Privacy and Other Legislation Amendment Act 2024 (Australia)
Australia's first tranche of Privacy Act reform (No. 128, 2024, assented 10 December 2024): security steps that include technical and organisational measures, a prescribed-country pathway for overseas disclosure, a Children's Online Privacy Code to be registered by 10 December 2026, information sharing under eligible data breach and emergency declarations, a three-tier civil penalty regime with infringement and compliance notices, stronger OAIC investigation, monitoring and inquiry powers, automated decision transparency in privacy policies from 10 December 2026, a statutory tort for serious invasions of privacy in force from 10 June 2025, and Criminal Code doxxing offences. Built from the authorised Act, read in full.
Privacy and Other Legislation Amendment Act 2024 (Australia) is a compliance framework from Australia (Commonwealth) with 3 domains and 15 controls that map to 1 other frameworks. The largest domains are Schedule 1: Privacy reforms (duties on APP entities) – Privacy and Other Legislation Amendment Act 2024 (Australia) (10 controls), Schedule 2: Statutory tort for serious invasions of privacy – Privacy and Other Legislation Amendment Act 2024 (Australia) (3 controls), Schedule 3: Doxxing offences (Criminal Code) – Privacy and Other Legislation Amendment Act 2024 (Australia) (2 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (3)
Schedule 1: Privacy reforms (duties on APP entities) – Privacy and Other Legislation Amendment Act 2024 (Australia)
| Code | Title |
|---|---|
| privacy-and-other-legislation-amendment-act-2024-australia::13K(1) | s 13K(1): APP obligations enforceable by infringement notice or compliance notice |
| privacy-and-other-legislation-amendment-act-2024-australia::13K(2) | s 13K(2): an eligible data breach statement must contain the prescribed contents |
| privacy-and-other-legislation-amendment-act-2024-australia::26GC | s 26GC: comply with the Children's Online Privacy Code once registered, where bound |
| privacy-and-other-legislation-amendment-act-2024-australia::26XB | s 26XB: handle personal information under an eligible data breach declaration only within its terms |
| privacy-and-other-legislation-amendment-act-2024-australia::26XC | s 26XC: do not further disclose information received under an eligible data breach declaration |
| privacy-and-other-legislation-amendment-act-2024-australia::80P | ss 80P and 80Q: emergency declarations, handling within their terms and no onward disclosure |
| privacy-and-other-legislation-amendment-act-2024-australia::80UC | s 80UC: comply with a compliance notice within the period it specifies |
| privacy-and-other-legislation-amendment-act-2024-australia::APP1.7 | APP 1.7 to 1.9: automated decisions in the APP privacy policy (from 10 December 2026) |
| privacy-and-other-legislation-amendment-act-2024-australia::APP11.3 | APP 11.3: security and destruction steps include technical and organisational measures |
| privacy-and-other-legislation-amendment-act-2024-australia::APP8.3 | APP 8.2(aa) and 8.3: disclosure overseas to a prescribed country or binding scheme |
Schedule 2: Statutory tort for serious invasions of privacy – Privacy and Other Legislation Amendment Act 2024 (Australia)
| Code | Title |
|---|---|
| privacy-and-other-legislation-amendment-act-2024-australia::Sch2.7(1)(a)(i) | Schedule 2 clause 7: serious invasion of privacy by intruding upon seclusion |
| privacy-and-other-legislation-amendment-act-2024-australia::Sch2.7(1)(a)(ii) | Schedule 2 clause 7: serious invasion of privacy by misusing information |
| privacy-and-other-legislation-amendment-act-2024-australia::Sch2.8 | Schedule 2 clause 8: defences an organisation must be able to show |
Schedule 3: Doxxing offences (Criminal Code) – Privacy and Other Legislation Amendment Act 2024 (Australia)
| Code | Title |
|---|---|
| privacy-and-other-legislation-amendment-act-2024-australia::474.17C | Criminal Code s 474.17C: doxxing, making personal data available in a menacing or harassing way |
| privacy-and-other-legislation-amendment-act-2024-australia::474.17D | Criminal Code s 474.17D: doxxing members of a group because of a protected attribute |
Maps to 1 other framework
Coverage is not the same as your position
This page shows what Privacy and Other Legislation Amendment Act 2024 (Australia) overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.
The Compliance Position Diagnostic, $5,000 fixed, ten business daysWhat is Privacy and Other Legislation Amendment Act 2024 (Australia) and who does it apply to?
Privacy and Other Legislation Amendment Act 2024 (Australia) is a compliance framework from Australia (Commonwealth) with 3 domains and 15 controls. Australia's first tranche of Privacy Act reform (No. 128, 2024, assented 10 December 2024): security steps that include technical and organisational measures, a prescribed-country pathway for overseas disclosure, a Children's Online Privacy Code to be registered by 10 December 2026, information sharing under eligible data breach and emergency declarations, a three-tier civil penalty regime with infringement and compliance notices, stronger OAIC investigation, monitoring and inquiry powers, automated decision transparency in privacy policies from 10 December 2026, a statutory tort for serious invasions of privacy in force from 10 June 2025, and Criminal Code doxxing offences. Built from the authorised Act, read in full. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does Privacy and Other Legislation Amendment Act 2024 (Australia) actually require?
Privacy and Other Legislation Amendment Act 2024 (Australia) has 15 controls organised across 3 domains. The largest domains are Schedule 1: Privacy reforms (duties on APP entities) – Privacy and Other Legislation Amendment Act 2024 (Australia) (10 controls), Schedule 2: Statutory tort for serious invasions of privacy – Privacy and Other Legislation Amendment Act 2024 (Australia) (3 controls), Schedule 3: Doxxing offences (Criminal Code) – Privacy and Other Legislation Amendment Act 2024 (Australia) (2 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of Privacy and Other Legislation Amendment Act 2024 (Australia) do I already cover?
Privacy and Other Legislation Amendment Act 2024 (Australia) maps to 1 other compliance frameworks. The top mapping partners are ISO 27701:2019 (4% coverage). Use our comparison tool to explore control-level mappings between frameworks.
How do I implement Privacy and Other Legislation Amendment Act 2024 (Australia)?
Start your Privacy and Other Legislation Amendment Act 2024 (Australia) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Privacy and Other Legislation Amendment Act 2024 (Australia) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 15 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,120 frameworks.
Get Started Free →Free forever, no credit card required