Privacy Act Reforms in June 2025: What Business Owners Need to Know (and Do)

From 10 June 2025, major reforms to the Privacy Act 1988 (Cth) have come into effect, introducing new legal obligations and raising the bar for how Australian businesses handle personal information.

These updates give individuals stronger privacy rights and expand the powers of regulators to investigate and penalise non-compliance. If your business collects, stores or shares personal data, now is the time to ensure your privacy practices meet the new standards.

The reforms reflect growing community expectations around data protection and transparency. Taking a proactive approach not only helps your business stay compliant, but also builds trust with clients and stakeholders.

What has changed?

Individuals can now sue for serious breaches of privacy: People can now take direct legal action against businesses or individuals if they seriously breach their privacy – even if it doesn’t involve the OAIC (Office of the Australian Information Commissioner). This means the risk of being sued for mishandling personal data has increased significantly.
Doxxing is a criminal offence: Publishing someone’s private information (like their address, phone number, or workplace) with the intent to cause harm is now a criminal offence. Even accidental involvement in doxxing-like behaviour, including sharing information via business platforms or social media, could put your business at risk.
The Office of the Australian Information Commissioner has stronger enforcement powers: The OAIC can now issue larger fines, conduct broader investigations, and hold businesses more accountable for privacy failures. If your business is non-compliant, you could face significant penalties.
Tougher standards for data security: Your obligation to take “reasonable steps” to protect customer and employee data has been raised. This means stronger cybersecurity, internal procedures, and staff training are now expected as standard. If you collect any personal data, you must actively safeguard it.
Faster reporting of data breaches: There is now greater emphasis on timely notification under the Notifiable Data Breaches (NDB) scheme. If you experience a data breach that could harm someone (e.g. identity theft, financial loss), you must notify both affected individuals and the OAIC promptly, or face tougher consequences.

What action is required?

To stay compliant under the new Privacy Act reforms, we recommend:

Reviewing your privacy policy to ensure it reflects current obligations (more on this below);
Auditing your data collection and storage practices;
Implementing stronger cybersecurity protections;
Training staff on privacy risks, doxxing laws, and breach response;
Reviewing contracts with suppliers and service providers who handle data;
Updating your Data Breach Response Plan; and
Consulting your legal advisor to get individual advice on how these changes specifically relate to you and your business.

Key items to review in your Privacy Policy:

To ensure your business’s privacy policy complies with the new requirements, you should undertake a comprehensive review of your policy. Key areas to address could include:

Enhanced Consent Requirements

Consent must now be voluntary, informed, current, specific, unambiguous and easily withdrawn.

Right to Erasure (“Right to Be Forgotten”)

Individuals should be informed of their right to request the deletion of their personal data when the data is no longer necessary for the purposes for which it was collected, consent has been withdrawn or if the data was unlawfully collected.

Transparency in Automated Decision-Making

Privacy policies must disclose the use of automated decision-making processes, the logic involved in these processes and any significance and potential consequences for individuals.

Note: These transparency obligations have a two-year grace period and you must implement them by 10 December 2026, but it’s always good to be on the front foot!

Overseas Data Transfers

If your business discloses personal information to overseas recipients, your privacy policy must identify the countries where recipients are located. You should also explain the measures taken to ensure these recipients comply with the Australian Privacy Principles (APPs and inform individuals of their rights concerning overseas disclosures.

Data Security Measures

Address the measures your business has implemented to protect personal information from misuse, interference, loss, unauthroised access, modification and disclosure.

Notifiable Data Breaches (NDB) Scheme

Your privacy policy should outline:

The procedures in place for detecting and responding to data breaches.
The process for notifying affected individuals and the OAIC when a breach is likely to result in serious harm.
Timeframes for notification and remedial actions.

Individual Rights

Inform individuals of their rights under the amended Privacy Act, including:

Accessing their personal information.
Correcting inaccuracies.
Requesting data deletion.
Objecting to certain data processing activities.
Lodging complaints with the OAIC.

Children’s Online Privacy

If you direct your services at children, prepare for the upcoming Children’s Online Privacy Code, which will require age-appropriate privacy notices, parental consent mechanisms and enhanced data protection measures for children’s information.

Note: While the code is to be developed by the OAIC and registered by 10 December 2026, it’s prudent to start aligning your practices now.

Need help navigating the changes?

Our Legal Team can support you with privacy compliance reviews and advice specific to your business operations.

If you’re unsure how the new laws apply to your business or want support reviewing your privacy practices, our legal team is here to help. Please get in touch with us by emailing legal@aintreegroup.com.au or reaching out to your Aintree Group Legal advisor directly.

This is general advice only and has not been prepared with your situation and needs in mind. For individual and personalised advice, we highly recommend that you seek out proper professional advice from your accountant and lawyer.