covered even when small. Many other businesses under $3 million turnover still sit outside the federal Act. State rules may still apply to them.
If a serious data breach is likely to harm you, the organisation must tell you and the OAIC. There is no 72-hour deadline in Australian law today. The draft would add one. It is not law yet.
Stronger OAIC powers and higher penalties have applied since 11 December 2024. A court path for a serious invasion of privacy has applied since 10 June 2025. The under-16 social media rule has applied since 10 December 2025. It delays accounts. It does not stop data collection on the phone itself.
Two items are already legislated and will start that day.
From 10 December 2026, organisations covered by the Privacy Act
must update their privacy policy when a computer program (including AI) makes or substantially helps make a decision that could significantly affect someone using their personal information. The policy must say what information is used and which decisions the system makes or heavily informs. This is a notice rule, not a ban. The OAIC published guidance on 30 September 2026.
The OAIC must also register a Children’s Online Privacy Code by that date. The code will set extra rules for services that target or are likely to be accessed by children. It builds on the current principles. It does not remove tracking from stock Android or iOS.
The Privacy Amendment (Personal Data Protection) Bill 2026 exposure draft proposes further changes. These include a fair-and-reasonable test for collection, use and disclosure; stronger consent standards; a right to erasure aimed at large digital platforms; a 72-hour notifiable data breach clock; a broader definition of personal information; and IDLock (a proposed myGov tool to help block or monitor licence or passport use in online verification).
None of these are law as of 1 November 2026. A future right to ask one platform to delete an account does not stop a normal phone sending data in the background, and it does not wipe records already held by data brokers or other organisations.
The OAIC 2026 community survey of 1,504 adults found that 93% say protecting personal information is important, 87% are more concerned than five years ago, and 78% feel they have little or no real control. 93% say using information collected for a service to train AI is not fair. 93% support a legal right to ask for deletion.
The practical result is simple. Rights that exist today are useful. Rights that start in December 2026 add notice. Draft rights may arrive later. None of them rewires the device that collects in the first place.
These steps reduce exposure while Parliament works.
Some already apply (court path for serious intentional or reckless invasion from 10 June 2025; under-16 social media account rule from 10 December 2025). From 10 December 2026 organisations must describe automated decisions in their privacy policy and the Children’s Online Privacy Code must be registered. Right to erasure, IDLock, the fair-and-reasonable test and the 72-hour breach clock remain draft.
Not as a general law against every organisation. The draft would give a limited right aimed at large digital platforms. Until it passes, close accounts you control and use the platform’s own delete tools. See how to delete personal data in Australia.
A proposed myGov tool to help block or monitor licence or passport use in online verification. It is not live. It targets identity theft, not app or phone data collection.
10 December 2026. Covered organisations must say in their privacy policy when a computer system, including AI, uses your information in a decision that significantly affects you. It is a notice rule, not a ban.
A draft requirement that collection, use and disclosure of personal information be fair, reasonable and lawful in the circumstances. It is not enforceable until the bill passes.
Yes for a serious invasion of privacy that was intentional or reckless, since 10 June 2025. For ordinary leaks or minor issues, write to the organisation first, then consider a written complaint to the OAIC.
No. It covers most government agencies, organisations with turnover above $3 million, every health service, and businesses that trade in personal information. Many smaller businesses sit outside the federal Act. State rules may still apply.
No. The reforms regulate how covered organisations handle information after it is collected. A Privacy Phone reduces what is sent in the first place.
The 2026 reforms give Australians more formal controls: a court path in serious cases, clearer notice when a computer or AI system helps make an important decision, and extra rules for children’s services. If the draft passes, a platform deletion right and IDLock may follow. None of that stops a default phone collecting.
Use the rights that already exist. Then reduce what the device gives away while Parliament works.
-> Discover free Privacy Tools
-> See Privacy Phones
[Last updated: 1 November 2026. Educational only].
