Annual report 2025-26

About the OAIC

The Office of the Australian Information Commissioner (OAIC) is an independent statutory agency in the Attorney-General’s portfolio, established under the Australian Information Commissioner Act 2010 (AIC Act).

Our purpose is to promote and uphold privacy and information access rights. We do this by:

• making sure Australian Government agencies and organisations with an annual turnover of more than $3 million, and some other organisations, follow the Privacy Act 1988 (Privacy Act) and other related laws when handling personal information
• protecting the public’s right of access to documents under the Freedom of Information Act 1982 (FOI Act)
• carrying out strategic information management functions within the Australian Government under the AIC Act.

In addition to the 3 principal Acts outlined above, we also administer the Notifiable Data Breaches scheme. A further 39 pieces of primary and subordinate legislation confer regulatory and other legal responsibilities on the OAIC or require other bodies to consult us on privacy matters (see Appendix A).

In particular, the OAIC has specific regulatory mandates supporting the following Commonwealth programs:

• My Health Records
• Consumer Data Right (CDR)
• Australian Government Digital ID System
• Identity Verification Service
• Anti-Money Laundering/Counter-Terrorism Financing
• National Consumer Credit
• Social Media Minimum Age
• Taxation Administration (handling of Tax File Numbers).

More information about our Digital ID and CDR functions can be found at Appendix F.

Regulatory approach

The OAIC aims to be a proactive regulator that is responsive to the community’s needs in promoting and upholding privacy and information access rights, and proportionate in our regulatory responses. We use our full regulatory toolkit across education, complaint resolution, compliance and enforcement to achieve effective regulatory outcomes. We do this by:

• using education and persuasion to encourage and promote compliance
• resolving complaints and merits review applications to deliver individual outcomes and to set regulatory expectations of the regulated community
• conducting proactive compliance audits through our assessment powers
• if necessary, taking enforcement action and using coercive and compulsory powers to enforce privacy obligations and information access rights.

We have strengthened our regulatory approach to further position the OAIC as a proactive and proportionate regulator that sets clear expectations, influences where it matters, and has the courage to take enforcement and compliance action when needed.

The OAIC’s 4 areas for regulatory focus in 2025–26 were:

• rebalance power and information asymmetries
• rights preservation in new and emerging technologies
• strengthen the information governance of the Australian Public Service
• ensure timely access to government information.

Our regulatory approach uses both encouragement and deterrence to promote and protect privacy and information access rights. We apply a proactive and harms-focused approach to prioritise our efforts.

We take regulatory action to encourage and support compliance by regulated entities and address high-risk matters with the greatest potential for harm.

Throughout 2025–26, we sought to take regulatory action in response to issues:

• that created a risk of substantial harm to individuals and the community, especially to vulnerable people and groups
• that concerned systemic harms or contraventions
• where our action was likely to change sectoral or market practices, or have an educative or deterrent effect
• that were subject to significant public interest or concern
• where our action helped clarify aspects of policy or law, especially newer provisions of the Acts we administer.

Overview from the Australian Information Commissioner

As an independent, contemporary and responsive regulator, the OAIC promotes and upholds privacy and information access rights. By upholding these important rights, we contribute to confidence in the institutions and systems of government, economy and society. Our mandate as an integrity agency – to promote lawfulness, transparency, accountability and fairness – underpins our regulatory efforts and embodies the goals of the Commonwealth Integrity Strategy.

Technology has made the privacy and information rights landscape increasingly complex, and this has led to a greater call on the OAIC’s case management functions. In an uncertain world, our functions take on an added importance, and we are seeing this reflected in the community’s engagement with the OAIC.

Community engagement has significantly increased

Reflective of the importance of information access and privacy, we have seen a significant increase in all our areas of work. In 2025–26 there has been a 60% increase in privacy complaints, 42% increase in Information Commissioner (IC) review applications, 18% increase in data breach notifications, and 35% increase in FOI complaints. Against this surge our performance was impactful.

This year, we responded to the Australian community’s increasing engagement with our regulatory services by exceeding our measure of the percentage of cases finalised within time standards. We finalised 90% of our cases within time standards.

These community contacts provide valuable insights to drive our increasing focus on proactive regulatory activities including guidance, investigations and enforcement to secure information access and privacy rights.

Informed by an increase in complaints regarding the social media sector, we have delivered a program of regulatory activities to minimise harm. That has included regulatory efforts to implement the policy intent of the Social Media Minimum Age scheme.

In 2025–26 there were 15 cyber incidents impacting over 1 million individuals, compared to only 2 in 2024–25. We have responded to this significant increase with the revision of our Notifiable Data Breaches Report, to provide greater insights and awareness of the causative factors and preventative measures.

Our role as a regulator is about embedding change – the right kind of change – in practices, product design and the broader environment, to deliver benefits for the community and all our stakeholders, whether in industry or the public sector.

Our approach is to apply regulatory powers in an escalating and proportionate manner, encouraging voluntary compliance through education and guidance to prevent harm, but confidently enforce privacy obligations and information access rights when required.

Our regulatory priorities for 2025–26 were:

• rebalance power and information asymmetries
• rights preservation in new and emerging technologies
• strengthen the information governance of the Australian Public Service
• ensure timely access to government information.

Key regulatory highlights for 2025–26

We use our full regulatory toolkit across education, complaint resolution, compliance and enforcement to achieve effective regulatory outcomes.

Examples include:

• Education – We released new guidance to support the expanded range of businesses that now fall under the Privacy Act as part of the AML/CTF reforms, facilitated webinars reaching 1,000 FOI practitioners, and continue to update our FOI guidance for agencies.
• Dispute resolution – We implemented a targeted program of case management improvements to respond to an increase in incoming matters and ensure confidence that the regulatory system can deliver resolution and remedy.
• Compliance – We released the Automated decision-making and public reporting under the Freedom of Information Act report highlighting whether agencies authorised to use ADM are being transparent about their use through compliance with the public reporting requirements contained in the FOI Act. We also conducted our first privacy compliance sweep.
• Enforcement – We continued our thematic investigations into 4 agencies’ compliance with timeliness requirements under the FOI Act, and welcomed the Federal Court’s order that Australian Clinical Labs (ACL) pay civil penalties of $5.8 million following a data breach in 2022, the first order of its kind in Australia.

Our work on ADM is an example of our cross-functional approach. In addition to our report dealing with transparency of ADM-use and FOI obligations, we also issued a discussion paper to accompany a consultation process to support entities covered by the Privacy Act to comply with the ADM transparency obligation commencing in December 2026.

This aligned approach utilises our 3 functions of information management, FOI and privacy, to deliver results for the community and our stakeholders.

Our approach is also responsive to community demand. In both the Australian Community Attitudes to Privacy Survey 2026 (ACAPS) and the 2025 Cross-jurisdictional Information Access Survey, we found:

• high community demand for transparency in use of AI and ADM
• growing awareness of privacy and information access rights, with 96% of Australians considering the right to access government-held information important or very important, and 87% saying they are more concerned about their privacy than they were 5 years ago.

Through our work in these areas, we seek to provide a platform for business and government to build greater trust and confidence in their products and service delivery, which will be of benefit to the wider economy.

Technology – challenges and opportunities

The levels of community engagement with our regulatory services, and the nature of the regulatory harm we are addressing, confirms our focus should be increasingly orientated to the digital environment. To succeed, we are taking a data informed, co-regulatory and anticipatory regulatory approach. Data capture and analysis require effective case management systems to support the timely deployment of regulatory effort. Our regulatory tools and systems must also respond to this challenge to enable us to keep pace with this rapidly evolving technological environment.

The Organisation for Economic Co-operation and Development (OECD) has recognised that rapid technological advancement threatens effective regulation and international co-operation is essential. Within Australia, the OAIC has led regulatory efforts including through development of the Children’s Online Privacy Code to set the standards for social media services.

However, the rapid development of technology means its impact may not be understood for years to come, similarly, the pace of development challenges the adequacy of regulatory approaches. To keep pace with this change, regulators themselves are deploying new approaches supported by greater use and sophistication of the technology to better understand and respond. The OECD recommends strategic intelligence be harnessed to leverage robust tools such as horizon scanning, advanced data analytics, forecasting and technological assessments to inform the development of strategic visions, plans and roadmaps for emerging technologies. This is the new challenge and opportunity for the OAIC as Australia’s national regulator of privacy and information access rights.

During 2025–26, we made strong progress against our regulatory priorities. We have also developed a Strategic Plan for 2026–29, to outline our future regulatory focus and support the delivery of strategic impacts under the key activities we are responsible for. Our Plan identifies 3 core strategic impacts:

• address power and information asymmetries
• promote information integrity
• embed fairness, accountability and transparency in new technology.

In concert with my esteemed colleagues, Freedom of Information Commissioner Alice Linacre PSM and Privacy Commissioner Carly Kind, we continue to progress our focus more than ever on being a risk-based regulator, applying our regulatory insights and data to uphold our statutory remit and to identify and ameliorate the most significant potential harms to the community. By so doing, we provide necessary preconditions for the community’s embrace of the digital economy.

The whole-of-OAIC approach is also vital as we continue to see matters traverse our full range of functions across privacy, FOI and information management. It is incumbent on us to take a holistic approach – not least because the regulated community seeks coordinated and coherent guidance. Following a revision to our organisational restructure, during 2025–26 we continued to reinforce the ‘One OAIC’ approach. OAIC staff have demonstrated an unwavering commitment to succeed in upholding privacy and information access rights in this challenging regulatory environment. Their efforts are demonstrated in the overwhelmingly positive achievements demonstrated in this report.

The OAIC’s organisational strength and integrated approach position us well to deal with the many milestones ahead in 2026–27, including future privacy reform and the implementation of the Children’s Online Privacy Code, uplift FOI practice by agencies, and always operating in the spirit of the Commonwealth Integrity Strategy.

The work we do is vital to the Australian community. Demand for our services, and awareness of information access and privacy rights, continues to grow. We have developed a clear path forward and will continue to apply and grow our regulatory expertise to uphold the values of the Australian community reflected in our laws.

Elizabeth Tydd
Australian Information Commissioner

Overview from the Freedom of Information Commissioner

Throughout 2025–26, the community has again demonstrated strong interest in the exercise of their information access rights amidst an increase in caseload activity for the OAIC’s FOI functions.

This is evidenced by the fact that Australian Government agencies and ministers received the highest number of FOI requests on record in 2025–26, totaling 46,933, an increase of 8%.

Since my appointment as FOI Commissioner in September 2025, I have worked on building trust in the FOI system and highlighting its importance to both the Australian community and the public sector.

My focus is on broad cultural uplift, increasing compliance and innovation, with the community at the centre of the FOI system and access to information an important part of our democratic fabric.

I have engaged with agencies through a roundtable, webinars and in 1:1 meetings, and have set the expectation for steady and sustainable improvement. Continuing to share what’s working in FOI administration and lessons learnt is an important part of this approach.

Community interest is reflected in the 2025 Cross-jurisdictional Information Access Survey, which found that 96% of Australians consider the right to access government-held information important or very important and an overwhelming 97% of national respondents view having an independent regulator report on an agency’s performance as important.

For the OAIC, we received a significant increase (42%) in requests for Information Commissioner (IC) reviews throughout the 2025–26 financial year. Nearly half involved the Department of Home Affairs.

While the number of IC applications finalised fell by 6% to 2,311, compared to 2,470 in 2024–25, this was largely due to an overall increase in applications and an increased focus on vexatious applicant issues. The use of resources to manage agencies non-compliance with statutory timeframes and the resultant reviews of deemed decisions remains a focus for decision-making.

The OAIC made significant progress in the make-up of matters on hand and timeliness, with the average time to finalise an IC review falling from 13.5 months to 7 months, and 83% of IC reviews finalised within 12 months compared to 67% in the previous year.

There were also significant reductions in longer-aged matters, with the finalisation of all remaining matters from 2020–21.

Numbers for FOI complaints about agencies were also higher, with a 35% increase in FOI complaints received (457) and a 19% increase in FOI complaints finalised (407).

Some of the ways we seek to support cultural uplift to the FOI system are via guidance, education and publication of the results of our investigations. The OAIC’s stakeholder survey found our guidance is highly valued, with 69% of respondents finding it very or extremely useful. There was also strong awareness of FOI webinars, with strong attendance numbers (approximately 1,000 attendees) at the FOI webinars throughout the reporting period.

We completed 4 complaint investigations during the financial year, involving the Australian Federal Police (AFP), the Department of Veterans' Affairs (DVA), the Department of Defence and the National Disability Insurance Agency (NDIA). All involved a lack of compliance with s 15(5)(a) of the FOI Act as the organisations did not acknowledge FOI requests within the statutory processing timeframe.

A significant guidance update was to Part 13 of the FOI Guidelines, which provides guidance on the Information Publication Scheme (IPS) that applies to all Australian Government agencies subject to the FOI Act. The updates to Part 13 address issues raised by agencies in the OAIC’s 2023 Information Publication Scheme Review Survey as well as incorporating insights from the 2024 FOI Practitioners Survey. Further, the updates operationalise the recommendations made in the OAIC’s report Automated decision-making (ADM) and public reporting under the Freedom of Information Act, which was published in January 2026. This report is a significant milestone in highlighting transparent use of this emerging technology.

Strengthening the relationship between agencies and the communities they serve is also necessary. That is why Australian and New Zealand Information Commissioners agreed to a common icon for information access to act as a visual signpost for access to government information across all Australian jurisdictions and New Zealand.

For the second consecutive year, we have prepared a separate volume of this annual report to improve accessibility and transparency of agency performance data and provide more detailed regulatory information.

Incremental and sustainable improvement, combined with administrative best practice, are the best ways to strengthen Australia’s FOI system. I’d like to recognise and thank my predecessor, Ms Toni Pirani who was in the role of FOI Commissioner for a quarter of this financial year and whose work laid the foundations for much of this year’s success. I’d also like to thank the committed and dedicated OAIC staff, and the FOI practitioners we work with, for their contribution to this goal.

Alice Linacre PSM
Freedom of Information Commissioner

Overview from the Privacy Commissioner

Privacy has continued to grow in salience and prominence throughout this financial year. Privacy complaints to the OAIC dramatically increased with over 5,268 complaints received, representing a 60% increase on the previous year. Our Australian Community Attitudes to Privacy Survey 2026 (ACAPS) of more than 1,500 Australians provided some context to that growth, including that 87% of people are more concerned about their privacy than they were 5 years ago.

The growing prevalence of privacy concerns in media and public discourses, spurred by the expansion of AI capabilities and the proliferation of surveillance wearables, have heightened public anxieties around privacy issues. At the same time, privacy breaches and harms continue to occur with worrying frequency.

More data breaches were notified to the OAIC in 2025–26 than in the history of the Notifiable Data Breaches scheme, with 1,327 breaches capable of causing serious harm to individuals notified.

In recognition and response to growing community alarm, the OAIC has continued to expand our focus on enforcement, strengthening our strategic approach through the articulation in July 2025 of regulatory priorities. These included rebalancing power and information asymmetries, and addressing the preservation of rights in the context of new technologies, including AI.

We commenced civil penalty proceedings in the Federal Court against Optus with respect to security failures that led to the entity’s 2022 data breach, and issued major determinations relating to tracking pixels, rent tech apps, and facial recognition technology. In October 2025, we successfully concluded our first-ever civil penalties proceedings under the Privacy Act, with the Federal Court ordering Australian Clinical Laboratories to pay $5.8 million in civil penalties in relation to a data breach that affected over 200,000 people in 2022. In January 2026, we conducted our first privacy compliance sweep, targeting the privacy policies of businesses that collect information in person, such as real estate agencies and car rental firms.

Enhancing transparency was an area of focus, through communicating how our functions are exercised, in order to provide the public and the regulated community with greater certainty about the OAIC’s decision-making process. We published reports on inquiries and investigations into Qantas, American Express, Property Lovers and I-MED Radiology Network, and a blog outlining our new approach to complaints handling. Our investigation into I-MED Radiology Network showed that better-practice de-identification in the training of AI models is possible.

In parallel, new and updated guidance materials were published on facial recognition technology in retail settings, age assurance, and compliance with the new Anti-Money Laundering/Counter Terrorism Financing (AML/CTF) obligations.

AML/CTF is one area in which the OAIC’s mandate expanded considerably during the year, with more than 120,000 Tranche 2 reporting entities brought within the jurisdiction of the Privacy Act for the first time. The Social Media Minimum Age scheme also expanded our remit, coming into force in December 2025 and establishing bespoke privacy protections overseen by the OAIC.

Our experience in growing our regulatory expertise and remit across these 2 policy domains has positioned us well for the technological and societal changes ahead. These include a likely further expansion of our remit as government progresses the Tranche 2 Privacy Act reforms, the commencement in December 2026 of the new Automated Decision-Making transparency obligation and the Children’s Online Privacy Code (the Code). The OAIC has done substantial preparatory work to support these initiatives, particularly through consultation on the Code. This process has ensured the perspectives of more than 750 children, parents and carers, and over 650 representatives from industry, academia and civil society will help to shape the final instrument.

I have been honoured to work alongside my OAIC colleagues this year to advance privacy protections for all Australians, and I am proud of the bold approach we have taken to issues that matter to the community. But it is clear to me that our work is only just beginning.

Australians want to benefit from stronger privacy laws and to encounter fewer unfair and unreasonable personal information handling practices. They have low confidence that many sectors, particularly in the digital realm, will handle their data in a trustworthy and responsible manner. As new technologies such as AI agents and surveillance wearables become more commonplace, Australians expect their privacy regulator to continue to advocate for and take action to protect their privacy.

I intend to continue to strive to meet that expectation in the year ahead.

Carly Kind
Privacy Commissioner

The Australian community’s engagement with the OAIC

In 2025–26, we released the Australian Community’s Engagement with the OAIC report, which provides a snapshot of the OAIC’s direct community contact through its case management activity. The report highlights data on incoming matters and finalisation rates, information about how cases are managed and options for managing this increasing demand.

The OAIC has seen significant increase in incoming matters across case types, reflecting the Australian community’s increasing awareness of their privacy and information rights. In response, we have implemented a targeted program of case management improvements over the past 2 years, to ensure confidence in the regulatory system and provide the community with improved outcomes.

Our key statistics for 2025–26, including incoming matters and finalisation rates, are below.

Our year at a glance

Our Commissioners

The OAIC is headed by the Australian Information Commissioner, who is a statutory officer appointed by the Governor-General. The Information Commissioner is the OAIC’s accountable authority, with responsibility for strategic oversight, corporate governance and the OAIC’s privacy, FOI and government information management functions. The OAIC leadership team is comprised of 2 Executive General Managers, General Managers and Principal Directors.

Australian Information Commissioner

Ms Elizabeth Tydd commenced as Australian Information Commissioner in August 2024 for a 5-year term.

Commissioner Tydd is an experienced agency head and has occupied a number of statutory decisionmaking roles, including Information Commissioner and CEO of the NSW Information and Privacy Commission, Australian Freedom of Information Commissioner, Deputy President of the Workers Compensation Commission and Deputy Chairperson of the former Consumer, Trader and Tenancy Tribunal.

She has extensive regulatory and governance experience at an executive and board level in a range of jurisdictions and industries, including commercial, not-for-profit and public sector oversight.

Commissioner Tydd holds a Bachelor of Laws and Master of Laws from the University of Technology Sydney, a Graduate Diploma in Legal Practice as well as postgraduate certificates in executive management and governance, together with post graduate qualifications in leadership and policy from Harvard University. She possesses expertise in digital government and has written extensively on this subject.

Privacy Commissioner

Ms Carly Kind commenced as Australia’s Privacy Commissioner in February 2024 for a 5-year term.

Commissioner Kind was previously the inaugural director of the UK-based Ada Lovelace Institute, a research institute focused on the ethical and societal impacts of data and AI.

She has worked with the European Commission, the Council of Europe, numerous UN bodies and a range of civil society organisations. Commissioner Kind has a Masters of Science, International Relations (Hons) from the London School of Economics, a Graduate Diploma in Legal Practice, and a Bachelor of Arts (International Relations) (Hons) and Bachelor of Laws from the University of Queensland.

Freedom of Information Commissioner

Ms Toni Pirani completed her tenure as FOI Commissioner in September 2025.

Ms Alice Linacre PSM commenced as Australia’s FOI Commissioner in September 2025 for a 5-year term.

Commissioner Linacre is an experienced senior public servant and administrative lawyer. She previously held senior roles in a number of Australian Government departments, including most recently the Attorney-General’s Department and the Department of Agriculture, Fisheries and Forestry. Commissioner Linacre also has experience in private legal practice.

In 2022, Commissioner Linacre was awarded the Public Service Medal for outstanding public service in the provision and management of legal services and resources to support the government’s response to critical events, including the COVID-19 pandemic.

She holds an Executive Masters in Public Administration, a Graduate Diploma in Legal Practice, and a Bachelor of Arts and Bachelor of Laws from the Australian National University.

Enabling legislation

The OAIC is an independent statutory agency established under the AIC Act. The AIC Act confers statutory functions and powers on the Information Commissioner, Privacy Commissioner, and FOI Commissioner. These functions underpin the OAIC’s role in promoting and upholding privacy rights, access to government-held information, and broader information management responsibilities.

As a non-corporate Commonwealth entity, the OAIC operates within the framework of the PGPA Act, which governs our financial management and accountability. Our annual reporting obligations are set out in s 46 of the PGPA Act, and ss 30, 31 and 32 of the AIC Act.

The OAIC also fulfils responsibilities under 39 other pieces of primary and subordinate legislation, which confer regulatory and other legal responsibilities on the OAIC or require other bodies to consult us on privacy matters.

Portfolio structure and responsible minister

The OAIC is an independent statutory agency in the Attorney-General’s portfolio. The minister responsible during the reporting period was the Attorney-General, the Honourable Michelle Rowland MP.

Our organisational structure

The OAIC structure supports achievement of its regulatory objectives through our ‘One OAIC’ approach, which seeks to combine elements of privacy and FOI where practicable while retaining regulated area expertise.

The OAIC’s structure includes 2 SES Band 2 Executive General Managers, who undertake complementary management and leadership roles, focusing respectively on information rights and regulatory action. Branches are led by SES Band 1 General Managers, and the structure also includes a number of Principal Directors to lead teams (as well as some larger or more complex functions within branches).

This structure is correct as at 30 June 2026.

Information Rights Division

The Information Rights Division manages and resolves externally generated FOI and privacy cases, from pre-intake enquiries to resolution. It is also responsible for the OAIC’s interactions with members of the community, for example the OAIC’s public enquiries function.

The division is led by an Executive General Manager and had 3 branches which are overseen by either an SES Band 1 General Managers or an EL 2 Principal Director depending on the nature and scale of work, and the level of associated risk. The division was comprised of the:

• Intake and Eligibility Branch
• FOI Case Management Branch
• Privacy Case Management Branch.

Regulatory Action Division

The Regulatory Action Division is led by an Executive General Manager and has 3 specialist teams overseeing the management of compliance, investigation and enforcement to promote adherence to the FOI Act and Privacy Act. This includes:

• the management of Commissioner-initiated and some high-risk complaint investigations
• complex NDB matters
• general and funded assessments (including those for CDR and Digital ID)
• the enforcement of privacy and FOI legislation through regulatory action.

Enabling Services Branch

The Enabling Services Branch provides a suite of corporate services and operational support to OAIC staff and our key stakeholders. It underpins the OAIC’s capabilities, managing essential functions that allow for effective governance, risk and operations across the OAIC, including:

• corporate services
• finance
• people and culture
• governance and risk.

Corporate Legal Services Branch

The Corporate Legal Services Branch provides expert legal advice and support to Commissioners and the broader OAIC on matters related to statutory obligations, administrative law and regulatory action.

The team also advise on a range of corporate legal matters including in the areas of employment and industrial relations, procurement and governance and risk. The Branch plays a critical role in managing merits review and judicial review proceedings brought against the Information Commissioner.

Office of the Commissioners

The Office undertakes strategic engagement with internal and external stakeholders to support delivery of the Commissioners’ statutory functions. Delivery of whole-of-OAIC projects was monitored and reported upon through this Office. The Office of the Commissioners also provides Commissioners with comprehensive executive support.

Regulatory Intelligence and Strategy Branch

The Regulatory Intelligence and Strategy Branch is the centre of data, policy research and guidance that informs the OAIC’s regulatory decision-making and strategy, influences policy and legislative processes, and educates the regulated community to support their privacy and FOI obligations. The branch:

• provides intelligence and data to inform regulatory decision-making
• develops guidance and publications to educate businesses, agencies and the community on information rights
• communicates the OAIC’s work and its impact on people and their lives, including by working with the media, business and government stakeholders
• engages with legislative and policy processes to ensure an information rights and regulatory perspective is considered
• delivers various specialist regulatory roles conferred on the OAIC (including Digital ID, CDR, My Health Record and credit reporting).