- 18 Nov 2026 UK Have your directors and PSCs verified with Companies House?
- 1 Dec 2026 AU Will your onboarding accept private-sector Digital IDs?
- 10 Dec 2026 AU Does your privacy policy explain your automated KYC decisions?
- End 2026 EU Is your ID verification ready for EUDI Wallets?
- 1 Jan 2027 US Can your age checks keep up state by state?
- 1 Apr 2027 JP Is your eKYC ready for the IC-chip mandate?
- 10 Jul 2027 EU Is your CDD flow ready for the AMLR?
- 1 Jan 2028 US Are your adviser clients ready for FinCEN’s AML rule?
- 31 Mar 2029 AU Is your initial CDD on the new AUSTRAC model?
- Now AU Tranche 2 is live. Is your AML/CTF program running?
Privacy Act reforms: what changed, what starts on 10 December 2026, and what is still proposed
The Privacy and Other Legislation Amendment Act 2024 was the first tranche of Privacy Act reforms. For firms that run identity and AML checks, three parts matter most: automated decision transparency, the statutory tort, and Privacy Act coverage of small reporting entities.
- The Privacy and Other Legislation Amendment Act 2024 (Act No. 128, 2024) became law on 10 December 2024.
- From 10 December 2026, APP entities must say in their privacy policy when a computer program makes, or substantially and directly helps make, decisions that could significantly affect individuals.
- A statutory tort for serious invasions of privacy started on 10 June 2025, and it reaches beyond APP entities.
- Since 1 July 2026, small Tranche 2 businesses with turnover of $3 million or less must follow the Privacy Act for personal information they handle for AML/CTF purposes.
- The next tranche, the Privacy Amendment (Personal Data Protection) Bill 2026, is an exposure draft only, with no introduction or start date announced.
What the reforms are
The Privacy and Other Legislation Amendment Act 2024 amended the Privacy Act 1988 and other laws. Its parts commence at different times. It added new enforcement tools for the OAIC, including infringement and compliance notices, a new criminal offence for doxxing, a statutory tort for serious invasions of privacy, and a transparency duty for automated decisions that starts 24 months after assent.
The government then released an exposure draft Privacy Amendment (Personal Data Protection) Bill 2026 on 31 August 2026, with submissions closing on 18 September 2026. The Attorney-General's Department says the Bill remains subject to further consideration by government. Law firm summaries describe a new test of whether collection, use or disclosure is fair and reasonable, and report that the small business exemption stays.
For an explanation of the principles themselves, see the Australian Privacy Principles explained.
Who it applies to
Most Privacy Act duties bind APP entities: Australian Government agencies and organisations with annual turnover above $3 million, plus some smaller businesses the Act names.
- Organisations with annual turnover above $3 million
- Small businesses that are AML/CTF reporting entities, for activities connected with their AML/CTF obligations (section 6E(1A) of the Privacy Act)
- Tranche 2 accountants, lawyers, conveyancers, real estate agents and trust and company service providers from 1 July 2026
- Any person or organisation, for the statutory tort, which is not limited to APP entities
A small firm covered only because of AML/CTF stays outside the Privacy Act for its other business activities, unless another rule brings it in.
What you have to do
These are the duties that touch identity checks, screening and client risk scoring. The OAIC's guidance for reporting entities sets most of them out.
- Explain automated decisions in your privacy policy
From 10 December 2026, APP 1.7 to 1.9 apply where a computer program makes a decision, or does something substantially and directly related to it, that could significantly affect someone's rights or interests and uses their personal information. The policy must describe the kinds of personal information and the kinds of decisions involved.
Policy update - Give clear privacy and collection notices at onboarding
Reporting entities need a privacy policy and collection notices that explain how they handle personal information for AML/CTF. You need not include information that would breach tipping off rules.
- Collect only what you need
The OAIC says to limit collection to what is reasonably necessary to meet your AML/CTF obligations and your other functions and activities.
- Avoid keeping ID copies you do not need
The OAIC says the AML/CTF Act does not require scanned copies or photocopies of identity documents. Keep the details you need and the date you checked them, and destroy or de-identify copies once no longer needed, unless another law requires you to keep them.
- Secure KYC data and plan for breaches
Take reasonable steps to keep personal information secure, and have a data breach response plan ready.
Governance - Check overseas disclosures
If personal information goes overseas, including to a service provider, you must generally take reasonable steps to make sure the recipient does not breach the APPs. Exceptions apply where the AML/CTF Act or Rules require or authorise the disclosure.
Vendor due diligence
What firms get wrong
The reforms land on firms that were never covered by the Privacy Act before, so old assumptions break.
The OAIC says small businesses that are AML/CTF reporting entities must comply with the Privacy Act for personal information they handle for AML/CTF, regardless of turnover. For Tranche 2 firms this started on 1 July 2026.
APP 1.7 refers to any computer program that makes a decision or does something substantially and directly related to it. A rules-based risk score or automated screening outcome can fall inside it if the decision could significantly affect the person.
As at 5 November 2026 it is an exposure draft. The Attorney-General's Department says it remains subject to further consideration, and no introduction or commencement date has been announced.
The OAIC says the tort is broader than the Privacy Act and can apply to individuals and entities that are not APP entities. Court proceedings must generally start within one year of the person becoming aware, and no later than three years after the invasion.
What happens when
- In force
Privacy and Other Legislation Amendment Act 2024 becomes law (Act No. 128, 2024) Source
- In force
Statutory tort for serious invasions of privacy commences Source
- In force
Privacy Act applies to small Tranche 2 reporting entities for their AML/CTF handling Source
- Proposed
Exposure draft Privacy Amendment (Personal Data Protection) Bill 2026 released for consultation Source
- Proposed
Submissions on the exposure draft close Source
- Commencing
Automated decision-making transparency duty (APP 1.7 to 1.9) starts Source
- Not yet setProposed
Next tranche of Privacy Act reform introduced and commenced Source
Not yet confirmed. We will update this when the date is set.
Also on the regulatory timeline.
Related guides
Questions people ask
What are the Privacy Act reforms?
The first tranche is the Privacy and Other Legislation Amendment Act 2024, now law. It added OAIC enforcement tools, a doxxing offence, a privacy tort and an automated decision transparency duty. A second tranche is at exposure draft stage.
When does the automated decision-making rule start?
On 10 December 2026. From that day your privacy policy must cover the kinds of personal information used, and the kinds of decisions made or substantially and directly assisted by computer programs, where those decisions could significantly affect people.
Does the Privacy Act apply to my small accounting or law firm?
If you are an AML/CTF reporting entity, yes, for personal information you handle for AML/CTF purposes, from 1 July 2026 for Tranche 2 firms. For what counts as personal information, see what is personal information in Australia.
What is the statutory tort for serious invasions of privacy?
Since 10 June 2025, a person can sue for a serious invasion of privacy by intrusion on their seclusion or misuse of information about them, where they had a reasonable expectation of privacy. Courts can award damages, injunctions or an order to apologise. The OAIC does not administer it.
What is in the Privacy Act tranche 2 exposure draft?
The Attorney-General's Department released the Privacy Amendment (Personal Data Protection) Bill 2026 for comment on 31 August 2026. Law firm summaries highlight a fair and reasonable test for collection, use and disclosure. The text may change before any Bill is introduced.
Do we have to keep copies of client ID documents?
The OAIC says the AML/CTF Act does not require it. Other laws can, such as the e-conveyancing Participation Rules when the Verification of Identity Standard is used, so check which rule applies to each record.
Primary sources
Checked 5 Nov 2026. We review this page every 90 days and when the rules change.
- Federal Register of Legislation, Privacy and Other Legislation Amendment Act 2024 (No. 128, 2024)
- OAIC, New resources on transparency for use of AI and automated decision-making
- OAIC, Statutory tort for serious invasions of privacy
- OAIC, Privacy guidance for reporting entities under the AML/CTF Act
- Attorney-General's Department, Privacy Reform: Consultation on Exposure Draft legislation
- Parliamentary Library, Bills Digest No. 16, 2024-25 (Privacy and Other Legislation Amendment Bill 2024)
- Clayton Utz, The next wave of Australian privacy reform (secondary)
Where StackGo fits
Privacy compliance is mostly policy, notices and governance, which no software does for you. Where IdentityCheck can help is in how much client data lands in your own systems. Your privacy policy still needs to describe any automated steps you use, including screening and risk scoring.
- By default, connected systems (Xero Practice Manager, Xero, Karbon and HubSpot) receive a link to the result plus the outcome and status, with no personal details written back
- Onboarding forms where you choose what to collect, including risk assessment forms with scoring and enhanced due diligence steps
- Biometric identity checks and PEP, sanctions and adverse media screening, with ongoing monitoring of screened clients
- It does not write your privacy policy, collection notices or data breach response plan
- It does not assess whether your use of automated decisions meets APP 1.7 to 1.9
- It does not give legal advice
Ready to make onboarding minutes, not hours?
Start free and run your first check today, or book a demo and we will walk you through it.