← Global Privacy Laws Research Library
128 of 2024
Privacy and Other Legislation Amendment Act 2024
Privacy and Other Legislation Amendment Act 2024: Australia
Prepared by Shubhank Suman · Last reviewed
In force, with provisions commencing in phases. (Federal Register of Legislation)
- Legal character
- Amending legislation
- Region
- Asia-Pacific
- Assent
- 10 December 2024
What it covers
The Act implements major reforms across:
- privacy protections
- children's privacy
- security, retention and destruction
- overseas data flows
- eligible data breaches
- penalties
- automated decision-making
- serious invasions of privacy
- doxxing-related criminal law.
The official legislation contains these as separate Parts and Schedules. (Federal Register of Legislation)
AI, privacy and cybersecurity relevance
- AI: Very High
- Privacy: Very High
- Cyber: Very High
AI
Very High
The most important AI-related element is automated decision-making transparency.
The Act adds requirements for privacy policies where a computer program is used to make, or substantially/directly contribute to, a decision that could significantly affect an individual's rights or interests and personal information is used in that process. (Federal Register of Legislation)
Privacy
Very High
Schedule 1 includes reforms concerning:
- APP codes
- children's privacy
- security and retention
- overseas disclosures
- eligible data breaches
- privacy enforcement
- automated decision transparency.
Cybersecurity
Very High
The Act contains amendments dealing with:
- security, retention and destruction
- eligible data breaches
- enforcement powers and penalties.
The underlying Privacy Act remains the primary operative privacy statute. (Federal Register of Legislation)
Current validity
CURRENT AMENDING LEGISLATION: PHASED COMMENCEMENT
Read first
Schedule 1 → Parts 4–7 → Part 15: Automated Decisions and Privacy Policies → Schedule 2: Serious Invasions of Privacy → Schedule 3: Doxxing.
Provisions / sections covered
Important classification
This is not Australia's standalone privacy law.
It is an amending Act principally modifying the Privacy Act 1988 and related legislation.
Critical current-status point
The automated-decision provisions have a future commencement date of 10 December 2026.
The OAIC's 2026 materials expressly state that the ADM transparency obligation commences on 10 December 2026. (OAIC)
Therefore, as of 17 September 2026, do not say that those ADM transparency obligations are already operative.
Children's privacy
The amendment requires development of a Children's Online Privacy Code. As of August 2026, OAIC consultation on the draft Code was ongoing. (OAIC)
Subject-matter tags
- Children's data
- Automated decision-making
- Data breach
- Cross-border transfers
- Data protection officer
- Retention
- Enforcement and penalties
- Transparency
Subject-matter tags describe what the indexed text discusses. They are not legal conclusions.
Related instruments in this library
- Spam Act 2003Law · Current (amended)Same jurisdiction; assess applicability separately.
- Online Safety Act 2021Law · Current (amended)Same jurisdiction; assess applicability separately.
- Telecommunications Act 1997Law · Current (amended)Same jurisdiction; assess applicability separately.
- Security of Critical Infrastructure Act 2018Law · Current (amended)Same jurisdiction; assess applicability separately.
Document page in the Knowledge Base - full text or PDF where it is available for this record.
This library locates primary and official sources. It does not interpret the law and it is not legal advice.