Privacy Act amendments 2024: what changed for practices

Tranche 1 of the Privacy Act reforms brought infringement notices for privacy policy and opt-out failures, a privacy tort and new automated decision rules.

10 December 202411 min read

The Privacy and Other Legislation Amendment Act 2024 received assent on 10 December 2024, and most of its privacy changes commenced the next day, 11 December 2024. It was the first tranche of the Government’s Privacy Act reforms, and it changed how privacy breaches are enforced in a way that reaches small, everyday compliance issues, not only major data breaches.

For practices, the headline is simple. Since 11 December 2024 the OAIC can issue infringement notices for specific technical breaches, including privacy policy deficiencies and direct marketing opt-out failures, without going to court. Your privacy policy and your email and SMS unsubscribe processes have become things a regulator can fine you for directly.

What has happened since: the Act’s statutory tort for serious invasions of privacy commenced on 10 June 2025 (see our article on the statutory privacy tort). Its automated decision-making transparency rules start on 10 December 2026. On 31 August 2026 the Government released an exposure draft of a second tranche of reforms, the Privacy Amendment (Personal Data Protection) Bill 2026, which is not law (see our article on the tranche 2 exposure draft).

What changed

The Act is No. 128 of 2024. According to the OAIC it passed Parliament on 29 November 2024. It has three Schedules: Schedule 1 (privacy reforms in 15 Parts), Schedule 2 (a statutory tort for serious invasions of privacy) and Schedule 3 (doxxing offences in the Criminal Code).

Commencement dates

11 December 2024: Schedule 1, Parts 1 to 14 (objects, APP codes, emergency declarations, children’s privacy, security, overseas data flows, data breaches, penalties, court orders, public inquiries, determinations, annual reports, external dispute resolution, and monitoring and investigation), and Schedule 3 (doxxing offences).
10 June 2025: Schedule 2, the statutory tort. The Act provided for commencement by proclamation or, failing that, six months after assent. The OAIC states the tort commenced on 10 June 2025.
10 December 2026: Schedule 1, Part 15, automated decisions and privacy policies.

Who it applies to

The Schedule 1 changes apply to APP entities. The OAIC states that the Privacy Act covers any business that is a health service provider regardless of turnover, so the small business exemption does not help a practice that provides a health service and holds health information. That covers general practice, specialists, dental, allied health, psychology, cosmetic clinics and telehealth, at any size.

The statutory tort in Schedule 2 is broader again. It is not limited to APP entities and can apply to individuals and other organisations.

What the rules require

A three-tier penalty system

The Act restructured civil penalties into tiers. The changes apply to acts and practices after commencement.

Serious interferences (section 13G). The maximum for a body corporate remains the greatest of $50 million, three times the benefit obtained, or 30% of adjusted turnover in the breach turnover period. The Act now lists factors a court may consider in deciding whether an interference is serious, including the kinds of information involved, the sensitivity of the information, the consequences for the individual, the number of people affected, whether a child or person experiencing vulnerability is affected, whether the conduct was repeated or continuous, and whether the entity failed to implement practices, procedures and systems to comply with its privacy obligations.
Interferences with privacy (new section 13H). Any interference with the privacy of an individual is now a civil penalty provision, with a maximum of 2,000 penalty units. If a court is not satisfied an interference was serious, it can make an order under section 13H instead.
Specified APP breaches (new section 13K). Breaches of particular APPs are civil penalty provisions with a maximum of 200 penalty units, and they can be dealt with by infringement notices or compliance notices.

Penalty units are a Commonwealth unit of value whose dollar amount is set under Commonwealth law and changes over time, so check the current value when you calculate an amount.

The APPs in the infringement notice tier

Section 13K lists these provisions:

APP 1.3: having an APP privacy policy.
APP 1.4: the required contents of the privacy policy.
APP 2.1: giving individuals the option not to identify themselves, or to use a pseudonym, when dealing with you.
APP 6.5: written notice of certain uses or disclosures.
APP 7.2(c) and 7.3(c): a simple means for individuals to opt out of direct marketing.
APP 7.3(d): drawing attention to the ability to opt out of direct marketing.
APP 7.7(a) and 7.7(b): giving effect to an opt-out request within a reasonable period, and telling the individual the source of their information when asked.
APP 13.5: dealing with requests to correct personal information.
Any other APP prescribed by regulations, and, from 10 December 2026, APP 1.7 (automated decisions in the privacy policy).

A non-compliant statement about an eligible data breach is also in this tier.

Infringement notices and compliance notices

The Commissioner, or a senior OAIC staff member, can issue an infringement notice for an alleged section 13K contravention. For a listed corporation, the amount is 200 penalty units per alleged contravention. The Act also created compliance notices (section 80UC). A compliance notice sets out the contravention and the action you must take, or stop taking, within a reasonable period. Failing to comply with a compliance notice carries its own civil penalty of up to 200 penalty units. You can apply to the Federal Court or the Federal Circuit and Family Court for review of a compliance notice.

Court orders for affected individuals

New section 80UA lets the court, in civil penalty proceedings, make orders such as directing the entity to redress loss or damage, pay compensation to individuals, stop or change a practice, or publish a statement about the contravention. Individuals or the Commissioner can apply within six years of the contravention.

Security, overseas transfers and data breaches

APP 11.3. The reasonable steps required to protect personal information, and to destroy or de-identify it, expressly include technical and organisational measures.
APP 8.3. A mechanism for prescribing countries or binding schemes whose protections are at least substantially similar to the APPs, to make some overseas disclosures simpler.
Eligible data breach declarations. The Minister can make a declaration after an eligible data breach to allow specified entities to handle specified personal information for purposes directly related to reducing harm.

Regulator powers

The Act gave the Commissioner monitoring and investigation powers under the Regulatory Powers Act framework, the ability to conduct public inquiries when directed or approved by the Minister, and expanded determinations so they can require steps to prevent or reduce reasonably foreseeable loss or damage.

Children’s Online Privacy Code

The Commissioner must develop and register a Children’s Online Privacy Code within 24 months of assent. The Act applies the code to providers of social media services, relevant electronic services or designated internet services likely to be accessed by children, but that category excludes an entity providing a health service. Other entities can be brought in by the code itself.

Automated decisions (from 10 December 2026)

New APPs 1.7 to 1.9 require your privacy policy to explain where a computer program uses personal information to make, or do something substantially and directly related to making, a decision that could reasonably be expected to significantly affect an individual’s rights or interests. The policy must describe the kinds of personal information used and the kinds of decisions made solely by computer programs or with their substantial assistance. Refusing or failing to decide counts as a decision, and effects can be beneficial or adverse. The Act gives examples, including decisions affecting rights under a contract and decisions affecting access to a significant service or support.

Statutory tort and doxxing offences

Schedule 2 created a right to sue for serious invasions of privacy, covered in our separate article. Schedule 3 created Criminal Code offences for using a carriage service to publish personal data in a way reasonable people would regard as menacing or harassing, with maximum penalties of 6 years’ imprisonment, or 7 years where a group is targeted because of attributes such as race, religion or disability.

What it means for your marketing

Website and privacy policy

Your privacy policy is now directly enforceable through infringement notices if it is missing or does not contain the required matters. Many practice websites run a template policy written years ago that does not mention the enquiry forms, booking tools, analytics, advertising pixels or email platforms the site now uses. Review it against what your website and marketing actually do, and update it whenever you add a tool.

APP 2.1 is also worth a look. Where it is lawful and practicable, people should be able to deal with you anonymously or under a pseudonym. A general “ask a question” form that makes full name, date of birth and Medicare number mandatory may not fit that principle.

Email and SMS

The opt-out provisions of APP 7 are in the infringement tier. Every marketing email or SMS should have a simple, working opt-out that is clearly drawn to the reader’s attention, and opt-outs should be actioned within a reasonable period across every list and platform. If someone asks where you got their details, you need to be able to tell them. Commercial email and SMS are also governed by the Spam Act 2003, which has its own consent and unsubscribe rules.

Paid ads and retargeting

Targeted online advertising that uses personal information is direct marketing for APP 7 purposes, according to OAIC guidance on tracking pixels. If you retarget website visitors, you need a simple way for people to opt out, and you must not use sensitive information, including health information, for direct marketing without consent. Because section 13G now names sensitivity and vulnerability as seriousness factors, health-related targeting carries more risk than most industries.

Automation and AI tools

Look at any tool that makes decisions about patients without a person in the loop: automated triage, eligibility screening, payment plan approvals, or booking priority. If a decision could significantly affect someone’s rights or interests, the privacy policy will need to describe it from 10 December 2026. Whether routine marketing automation such as email segmentation meets that threshold is not settled, so take advice if you are unsure.

Agencies and vendors

The new APP 11.3 wording, technical and organisational measures, applies to the information your agency or developer can reach. Access controls, two-factor authentication, removing old logins and knowing which plugins and scripts are installed are all part of reasonable steps.

Common mistakes we see

A privacy policy that predates the current website and does not mention analytics, pixels, chat tools or email platforms.
Unsubscribe links that work for one list but not others, or that are removed from “newsletter” emails because they are seen as information rather than marketing.
Opt-outs actioned in the email platform but not in the SMS platform or the practice management recall list.
Enquiry forms with every field mandatory, even for a general question.
No record of where marketing contacts came from.
Assuming the infringement notice tier is only for large companies. It applies to APP entities, including health service providers of any size.

A practical checklist

Compare your privacy policy against APP 1.4 and against every tool your website and marketing use.
Name the kinds of third parties you share data with through marketing tools, and say whether information goes overseas.
Test the opt-out on every email and SMS template.
Make sure an opt-out in one system is applied to all marketing lists.
Record the source of every marketing contact so you can answer an APP 7.7(b) request.
Review mandatory fields on website forms and remove those you do not need.
Write down your process for handling correction requests under APP 13.
List any automated decision tools and assess them against APP 1.7 before 10 December 2026.
Check that agency and contractor access to your systems is current and protected by two-factor authentication.

How this fits with other rules

These changes sit alongside your advertising obligations under the National Law and Ahpra’s guidelines, and the Australian Consumer Law. The Privacy Act does not govern what your advertising claims; it governs how you use personal information to deliver it. Email and SMS also need to satisfy the Spam Act, and telemarketing the Do Not Call Register Act. The OAIC notes that APP 7 does not apply to direct marketing communications covered by those two Acts, so check which regime applies to each channel you use.

Frequently asked questions

Can the OAIC fine my practice without going to court now?

For the contraventions listed in section 13K, such as privacy policy content and direct marketing opt-outs, the OAIC can issue an infringement notice or a compliance notice. More serious matters still go to court as civil penalty proceedings.

When did these changes start?

Most of Schedule 1 and the doxxing offences commenced on 11 December 2024. The statutory tort commenced on 10 June 2025. The automated decisions rules commence on 10 December 2026.

Does the Children’s Online Privacy Code apply to my practice?

The Act’s default category for the code excludes entities providing a health service. The code itself can specify additional entities, so check the registered code once it is finalised.

Do I need to mention automated decisions in my privacy policy?

Only if a computer program uses personal information to make, or substantially assist with, decisions that could reasonably be expected to significantly affect an individual’s rights or interests. The requirement applies from 10 December 2026.

Did tranche 1 remove the small business exemption?

No. But health service providers were already covered by the Privacy Act regardless of turnover, so the exemption does not apply to a practice that provides a health service and holds health information.

Need a hand?

A privacy policy that matches what your website really does, and opt-outs that work everywhere, are two of the simplest risks to fix. Our compliance audit reviews your website, forms and marketing data flows, and our patient email marketing service builds opt-out handling into every send. For teams who want to manage this in-house, we also offer compliance training.

This article is general guidance based on the published rules, not legal advice. Final responsibility for how your marketing handles personal information sits with your practice, and complex situations may need independent legal or privacy advice.