Privacy in Australia: Your Rights and How to Protect Yourself in 2026

Privacy in Australia is a legal right and, for most people, a daily leak.

The Privacy Act 1988 and the 13 Australian Privacy Principles set rules for how many organisations collect, use and store personal information. The Office of the Australian Information Commissioner (OAIC) over-sees that system. Those rules matter, however, they are also incomplete.

A normal phone can still send your location, app and sensor data in the background. Apps can still harvest your activity and behaviours after you tap ‘Allow’ to their terms. Telecommunications companies in Australia must still keep certain metadata for two years. Recent and proposed reforms in 2025 and 2026 close some gaps. However, they do not rewire the device in your pocket or your personal computer.

This guide covers what privacy law in Australia actually covers in 2026, what your rights are, what the law still does not stop, and what reduces tracking in practice.

Quick answer: Privacy law in Australia is built on the Privacy Act 1988 and 13 Australian Privacy Principles. You can ask why data was collected, request access, ask for correction, and complain to the OAIC. Since 10 June 2025 you can also sue for a serious, intentional or reckless invasion of privacy. From 10 December 2026, many organisations must say when a computer system (i.e. AI) helps make a significant decision about you. Stronger laws help, but they do not replace account hygiene, a private browser, or a private phone professionally configured to not report home.

Who the Privacy Act (1988) covers

It applies to “APP entities”: most Australian Government agencies, private organisations with annual turnover above $3 million, health service providers of any size, and some others – including businesses that trade in personal information.

A general small-business exemption still exists under that $3 million line – it was not removed in the 2024 reforms. Health services are covered even if they are small. State and Territory public sector rules sit besides this federal Act.

What “personal information” means. Information or an opinion about an identified person, or someone who is reasonably identifiable – true or not, written down or not. Name, email, phone number, location history, photos, device identifiers and many behavioural profiles all qualify.

Your Rights

Australia does not give you a European-style “delete me everywhere” right against every organisation. However, it does give you a usable set of tools.

You can generally:

• be told why your information is being collected, how it will be used, and who it may be given to
• deal anonymously or under a pseudonym in many situations, where practicable and lawful
• request access to the personal information an organisation holds about you
• request correction if that information is wrong, out of date or incomplete
• ask not to receive direct marketing
• complain to the organisation, then to the OAIC, if your information has been mishandled.

Since 10 June 2025 you can also go to court for a serious invasion of privacy – but only if all of these are met: intrusion on your seclusion or misuse of information about you; a reasonable expectation of privacy; the invasion was intentional or reckless; it was serious; and the public interest in your privacy outweighs competing interests, including freedom of the media.

For most problems, write to the organisation first (keep records), then use oaic.gov.au. Get legal advice before you treat the tort as your first step.

What the Law does not stop

The Act can require covered organisations to collect fairly, store securely, notify you of an eligible data breach, and from 10 December 2026 – say when a computer system (i.e. AI) is used to make a significant decision about you. In serious cases it can support a court claim.

It generally does not:

• stop a normal phone operating system sending data to Google, Apple, Samsung, or others
• stop 2-year telecommunications metadata retention
• stop third-party trackers inside apps you already installed
• give you a general erasure right against every retailer, broker or app (not yet)
• prevent AI training on data that has already left your device
• make Terms and Conditions “Allow” and “Accept” feel like a real choice.

The 2026 OAIC community survey (1,504 adults, March 2026) matches that gap: 93% say protecting personal information is important, 87% are more concerned than 5 years ago, and 78% feel they have little or no real control. 93% say using data collected for a service to train AI is not fair. 93% also support a legal right to request deletion.

Australians want control, however default technology is not built to give it.

What’s changing in 2026

-> Already in force: stronger OAIC powers (from 11 December 2024), the statutory tort (from 10 June 2025), and the under-16 social media restrictions (from 10 December 2025).

-> From 10 December 2026: covered organisations must describe relevant automated decisions in their privacy policy. The OAIC must register a Children’s Online Privacy Code for many services children under 18 are likely to use.

-> Still draft (released 31 August 2026): a limited right to ask social media and search companies to destroy personal information (news publishers exempt); IDLock on myGov for licence and passport checks; a “fair and reasonable” collection test; extra rules aimed at AI training and wearable cameras. Parliament has not passed it. The exposure draft on that package is open until 18 September 2026 on the Attorney-General’s Department consultation page.

How to Protect your Privacy in Practice

-> Use the system. Read the terms before you hand over a licence, Medicare number or passport scan. Request to close accounts you no longer use and to delete information collected on you. After a breach notice: change your passwords, turn on two-factor authentication (2FA), and check credit files. Complain when an entity ignores you or when advice received sounds suspicious.

-> Reduce what is collected:

• Accounts: Use unique, strong passwords for email, myGov and banking. Use an authenticator app or passkey rather than SMS where you can. A password manager such as Proton Pass makes this less of a hurdle.
• Browser and search: Brave with uBlock Origin. Startpage, DuckDuckGo or Brave Search as a privacy-focused way to search. These and other free options that focus on your privacy, security and anonymity can be found in our Privacy Hub, along with 150+ tools to better your privacy, security and anonymity in Australia.
• Phone: Stock Android and iOS are convenient, however are designed as data collection platforms. A professionally configured Privacy Phone running GrapheneOS removes the Google tracking layer and gives you sensor controls, app isolation and separate user profiles – like having multiple phones in one. Major Australian networks and most banking apps still work when the phone is prepared for local use.

• PC: Windows 10 free support ended on 14 October 2025. Windows 11 increased tracking and AI features. A Privacy Laptop running a user-friendly system such as Zorin OS removes that default reporting and invasive AI features.
• When you need to “Go Dark”: A Faraday bag blocks radio signals (cellular, WiFi, bluetooth, NFC, etc). Mesh networks provide a communications fallback if mobile towers fail.

You do not need every layer on day one. Most people get the largest gain from account hygiene, good habits plus a private phone. The law is what you use after data has been mishandled. A private phone/PC is what you use so less data exists to mishandle.

Common Traps

• “The new laws mean I am covered” – They cover organisations. They do not rewire your phone.
• “I turned off tracking in Settings” – On stock devices many system services still communicate.
• “A VPN is enough” – A VPN hides some traffic from the café or your internet provider, it does not stop the operating system or the app sending data home.
• “I will wait for the right to erasure” – Even if passed, the announced version targets social media and search, not every broker, retailer or app.
• “I should sue first” – For most problems, approach the organisation to begin with, then OAIC.

Common Questions

What is privacy law in Australia?

The main federal law is the Privacy Act 1988, including 13 Australian Privacy Principles. The OAIC regulates it. States and Territories have extra rules for their own public sectors. Some 2024-26 reforms have already started, others are still draft.

What are the Australian Privacy Principles?

These are 13 rules covering the life of personal information: open management, anonymity, collection, notice, use and disclosure, direct marketing, overseas disclosure, government identifiers, quality, security, access and correction. They apply to APP entities, not automatically to every small business.

Do I have a right to delete my data in Australia?

Not as a general legal right against every organisation. Many platforms already offer download and delete tools. A limited right against social media and search companies was proposed on 31 August 2026 and is not yet law.

Who do I complain to about a privacy breach?

Approach the organisation first, in writing, then the OAIC. For online safety harms also use eSafety. After identity theft, tell your bank asap and consider credit-file alerts.

Does the Privacy Act stop Google or Apple tracking my phone?

No. The Act regulates many organisations that handle personal information. It does not remove tracking and telemetry from a consumer phone operating system.

What changes on 10 December 2026?

Covered organisations must disclose relevant automated decision-making (i.e. AI systems) in their privacy policies. The Children’s Online Privacy Code must be registered.

Is a Privacy Phone legal in Australia?

Yes, when used for lawful purposes. Identity-verification rules still apply if you want a AU-carrier mobile number.

How should Australians protect their privacy in 2026?

Use official rights where they help. Lock down accounts. Cut browser tracking. Treat an operating system as the main leak – consider a Privacy Phone and Privacy Laptop. Add a Faraday bag and/or off-grid comms if your situation needs that extra layer. Compliment these layers by reducing unnecessary data sharing, and smarter daily app habits.

Final Thoughts

Privacy in Australia in 2026 is stronger on paper than it was in 2024. You can complain more effectively, sue in serious cases, and from December 2026 – see when an automated system is used to decide something important about you.

Paper is not the same as practice. Most people still feel they have little control. That feeling matches the technology they carry.

Learn the rights. Use them. Then reduce the personal data you give away.

[Last updated: 2 September 2026. Educational only – not legal advice.]

Want to go further?

-> Explore 150+ Privacy Tools vetted by our Pros

-> See Privacy Phones

-> See Privacy Laptops

The Act covers orgs. Most of the privacy leaks still starts with your phone and personal computer.