Australia has entered a new era of privacy protection. As of June 10 2025, every Australian now has the right to sue for serious invasions of privacy.
Recent amendments to the Privacy Act 1988 (Cth)create a new statutory tort for serious invasions of privacy, introduce a federal offence of doxxing, strengthen the powers of the Office of the Australian Information Commissioner (OAIC), and increase penalties for breaches of privacy law.
A claim may be brought where a person’s seclusion has been intruded upon or their private information misused, provided they had a reasonable expectation of privacy and the conduct was intentional or reckless. Importantly, the invasion must be serious, and courts must find that the individual’s privacy interest outweighs any competing public interest.
The tort is actionable without proof of financial loss, allowing courts to award damages for emotional distress as well as injunctions, declarations, and corrective or apology orders. The amendments caps damages for non-economic damages and punitive damages at the greater of $478,550 or or the maximum amount of damages for non-economic loss that could be awarded under defamation proceedings. Additional remedies include accounts of profits derived from invasions of privacy and the destruction of invasive material. Exemptions apply to journalists, children, and government or intelligence agencies. Defences are also available where conduct is legally authorised or consented to. Most claims must be brought within one year of discovery.
The reforms also make “doxxing”, where someone publishes another person’s private information to harass or intimidate them, a federal criminal offence for the first time. Those caught doxxing face up to 6 years in jail. Aggravated offences, such as doxxing motivated by prejudice, attract even heavier penalties.
The OAIC has seen its regulatory powers significantly enhanced. The reforms grant the regulator the authority to issue infringement notices, impose higher civil penalties—including potential fines in the tens of millions for serious or repeated breaches—develop the Children’s Online Privacy Code, and enforce cross-border data flow “white lists.”
Further reforms are scheduled to take effect by December 2026, including launching the Children’s Online Privacy Code to mandate age-appropriate design and parental consent provisions, and imposing transparency obligations for automated decision-making. Entities will be required to disclose when algorithmic decision-making significantly affects individuals.
Together, these reforms represent more than a mere technical update. They mark a fundamental shift in how privacy is treated in Australia, elevating it to a legal right enforceable in courts. Businesses face not only heightened financial penalties but also reputational and operational risks arising from civil litigation. For the first time, the law provides Australians a direct avenue to seek redress for serious privacy violations.
As one leading law firm has observed, privacy in Australia has finally “got teeth”.
We acknowledge the Ngunnawal and Ngambri people, who are the Traditional Custodians of the land on which Woroni, Woroni Radio and Woroni TV are created, edited, published, printed and distributed. We pay our respects to Elders past and present. We acknowledge that the name Woroni was taken from the Wadi Wadi Nation without permission, and we are striving to do better for future reconciliation.