Privacy Act Changes: What Queensland Businesses Actually Need to Do

There has been a good deal written about Australia’s privacy reforms over the past eighteen months, and not all of it has been accurate. We have read articles this year telling small businesses that their exemption from the Privacy Act disappears in December. We have read others suggesting nothing has changed at all. Neither is right, and the gap between them is where most of the confusion sits.

This guide sets out what is actually law today, what is scheduled, what is still only a proposal, and what a business of fifteen to a hundred and fifty people should sensibly do about it. We are an IT provider rather than a law firm, so we have stayed on the side of this that we know well: translating each obligation into the technical controls that satisfy it. For advice on your specific circumstances, speak to a lawyer.

A note on the Queensland framing before we start. Queensland businesses are governed by the Commonwealth Privacy Act 1988, the same as every other Australian business. Queensland has its own Information Privacy Act, but that applies to state government agencies and local councils rather than to private businesses. We cover it briefly at the end, because it matters if you contract to government.

What Is Already Law

The first tranche of reforms, the Privacy and Other Legislation Amendment Act 2024, received Royal Assent on 10 December 2024. Most of its provisions commenced the following day. Three of them matter for a business of your size.

The security obligation has been tightened, and this is the one most businesses have missed. APP 11 has always required entities to take reasonable steps to protect the personal information they hold. The reforms added a new provision clarifying what “reasonable steps” actually means, and it now expressly includes implementing technical and organisational measures. The terminology is borrowed directly from the European GDPR. In practical terms, technical measures are the controls that protect information — multi-factor authentication, encryption of sensitive data, patching. Organisational measures are how you govern it — access privilege structures, and deactivating accounts when employees leave.

If that list sounds familiar, it should. It is a fairly precise description of what a managed IT service does. The significance of the change is that a vague assurance that you take security seriously is no longer the standard. The standard is demonstrable measures, and a regulator asking about them will want evidence rather than intent.

Second, individuals can now sue. A statutory tort for serious invasions of privacy commenced on 10 June 2025. For the first time in Australian law, a person has a personal right of action. This is worth understanding carefully if you have been relying on the small business exemption, because the tort is not limited by it. A business under the three million dollar turnover threshold, exempt from most of the Privacy Act, can still be sued under this provision.

Third, the regulator has more powers. The reforms expanded the OAIC’s enforcement options, introduced tiered civil penalties for less serious contraventions, gave the Commissioner code-making powers, and created a criminal offence for doxxing.

What Is Scheduled for December 2026

Two things land on 10 December 2026, and only one of them is likely to affect you.

Automated decision-making transparency. From that date, privacy policies must disclose where computer programs make, or substantially assist in making, decisions that significantly affect an individual’s rights or interests. You will need to explain what kinds of personal information feed into those systems and what sorts of decisions they produce.

Most businesses assume this does not apply to them, and a fair number are wrong. If you use software to screen job applicants, score credit, set pricing automatically, or triage applications, that is automated decision-making. The rise of AI tooling over the past two years means a great many organisations are now doing this without having framed it that way. The first task is genuinely a discovery exercise: working out which tools across the business are making or shaping decisions about people.

The Children’s Online Privacy Code. The OAIC is developing a code covering services likely to be accessed by children, due by the same date. If you run a website, app or platform that minors could reasonably access, there may be additional obligations around collection and consent. For most of our client base this will not apply, but it is worth a moment’s thought if you operate anything consumer-facing.

What Changed in July, and Who It Caught

This one has received far less attention than it deserves, and it caught a large number of businesses off guard.

From 1 July 2026, the second tranche of Australia’s anti-money laundering rules extended reporting obligations to a new group of professions: real estate agents, lawyers, conveyancers, accountants, trust and company service providers, and dealers in precious metals and stones. Firms providing those designated services are now reporting entities under the AML/CTF Act.

The privacy consequence is the part that surprises people. Once you are a reporting entity, the Privacy Act applies to your handling of personal information for that work regardless of your turnover. A twelve-person conveyancing practice turning over well under three million dollars no longer sits outside the Act for that part of its business. The OAIC has estimated that more than a hundred thousand small businesses are affected by this change alone.

If you are in one of those professions and this is the first you are hearing of it, the sensible first step is a personal information audit rather than a panic. You cannot protect or account for data you have not located.

What Is Only Proposed

This is where most of the published commentary has gone wrong, and it is worth being precise.

The small business exemption has not been removed. The three million dollar turnover exemption remains in place. The Government agreed in principle to removing it following an impact analysis and consultation with small business, but it has not been legislated, no commencement date has been set, and — notably — it was omitted from the exposure draft Bill released in late August 2026. If you have read that the exemption disappears in December, that claim has confused it with the automated decision-making obligation, which is a separate requirement arriving on a separate track.

We are not suggesting the exemption will survive indefinitely. It is out of step with most comparable international regimes and it has been under review for years. But there is a meaningful difference between a dated legal obligation and a policy direction, and a business planning its year deserves to know which one it is looking at.

The second tranche itself is real and is moving. The Attorney-General’s Department released an exposure draft, the Privacy Amendment (Personal Data Protection) Bill 2026, in late August 2026, proposing around forty changes. Items understood to be in scope include a new fair and reasonable test for the handling of personal information regardless of consent, an expanded definition of personal information, and stronger complaints-handling obligations. The employee records exemption, like the small business exemption, was not dealt with.

It is a consultation draft rather than law. Watch it, plan around the direction of travel, and do not rebuild your business on it yet.

What You Have to Do If Something Goes Wrong

The Notifiable Data Breaches scheme has been in force since February 2018 and its core mechanics are unchanged.

If personal information you hold is lost, accessed without authorisation or disclosed, and that is likely to result in serious harm to any affected individual, you must notify both the OAIC and the individuals concerned. Where you suspect an eligible breach but are not certain, you have thirty days to carry out a reasonable and expeditious assessment. Notification to affected individuals must include recommendations about the steps they should take.

It is worth noting that the thirty-day window is an outer limit for assessment rather than a comfortable buffer, and that a seventy-two hour notification standard, along the lines of the European regime, was an agreed-in-principle second-tranche proposal that has not been legislated. If it eventually is, the practical question becomes whether you would even detect a breach quickly enough to meet it. In our experience that is the real gap for most mid-sized businesses. The obligation is not usually what trips people up. The detection is.

There is also a quieter point here. If you take effective remedial action quickly enough that serious harm is no longer likely, the breach may not be notifiable at all. Speed of response has a direct bearing on whether you end up making a public notification, which is a reasonable argument for monitoring and a tested response plan in its own right.

Turning the Obligations Into Controls

This is the part we are actually useful for. Each obligation below maps to something technical.

Most of the businesses we assess have some of the technical side in place and very little of the organisational side. Offboarding is the most common gap by a wide margin. It is remarkably common to find active accounts belonging to people who left eighteen months ago, and it is precisely the kind of thing the new wording in APP 11 is aimed at.

A Practical Order to Work Through

If you are starting from nothing, the sequence matters more than the speed.

Begin with a personal information audit. Find out what you hold, where it sits, who can reach it and how long you have kept it. This is usually a half-day exercise for a business of this size and it almost always turns up something unexpected.

Then publish a privacy policy that describes what you actually do rather than a template. Then write a breach response plan, keep it to a page, and make sure the people named in it know they are named in it. Then close the technical gaps the audit exposed, starting with MFA coverage and offboarding. Then diarise an annual review, and add the December automated decision-making disclosure to that list now rather than in November.

That sequence covers your exposure under the statutory tort today, positions you for the December obligations, and turns the second tranche into an administrative update rather than a project, whenever it lands.

If You Work With Queensland Government or Councils

Queensland runs its own scheme for the public sector. The Mandatory Notification of Data Breach scheme under the Information Privacy Act 2009 commenced on 1 July 2025 for Queensland government agencies, with local councils brought in from 1 July 2026. Queensland agencies must assess a suspected eligible breach within thirty days and notify both affected individuals and the Office of the Information Commissioner.

This does not apply to you directly as a private business. It matters because agencies and councils increasingly pass equivalent expectations down to their contractors and suppliers. If you tender for government work in Queensland, being able to demonstrate your own breach response capability is becoming part of the conversation.

Frequently Asked Questions

Does the Privacy Act apply to small businesses? Generally not, if annual turnover is under three million dollars, though there are longstanding exceptions including health service providers. Two things have changed. The statutory tort for serious invasions of privacy applies regardless of the exemption, and from 1 July 2026 businesses providing designated services under the AML/CTF regime are covered for that work irrespective of turnover.

Is the small business exemption being removed in December 2026? No. Removal of the exemption is a proposed second-tranche reform that has not been legislated and has no commencement date. It was not included in the exposure draft Bill released in August 2026. The obligation arriving on 10 December 2026 is the automated decision-making transparency requirement, which is a separate matter.

What do we have to do by 10 December 2026? Privacy policies must disclose where computer programs make, or substantially assist in making, decisions that significantly affect individuals, including what kinds of personal information those systems use. The OAIC’s Children’s Online Privacy Code is due by the same date.

How long do we have to report a data breach? Where you suspect an eligible breach, you have thirty days to complete a reasonable and expeditious assessment. If it is an eligible breach, you must notify the OAIC and affected individuals promptly. The thirty days is for assessment, not a grace period before acting.

Does using AI tools mean we have automated decision-making obligations? Possibly. The test is whether a computer program makes, or substantially assists in making, a decision that significantly affects someone’s rights or interests. Screening job applicants, assessing credit and automated pricing are the common examples. A discovery exercise across the tools your business actually uses is the sensible starting point.

What does APP 11 require us to do technically? The reforms clarified that reasonable steps include technical and organisational measures. In practice that means controls such as multi-factor authentication and encryption, alongside governance such as role-based access and properly disabling accounts when staff leave.

Where to Start

Most of what the Privacy Act now asks for is the same work that protects your business from a cyber incident anyway. The obligations have simply made it explicit, and made it something you may one day need to evidence rather than assert.

Our TechSecure assessment reviews identity and access management, network and system configuration, policies and procedures, and where your data actually sits, and produces a register of risks and practical mitigation steps. It benchmarks against the ACSC Essential Eight, which overlaps substantially with what APP 11 now expects. Our guide to the Essential Eight covers those controls in more detail.

We should say plainly that we are an IT provider, not a law firm. We can tell you whether your environment supports the obligations and fix it where it does not. For advice on how the Act applies to your particular circumstances, your lawyer is the right call.

Not sure whether your systems would stand up to scrutiny? Contact our friendly Brisbane team for a chat today.

Read more about TechSecure, our cyber security assessment