Report
The Privacy Act reforms, dated: what has commenced and what starts on 10 December 2026
Most of the first round of privacy reform is already law. The two obligations left on the calendar land together on 10 December 2026, and both are answered by reading what your software does with personal information and writing it down.
- Dates checked 11 Aug 2026
- First published 11 Aug 2026, this edition 29 Oct 2026
- PDF, 7 pages, 331 KB
- BS-RPT-12, version 1.1
Executive summary
The Privacy and Other Legislation Amendment Act 2024 received Royal Assent on 10 December 2024, and most of its privacy reforms commenced the next day, 11 December 2024. Since 11 December 2024 the reasonable steps APP 11 requires an entity to take to protect the personal information it holds expressly include technical and organisational measures, and the clarification applies to information held after that day whether or not it was collected before it.
The statutory tort for serious invasions of privacy commenced on 10 June 2025, six months after Royal Assent, and gives an individual a cause of action in court against any person who seriously and intentionally or recklessly invades their privacy. Mandatory ransomware payment reporting under the Cyber Security Act 2024 commenced on 30 May 2025 for businesses with an annual turnover of $3 million or more and for entities responsible for critical infrastructure.
On 10 December 2026 the automated decision-making transparency requirements in APP 1.7 to 1.9 commence, and the Children’s Online Privacy Code must be registered by the same day. From 10 December 2026 an APP entity that has arranged for a computer program to use personal information to make a decision that could reasonably be expected to significantly affect an individual’s rights or interests, or to do a thing substantially and directly related to making it, must say so in its privacy policy, whether the arrangement was made before or after that day.
For a firm that holds customer data the calendar is now short. The reforms already in force changed what a court and the regulator can do after a breach or a misuse; the two that commence in December change what a privacy policy has to say before one. Both December obligations are met by the same piece of work: a list of every place personal information flows through your systems, and a statement of which of those flows a program decides on its own.
A team that runs that review before November has its December wording ready, and the wording describes the system as it runs. A team that writes the policy in December describes the product it remembers building.
- List every flow of personal information through your systems, including the suppliers, models and analytics services that receive it.
- Name each decision a program makes or shapes about a person, and whether a person reviews it.
- Rewrite the privacy policy from that list before 10 December 2026, and set a date to read it against the system again.
Report
The figures
The reform dates, December 2024 to December 2026
What to do
For a firm with customer data, the order to follow before December:
- Build the data map: every field of personal information, where it rests, every supplier, model and analytics service it reaches, and the written purpose for each.
- List every decision a program makes or shapes about a person, with the information that feeds it, whether a person reviews it, and what the person affected is told.
- Rewrite the privacy policy from the two lists, with the automated decision wording in plain words, and publish it before 10 December 2026.
- Decide whether your service is likely to be accessed by children, and if it is, write down what it collects from them and how each collection is switched off.
- Read the reasonable steps duty against your estate: patching on a clock, phishing-resistant sign-in on every account that reaches personal information, and backups a compromised administrator cannot delete.
- Hold less: delete fields with no written purpose and shorten retention where the purpose has ended, because the tort and the breach scheme both reach information you still hold.
- If your turnover is above the reporting line, write the ransomware decision procedure now: who decides, who reports, and what is written down on the day.
- Put a date in the calendar to read the policy against the system again, and keep the two lists with it.
We run this review for clients: the data map and the decision list drawn from the running system and its code, the privacy policy rewritten from them with the December wording, and the reasonable steps read back from the systems that enforce them, with a dated list of what remains. For software teams we do the privacy policy work inside the build, so the policy ships with the release that changes it. Scope and price are at blackshard.com.au/services/compliance.
Method
Every date comes from the commencement table of the Act as the Federal Register of Legislation publishes it, read beside the register’s making date, or from the page on which the Office of the Australian Information Commissioner states it. Every date is printed as the source states it; each source was on the register or the OAIC’s pages by 11 August 2026 and is listed at the end.
The commencement table fixes most dates by a formula, the day after Royal Assent or a period of months beginning on it, and the register fills in the calendar date. The two formulas that matter are the twenty-four months that set 10 December 2026 and the six months that set 10 June 2025. The tort could have commenced earlier by proclamation; it commenced on the fallback day the formula names.
The ransomware reporting date belongs to a different Act and is printed from the Australian Signals Directorate’s annual threat report, because a firm planning its privacy calendar plans that one beside it.
The review a software team runs before December
The review has three passes. The first pass is the data map: every field of personal information the product collects, every table and bucket it rests in, every supplier, model and analytics service it is sent to, and the purpose that was written down when the field was added. Fields with no written purpose are the first finding.
The second pass is the decision list. Walk every place where code, a rule or a model decides or shapes something about a person: an eligibility check, a fraud score that holds an order, an identity match that fails closed, a ranking that decides who is shown a service, an automated refusal. For each one, write what personal information feeds it, whether the output is the decision or an input to a person, and what the person affected is told. That list is the raw material of the December wording.
The third pass is the policy itself. Read the current privacy policy against the two lists and mark every sentence the system no longer bears out. Then add the automated decision wording, the kinds of information those programs use and the kinds of decisions they make or shape, in plain words a customer can act on. The policy is published before 10 December 2026 and the two lists are kept with it, because the question a regulator asks after a complaint is what the entity knew about its own processing.
If the product is likely to be reached by children, the same review feeds the Code work: whether the service is a social media, relevant electronic or designated internet service, what it collects from a child and why, and what it would take to turn each collection off.
BS-RPT-12, published 11 Aug 2026, revised 29 Oct 2026
The full report, as a PDF
PDF, 7 pages, 331 KB. Dates checked 11 Aug 2026.
More reports
Report
Security events by hour: what our monitoring sees
Measured 26 Oct 2026, 00:45 AEST · PDF, 6 pages, 213 KB
