Data protection
The Privacy Act applies to federal agencies and to businesses above a turnover threshold, and is built around thirteen Australian Privacy Principles. The Notifiable Data Breaches scheme requires notification of eligible breaches. Reforms passed in 2024 created a statutory tort for serious invasions of privacy and increased enforcement powers.
Key points
| Access and correction | APP 12 and 13, generally within 30 days |
|---|---|
| Small business exemption | Businesses under the turnover threshold are largely exempt — a long-criticised gap |
| Breach notification | Mandatory for eligible data breaches, to the OAIC and affected individuals |
| Sensitive information | Health, sexual orientation and sexual practices require consent |
| Statutory tort | Serious invasions of privacy actionable following the 2024 reforms |
| Children | A Children's Online Privacy Code is being developed |
| Regulator | Office of the Australian Information Commissioner |
| Notifiable breaches | Must be reported to the regulator and to affected individuals |
| Determinations | The Commissioner can award compensation, including for non-economic loss |
| Credit reporting | A separate, detailed part of the Act with its own complaint route |
In practice
- Complain to the organisation and allow 30 days before approaching the Commissioner.
- For credit file errors, use the credit reporting provisions — they have shorter deadlines.
Cost and coverage
Free complaints to the OAIC; the new tort allows damages claims in court.
Recent changes
The 2024 package was the first substantial modernisation of the Privacy Act in decades, and further tranches of reform have been foreshadowed.
Where to go
- Office of the Australian Information Commissioner.
- State privacy commissioners for state agencies.
- IDCARE for identity and cyber support.
Worth knowing
The small business exemption means many everyday services are not covered at all. Check whether the organisation is actually subject to the Act before building a complaint around it. Unlike many regulators, the Australian Commissioner can award compensation directly, including for distress. That makes the complaint route worth using.
The general article: Data protection · Compare with another country
Privacy
The Privacy Act 1988 and the thirteen Australian Privacy Principles govern the handling of personal information by federal agencies and by businesses above the turnover threshold. The 2024 reform introduced a statutory tort of serious invasion of privacy, which commenced in 2025 and gives individuals a direct cause of action for intrusion into seclusion or misuse of information.
Key points
| Statute | Privacy Act 1988 and the thirteen Australian Privacy Principles |
|---|---|
| Small business | Many small businesses are still exempt, a long-criticised gap |
| Regulator | Office of the Australian Information Commissioner, free to complain to |
| Statutory tort | Serious invasion of privacy, available since 2025, damages without proof of financial loss |
| Data breaches | Notifiable Data Breaches scheme: notify the regulator and affected individuals |
| Online abuse | eSafety Commissioner can order removal |
| Two limbs | The new tort covers intrusion into seclusion and misuse of private information |
| Serious invasion | The invasion must be serious and intentional or reckless; negligence is not enough |
| Public interest | Balanced against the privacy interest as part of the cause of action |
In practice
- Document the seriousness of the impact: the threshold is a key element, not an afterthought.
Cost and coverage
The statutory tort of serious invasion of privacy, introduced by the 2024 reform, is the biggest change to Australian privacy law in decades: for the first time an individual can sue directly.
Where to go
- Office of the Australian Information Commissioner.
- eSafety Commissioner for online abuse.
- State or territory legal aid.
Worth knowing
Complain to the organisation first: the Commissioner will normally not take a complaint until the organisation has had thirty days to respond. The statutory tort requires intent or recklessness. Accidental disclosure, however damaging, falls outside it and must be pursued under the Privacy Act.
Image rights
The eSafety Commissioner can order removal and fine those who refuse — an administrative route with no court needed.
The Online Safety Act 2021 gives the eSafety Commissioner an image-based abuse scheme: a person whose intimate image has been shared without consent can complain and the Commissioner can issue removal notices to the person who posted it and to the platform, backed by civil penalties. Criminal offences exist at Commonwealth and state level in parallel.
Key points
| Regulator | eSafety Commissioner, free complaints, no lawyer needed |
|---|---|
| Removal notices | To the poster and to the service, with civil penalties for non-compliance |
| Deadline | Services are expected to act within 24 hours of a notice |
| Criminal law | Commonwealth offence of using a carriage service to menace or harass, plus state offences |
| Public photography | Generally lawful; there is no general image right |
| Deepfakes | Sexually explicit deepfakes are covered by recent Commonwealth reform |
| Civil penalties | Apply to individuals as well as services that ignore a removal notice |
| No court needed | The Commissioner acts administratively |
| Threats | Threatening to share an intimate image is also covered |
In practice
- Report to eSafety with links and screenshots; they contact the platform directly.
Where to go
- eSafety Commissioner, esafety.gov.au.
- State police.
- Community legal centres.
Worth knowing
The eSafety scheme is the most effective tool available in Australia and it is free: use it before considering any court action. The eSafety scheme reaches overseas platforms and has a high compliance rate. It costs nothing and does not require legal representation.
The general article: Image rights · Compare with another country
Speech and online harassment
A serious harm threshold since 2021, a powerful eSafety Commissioner, and courts that have held page owners liable for comments.
Uniform defamation law was reformed in 2021 to introduce a serious harm element and a public interest defence. Australia is unusual in having a statutory eSafety Commissioner with power to order removal of cyberbullying material, image-based abuse and seriously harmful adult cyber-abuse.
Key points
| Serious harm | Required since the 2021 reforms |
|---|---|
| Public interest defence | Introduced in 2021, modelled on the UK |
| Concerns notice | Mandatory pre-action step before suing |
| eSafety Commissioner | Can order removal within 24 hours for image-based abuse and cyberbullying, and fine non-compliant services |
| Adult cyber-abuse | Separate scheme under the Online Safety Act 2021 |
| Publisher liability | Courts have held page administrators responsible for third-party comments, prompting further reform |
| Limitation | One year from publication |
| Online Safety Act | The eSafety Commissioner can order removal of seriously harmful content |
In practice
- Serve a concerns notice first; proceedings issued without one will be stayed.
- Use the eSafety Commissioner for adult cyber abuse: it is free and quicker than court.
Cost and coverage
eSafety complaints are free and fast; defamation litigation is costly.
Recent changes
The eSafety scheme is one of the few in the world where an individual can obtain a binding removal order without going to court.
Where to go
- eSafety Commissioner — reporting portal for image-based abuse, cyberbullying and adult cyber-abuse.
- Police for threats and stalking.
- Legal aid and community legal centres for defamation advice.
Worth knowing
Report to eSafety before considering legal action. Removal orders are usually obtained within days, and the evidence gathered supports any later claim. The concerns notice is now compulsory. It must set out the imputations and give the publisher a period to make an offer to make amends.
The general article: Speech and online harassment · Compare with another country
Copyright
Fair dealing with five listed purposes, life plus seventy years, and no fair use despite repeated review recommendations.
The Copyright Act 1968 protects works for the author's life plus seventy years. Australia has fair dealing, limited to research or study, criticism or review, parody or satire, reporting news, and professional legal advice. Successive law reform inquiries have recommended adopting fair use; Parliament has not done so, but a flexible exception for libraries, archives and education was added in 2017.
Key points
| Statute | Copyright Act 1968 |
|---|---|
| Term | Life plus 70 years |
| Fair dealing | Five listed purposes, including parody or satire |
| No fair use | Recommended by review bodies but not enacted |
| Format shifting | Limited private copying exceptions exist for certain formats |
| Safe harbour | Extended in 2018 to libraries, archives, educational and cultural institutions |
| Flexible exception | Added in 2017 for libraries, archives and education |
| Site blocking | Courts can order access to infringing sites to be blocked |
In practice
- Do not rely on American fair use guidance: Australia's list of purposes is closed.
Where to go
- IP Australia and the Attorney-General's Department.
- Copyright Agency, APRA AMCOS, Screenrights.
- Australian Copyright Council information sheets, free.
Worth knowing
Because the list of purposes is closed, a use that would clearly be fair use in the United States can still infringe in Australia. Do not rely on American guidance. Successive reviews have recommended fair use and Parliament has declined. Anything outside the five purposes infringes, however reasonable it seems.
The general article: Copyright · Compare with another country
Identity theft
IDCARE provides free case management, and a Commonwealth Victims' Certificate gives you a court document proving you were a victim.
Identity crime offences exist at Commonwealth and state level. What is distinctive is the support infrastructure: IDCARE is a national not-for-profit providing free, individualised response plans, and victims of Commonwealth identity crime can apply to a magistrate for a Victims' Certificate — an official document that helps in reestablishing credit and clearing records. Credit bans can be placed with the three credit bureaus.
Key points
| Offences | Commonwealth Criminal Code identity crime offences, plus state offences |
|---|---|
| IDCARE | Free national identity and cyber support service |
| Victims' Certificate | Applied for from a magistrate; officially recognises you as a victim |
| Credit bans | 21 days initially with Equifax, Experian and illion, extendable |
| Reporting | ReportCyber, the national online police reporting portal |
| Documents | State registries can flag or reissue compromised documents |
| Free credit reports | Available from all three bureaus, with more frequent access after fraud |
| Document flags | State registries can flag a compromised licence or certificate |
| myGov | Check for unauthorised linked services |
In practice
- Contact IDCARE first: the response plan tells you exactly which organisations to contact and in what order.
- Place a credit ban with all three bureaus; it is free.
- Report through ReportCyber and keep the reference.
- Ask your state registry about flagging a compromised licence or birth certificate.
- Check myGov for services linked without your knowledge, and change the sign-in method.
Where to go
- IDCARE, free national service.
- ReportCyber, cyber.gov.au.
- Scamwatch, run by the ACCC.
Worth knowing
Credit bans last 21 days by default. Diarise the expiry and extend it, otherwise the protection quietly lapses. The Commonwealth Victims' Certificate is a court document confirming you were a victim. It carries far more weight with creditors than a police report.
The general article: Identity theft · Compare with another country
Online shopping
No cooling-off period, but the Australian Consumer Law gives strong automatic guarantees that cannot be excluded.
The Australian Consumer Law applies nationally. Goods must be of acceptable quality, fit for purpose and match their description; services must be provided with due care and skill. Where the failure is major, the consumer chooses between a refund, replacement or compensation — and no shop policy can override these guarantees.
Key points
| Cooling-off | No general right; change-of-mind returns are a shop policy |
|---|---|
| Consumer guarantees | Automatic and cannot be excluded by contract |
| Major failure | Consumer chooses refund, replacement or compensation |
| Minor failure | Business may choose to repair, replace or refund |
| No receipt | Any proof of purchase suffices, including a bank statement |
| Overseas sellers | The law applies to businesses supplying into Australia |
| Unfair contract terms | Prohibited, with penalties since 2023 |
| No cooling-off online | There is no general right to change your mind |
In practice
- Cite the consumer guarantees rather than the warranty: they apply regardless of what the receipt says.
- For a major failure, state clearly that you choose a refund — the choice is yours, not the trader's.
Cost and coverage
Complaints to state fair trading offices are free; tribunals charge small fees.
Recent changes
Penalties for unfair contract terms came into force in 2023, making previously unenforceable terms directly unlawful.
Where to go
- State and territory fair trading or consumer affairs offices.
- Australian Competition and Consumer Commission for systemic issues.
- State civil and administrative tribunals for claims.
Worth knowing
Signs saying 'no refunds' are unlawful in Australia. Consumer guarantees apply regardless of what a store's policy says, and a business cannot contract out of them. No sign saying no refunds has any legal effect. Consumer guarantees are statutory and cannot be excluded, limited or modified.
The general article: Online shopping · Compare with another country
Romance scams
A national anti-scam centre, and a statutory framework placing duties on banks, telecoms and platforms.
Reports go to the national anti-scam centre through Scamwatch, and to the police cybercrime portal for criminal matters. A scams prevention framework imposes enforceable obligations on banks, telecommunications providers and digital platforms to prevent, detect and disrupt scams, with penalties for failure. Banks operate a fraud reporting line reachable at any hour, and suspicious texts are forwarded free to a national short code.
Key points
| Reporting | Scamwatch, run by the national anti-scam centre |
|---|---|
| Criminal reporting | National police cybercrime portal |
| Statutory duties | Banks, telecoms and platforms have enforceable anti-scam obligations |
| Bank fraud lines | Available at any hour, by law |
| Suspicious texts | Forward free to the national short code |
| Financial complaints | Free, binding external dispute resolution scheme |
| Cryptocurrency | Effectively unrecoverable |
In practice
- Report to Scamwatch and to the police portal: they serve different purposes.
- If the bank refuses, escalate free of charge to the financial complaints authority, which can make binding decisions.
- Cite the statutory obligations when complaining: banks now have defined duties, not just goodwill.
- Ask the bank in writing whether it met its own anti-scam obligations — the answer matters for any later claim.
Cost and coverage
All reporting and the complaints authority are free.
Where to go
- Scamwatch, at the national anti-scam centre.
- Police cybercrime reporting portal.
- Australian Financial Complaints Authority, free and binding.
Worth knowing
The financial complaints authority is the underused lever here: it is free, independent and its decisions bind the bank. Many refusals are reversed at that stage.
Sources
- Scamwatch — National Anti-Scam Centre reporting and current alerts
- ReportCyber — Australian Signals Directorate cyber incident reporting
- Australian Financial Complaints Authority — free and binding if the bank refuses
- Moneysmart investor alert list — ASIC's list of unlicensed companies and websites, updated daily
The general article: Romance scams · Compare with another country
General sources
- Federal Register of Legislation — Commonwealth law as made and in force
- Services Australia — government services and payments