Australia's privacy laws are about to change more sharply than at any point since the Notifiable Data Breaches scheme was introduced in 2018 — and the deadline is fixed. The Privacy and Other Legislation Amendment Act 2024 put a staged timeline on reform of the Privacy Act 1988, and the tranche that matters most to Australian businesses takes effect in December 2026. Individuals gain a direct right to sue for serious invasions of their privacy, the Australian Information Commissioner gains stronger investigation and penalty powers, and businesses face new obligations around how they collect, retain and act on personal information.
This guide sets out what changes in December 2026, which businesses are affected, what each reform means for the IT environment that actually stores and processes your data, and the steps to take before the deadline.
What is changing in the Privacy Act in December 2026?
The Privacy and Other Legislation Amendment Act 2024 introduced a series of reforms to the Australian Privacy Act 1988, with key provisions taking effect December 2026. The most significant changes for Australian businesses:
A new statutory tort for serious invasions of privacy. Individuals can sue directly, without needing to go through the OAIC. This shifts privacy from a regime only regulators could enforce to one where customers, employees and former employees can take direct legal action. Businesses that mishandle personal information face civil claims from the people affected, not just regulatory attention.
Strengthened data breach notification obligations. Assessment timelines under the Notifiable Data Breaches scheme tighten, and businesses are expected to have the logging, detection and response processes in place to identify and assess a breach within the statutory window — not weeks after it happened.
New requirements around automated decision-making. Businesses must disclose when AI is used to make decisions that significantly affect individuals — recruitment screening, credit assessment, customer service triage. This is the first time automated decision-making has been pulled squarely into Australia's privacy law, and it lands in the same December 2026 window.
Extended powers for the Office of the Australian Information Commissioner. The OAIC can investigate and penalise non-compliant organisations directly, resolve complaints itself and seek injunctions — moving from a complaints-driven regulator to an enforcement one.
The maximum civil penalty for serious or repeated Privacy Act breaches increased to AUD $50 million or 30% of domestic turnover — whichever is greater. At that scale, a privacy failure is an existential event for most mid-market businesses, not a line item. The changes were staged deliberately so organisations could prepare; December 2026 is when the core obligations bite, and the OAIC has signalled its enforcement posture steps up from that point.
Which Australian businesses are affected?
The Privacy Act applies to organisations with annual turnover above AUD $3 million and certain categories of smaller organisations regardless of turnover — including health service providers, businesses that trade in personal information, and businesses that handle sensitive information. The December 2026 reforms extend obligations to a wider class of small businesses handling personal information as a core business function.
If your business handles customer data, employee data, health information, or financial records and relies on digital systems to store and process it — the reforms apply.
In practice, that catches far more organisations than owners expect: recruitment agencies, medical and allied health practices, real estate agencies, financial brokers, construction firms holding site personnel records, and professional services firms of every kind. The test to apply is simple — if you hold personal information about people outside your organisation and store it digitally, assume you are in scope and plan accordingly.
What do the Privacy Act reforms mean for your IT environment?
The reforms are enforced against business processes, but they are delivered through IT systems. Most Australian businesses hold their personal information estate in Microsoft 365 — Exchange Online mailboxes, SharePoint document libraries, OneDrive folders and Teams channels — so compliance work largely happens inside that environment. Five workstreams matter before December 2026:
Data mapping. You must know what personal information you hold, where it is stored, who has access, and how long you retain it. For Microsoft 365 environments this means auditing SharePoint site permissions, OneDrive sharing settings, Teams channel membership, and Exchange mailbox access — then documenting what you find. External guests, former employees' accounts and over-shared sites are consistently the largest findings in permission audits, and every one of them is privacy exposure.
Data retention policies. Personal information must not be retained longer than necessary. Microsoft Purview retention policies enforce this automatically — retention rules applied across mailboxes, SharePoint sites and Teams channels mean personal information ages out on schedule instead of accumulating indefinitely in long-forgotten folders.
Access controls. Only authorised staff should access personal information. Microsoft Entra Conditional Access and Intune device compliance policies enforce this: access to sensitive data restricted to compliant devices from trusted locations with MFA required, and least-privilege permissions reviewed on a cycle rather than granted once and forgotten.
Automated decision-making disclosure. If you use Microsoft Copilot or any AI tool that influences decisions about individuals (recruitment, credit, customer service routing), you must be able to disclose this. That means knowing which AI tools touch personal information and what data they access — and updating privacy notices accordingly. Australia's ASD advisory on AI misalignment reinforces why AI systems touching personal data need constrained, monitored deployments rather than open-ended agent access.
Data breach response. If a breach occurs, you have 30 days to notify the OAIC and affected individuals. Your IT provider should have an incident response plan covering detection, containment, assessment and notification — and it should have been tested, because a plan that has never been rehearsed does not survive contact with a real incident.
How Mycelium 365 helps Australian businesses comply
Mycelium 365 delivers the technical controls the Privacy Act reforms require — Microsoft Purview data governance, Entra Conditional Access, Intune device management, audit logging, and data breach response planning. Our managed Entra ID service anchors identity and access control for personal information across the tenant, and our AI strategy advisory includes review of automated decision-making disclosures for businesses using Copilot.
Compliance is also a security posture problem. The fastest route to a breach notification is a compromised identity or an unpatched device, so the same controls behind the Essential Eight — which we implement and assess — directly reduce your Privacy Act exposure.
Contact us to discuss your Privacy Act readiness before December.