The Privacy Accountability Shift: What Australia’s 2026 Reforms Mean for How Businesses Handle Customer Data

In October 2025, the Federal Court ordered Australian Clinical Labs to pay $5.8 million over a 2022 data breach at its Medlab Pathology business, the first time a civil penalty under the Privacy Act has actually been enforced through the courts. The underlying breach exposed roughly 223,000 people’s health and personal information. The judgment did not turn on the breach alone. It turned on what the company did afterwards: inadequate security controls carried over from an acquisition, thin incident response planning, an investigation the Court found insufficiently thorough, and a notification to the regulator that arrived some three weeks later than it should have.

The $5.8 million figure will not be the ceiling for long. The breach that triggered it happened when the maximum civil penalty sat at $2.22 million; Parliament has since raised the cap to the greater of $50 million, three times the value of any benefit obtained, or 30 percent of a company’s adjusted turnover during the breach period. The case matters less as a number and more as a signal: a regulator that spent years being described as toothless has now had a court confirm it can use the teeth it was given, at the exact moment three separate strands of privacy law are converging on Australian businesses at once.

Two of the Three Changes Are Not Waiting for Anyone

It is tempting for a business to treat privacy reform as a single event to prepare for once the legislation finally settles. That reading misses how this reform has actually arrived: in three uneven pieces, on three different timelines, only one of which is still genuinely undecided. A statutory tort for serious invasions of privacy has been in force since 10 June 2025, giving individuals a direct right to sue over misuse of their information or intrusion into their private affairs, independent of anything the Office of the Australian Information Commissioner chooses to pursue. A new transparency obligation covering automated decision-making has a fixed commencement date of 10 December 2026, a little over ten weeks from now, and applies regardless of what happens to the rest of the reform package. Only the third piece, a broader rewrite of the core Australian Privacy Principles, remains an open question, and even that is closer to settled than most executives assume.

The OAIC’s own guidance on the statutory tort is a useful reminder that this exposure sits outside the regulator entirely. A customer, former employee, or member of the public with a reasonable expectation of privacy can bring a claim directly, seek damages or an injunction, and does so on a timeline of up to three years after the event or one year after discovering it. Boards that have spent the past two years modelling privacy risk purely as “what might the OAIC do to us” have been modelling half the exposure.

The Date That Is Not Moving: 10 December 2026

The automated decision-making transparency obligation, inserted into Australian Privacy Principle 1, requires an organisation’s privacy policy to disclose three things in plain, accessible language: the types of personal information used in any computer program that makes or substantially assists a decision, the categories of decisions made entirely by that program, and the categories of decisions the program substantially and directly contributes to. The examples regulators point to are the obvious ones: credit and loan approvals, insurance underwriting, employment screening, and eligibility for a benefit or service. The less obvious point, and the one most businesses are underestimating, is the threshold. This is not an “AI disclosure” requirement in the narrow sense a lot of commentary implies. A rules-based scoring spreadsheet, a legacy eligibility formula bolted onto a CRM, or a lead-qualification workflow that quietly determines who gets a callback and who does not can all clear the bar of “substantially assisting” a decision, whether or not anyone in the business would describe it as artificial intelligence.

Gadens’ analysis of the obligation is blunt about the compressed timeline: businesses need policy language ready by 10 December, which means the underlying audit of what systems actually do has to happen now, not in November. The OAIC has been consulting on guidance through 2026 and has signalled a broad reading of what counts as a covered decision, not a narrow one that would let a business define its way out of disclosure. A privacy policy update is the visible output. The real work is the internal audit that has to happen first: tracing which systems, scripts, and third-party tools touch a decision about a real person, and being honest about which of them “substantially assist” it even when no one originally built them with that description in mind.

The Part Still Being Negotiated

The broader rewrite, generally referred to as the second tranche of reform, moved from concept to an actual exposure draft bill in 2026, with public consultation closing on 18 September. Maddocks’ review of the draft lays out its core mechanics: a new “fair and reasonable” test that applies on top of existing consent, meaning a business could comply with every explicit permission it has collected and still fall foul of the Act if a regulator decides the underlying practice was not fair and reasonable in the first place; a tighter definition of consent as voluntary, informed, current, specific, and unambiguous, closing off pre-ticked boxes and buried opt-outs; a broadened definition of personal information that pulls in more of what a business collects without necessarily realising it counts; and materially stronger security expectations under Australian Privacy Principle 11, the same principle Australian Clinical Labs was found to have breached.

Two things are worth noting about what did not make the draft. The long-standing exemptions for small businesses under $3 million in turnover and for employee records both survived, despite both being flagged for removal in earlier consultation rounds. Neither survival should be read as permanent. Both exemptions have now been publicly reconsidered twice in three years, and a business currently relying on either one is relying on a carve-out that the government has twice come close to closing. The draft bill also still has no confirmed commencement dates. That is a genuine gap, not a reason to wait: the direction of the reform is settled even where the calendar is not, and a business that builds its data practices to the “fair and reasonable” standard now is not exposed if that standard arrives on a shorter timeline than expected.

Why This Sits With the Systems Team, Not Just Legal

A privacy policy is a document. Compliance with any of these three changes is not. It depends on whether a business can actually answer, with confidence, where a given customer’s data lives, which systems touch it, and whether any of those systems make or substantially assist a decision about that person. For most mid-sized Australian businesses, personal information moves through half a dozen disconnected systems that were never built to answer that question together: a website contact form, a CRM, an email marketing platform, an accounting package, a spreadsheet someone built two years ago that nobody has since documented. None of them log what data fed what decision, because none of them were designed with a regulator’s audit in mind.

This is precisely the gap that clean API-level data integrations are built to close, and precisely why a CRM that was configured purely for pipeline visibility now needs to be reconsidered as a compliance surface too. A CRM and sales workflow that scores, routes, or auto-qualifies leads is a candidate for the ADM disclosure whether or not it was ever marketed internally as “automated decision-making.” The businesses that will find 10 December straightforward are the ones that already have a single, traceable data layer connecting their website, their CRM, and their operational systems. The businesses that will find it a scramble are the ones discovering, mid-audit, that three different tools have three different copies of the same customer record, each updated on its own schedule, none of them a reliable source of truth.

A Practical Framework for the Next Two Quarters

Waiting for tranche two to pass before acting is a choice to do the easy, dated obligations late and the hard, undated one twice. Five priorities are worth acting on now, ahead of the December deadline and ahead of whatever tranche two ultimately requires:

• Map every system that makes or substantially assists a decision about a person. Credit, hiring, eligibility, and pricing are the obvious categories. Lead scoring, service prioritisation, and eligibility gates buried inside a CRM workflow are the ones businesses miss.
• Draft the three required ADM disclosures now, against the broad reading. Write the privacy policy language as if the OAIC will interpret “substantially assists” generously, because its own signalling suggests it will, then have it ready well before 10 December rather than in the final week.
• Treat Australian Privacy Principle 11 as a live operational obligation, not an annual checkbox. The Australian Clinical Labs penalty turned as much on a slow, thin incident response as on the original breach. An untested response plan is itself a finding waiting to happen.
• Build consent and collection practices to the “fair and reasonable” standard before it is law. Retrofitting a data collection form or a marketing opt-in after the fact costs more than designing it correctly the first time, and a standard built on judgment rather than a checklist rewards businesses that got ahead of it.
• Give one named executive or board member ownership of privacy risk. With a statutory tort, a $50 million penalty ceiling, and a fixed disclosure deadline now all live at once, an undocumented, distributed sense of “someone handles that” is no longer a defensible governance position.

Where This Leaves Business Leaders

Three different instruments are now operating on Australian businesses at the same time, and only one of them is waiting for Parliament. The statutory tort has been enforceable by individuals for over a year. The automated decision-making disclosure has a commencement date that will not move for a business that is not ready. The broader rewrite of the Australian Privacy Principles is still being negotiated, but its direction, a fairness test above consent, tighter collection standards, and harder security expectations, is no longer in serious doubt. A business treating this as one future compliance project rather than three overlapping obligations at different stages of maturity is solving the wrong problem.

What separates the businesses that will meet December calmly from the ones that will not has little to do with legal budget and everything to do with data architecture: whether personal information moving through a website, a CRM, and the systems behind them can actually be traced, audited, and explained in plain language to a regulator or a customer who asks. A digital project consultancy engagement that starts by mapping where customer data actually lives and which systems touch it is a defensible use of the next quarter’s budget regardless of how tranche two ultimately lands. The deadline that matters most right now is not the one still being drafted in Canberra. It is the one already on the calendar.