Security + privacy regulations in Australia

Australia's Privacy Act 1988 is the foundational privacy law, setting out 13 Australian Privacy Principles (APPs) that govern collection, use, disclosure, and management of personal information. The Act applies to APP entities — primarily private-sector organizations with annual turnover above AU$3M, plus specific sectoral categories (health-service providers, contracted federal service providers, etc.) regardless of size. The 2022 Optus + Medibank breaches triggered a major reform package in 2023-2024. Penalties were substantially increased (maximum now AU$50M or 30% of annual turnover for serious/repeated interferences). The Notifiable Data Breaches scheme — part of the Privacy Act — requires notification to the OAIC and affected individuals for eligible data breaches that are likely to cause serious harm. Further reform is expected through 2025-2026. The Attorney-General's Department has proposed a comprehensive review including a direct right of action, removal of the small-business exemption, and tighter rules on targeted advertising. IRAP (Information Security Registered Assessors Program) is Australia's federal security certification — required for vendors providing services to Australian federal agencies at PROTECTED level and above. It's a heavier lift than SOC 2 and is worth pursuing only if you have committed federal pipeline.