About the OAIC

Guide to privacy regulatory action

The OAIC is updating this page to reflect changes to the Privacy Act 1988 made by the Privacy and Other Legislation Amendment Act 2024 (POLA Act). These changes enhance the privacy of individuals with respect to their personal information, and include changes to the Information Commissioner’s enforcement powers. They also introduce a statutory tort to provide redress for serious invasions of privacy.

The POLA Act commenced on 10 December 2024, with some measures commencing at later dates as set out in s 2 of the Act.

For more information please refer to the Privacy Act and the explanatory memoranda.

Our regulatory approach

Guide to privacy regulatory action

This guide explains our privacy regulatory powers, looking at the legislative framework and purpose of the power, and the procedural steps we’ll take in the exercise of the regulatory power.

Introduction

Chapter 1: Privacy complaint handling process

Chapter 2: Commissioner initiated investigations and referrals

Chapter 3: Information sharing

Chapter 4: Enforceable undertakings

Chapter 5: Determinations

Chapter 6: Injunctions

Chapter 7: Civil penalties — serious or repeated interference with privacy and other penalty provisions

Chapter 8: Infringement notices

Chapter 9: Privacy assessments

Chapter 10: Directing a privacy impact assessment

Chapter 11: Data breach incidents

We use cookies on this site

Our regulatory approach

Guide to privacy regulatory action

This guide explains our privacy regulatory powers, looking at the legislative framework and purpose of the power, and the procedural steps we’ll take in the exercise of the regulatory power.

Introduction

Chapter 1: Privacy complaint handling process

Chapter 2: Commissioner initiated investigations and referrals

Chapter 3: Information sharing

Chapter 4: Enforceable undertakings

Chapter 5: Determinations

Chapter 6: Injunctions

Chapter 7: Civil penalties — serious or repeated interference with privacy and other penalty provisions

Chapter 8: Infringement notices

Chapter 9: Privacy assessments

Chapter 10: Directing a privacy impact assessment

Chapter 11: Data breach incidents