You can now be sued for a privacy breach: Australia's new privacy tort, explained
Australia's statutory privacy tort lets people sue any business, however small, over a serious invasion of privacy. What it covers and how to stay out of court.
For the first time, Australians can sue over a serious invasion of privacy — directly, personally, without waiting for a regulator. For businesses that hold client data, the risk calculus just changed shape.
Australia's 2024 privacy reforms introduced a statutory tort for serious invasions of privacy, live since 10 June 2025. Until now, privacy enforcement mostly meant the OAIC acting after big breaches. The tort adds something different: an individual — a client, a patient, an ex-employee — with a direct legal claim against whoever invaded their privacy. Courts will settle the finer detail case by case, but the pattern of business exposure is already clear from how the tort is framed. The same reform package also brings automated-decision disclosure rules from 10 December 2026.
What is the statutory tort for serious invasions of privacy?
Set out in Schedule 2 of the Privacy Act 1988, Australia's statutory privacy tort lets an individual sue a person or organisation directly for intruding upon their seclusion or misusing information about them. Intrusion includes entering someone's private space or watching, listening to or recording their private activities; misuse includes collecting, using or disclosing information about them. The invasion must be serious, intentional or reckless, and the person must have had a reasonable expectation of privacy — with the claim balanced against public-interest considerations. Importantly, a claimant does not need to prove financial loss; distress can ground damages. The OAIC's summary of the tort sets out the elements, defences and exemptions.
How could a business be sued for a privacy breach?
Usually not through malice, but through carelessness bad enough that a court could see it as reckless — ignoring known risks to the personal information it holds. Simple negligence is not enough on its own; the tort needs intentional or reckless conduct. The plausible paths for an ordinary business:
A breach that was foreseeable.
Client files exposed through security failures a court considers reckless — no MFA on a system holding sensitive records, years-old unpatched software, credentials shared in spreadsheets, or staff logins already exposed in old breaches (a free dark web scan shows whether your company email addresses have turned up).
Misuse by an insider.
A staff member snooping records or leaking someone's file — with the business's controls (or absence of them) in the frame.
Surveillance overreach.
Monitoring staff or customers beyond what is reasonable and disclosed — a live issue as cameras and tracking tools get smarter.
Sensitive-data industries first.
Legal practices, health clinics and finance firms hold exactly the information whose misuse is most obviously "serious" — matter files, health records, financial affairs.
How do you reduce your business's privacy tort risk?
The tort punishes intentional or reckless conduct, so the strongest protection is demonstrable care: controls you can show were in place before anything went wrong. Concretely:
Security that matches the sensitivity
access controls, MFA and monitoring on the systems holding client records, mapped to a recognised baseline like the Essential Eight.
Least-privilege access
staff see the records their role needs, with access logged, so an insider incident is limited and provable.
Honest collection habits
hold what you need, delete what you do not; data you no longer hold cannot be misused.
A rapid, documented response
contained quickly and handled properly, an incident reads as misfortune; ignored, it reads as recklessness. Agreeing an incident response plan in advance is what makes that speed possible.
For legal and health practices this lands on top of existing professional obligations — our law-firm and healthcare security pages cover the sector-specific stack.
Frequently asked questions
Can someone sue us just because we were breached?
Being a victim of crime is not automatically a tort — the question is whether the invasion was intentional or reckless. A business that took reasonable, documented security steps is in a very different position from one that ignored known basics.
Does this replace OAIC penalties?
No — it adds to them. The OAIC's enforcement powers and the Notifiable Data Breaches scheme continue; the tort is a separate, personal avenue for individuals, which is what makes it novel.
Are small businesses exposed even under the $3M threshold?
Yes — this is the detail worth underlining. The tort is not bound by the Privacy Act's small-business exemption, so a business too small for the Act's obligations can still be sued for a serious invasion of privacy. Size is no shield from attackers either — see why small businesses are targets.
What single step most reduces this risk?
Lock down access to the systems holding your most sensitive records — MFA, least privilege, logging. Most misuse and most breaches run through exactly that gap.
When did Australia's statutory privacy tort start?
It commenced on 10 June 2025, when Schedule 2 of the Privacy Act 1988 took effect, and it covers invasions of privacy that happen on or after that date. Claims go to the courts rather than the OAIC, which has no direct role in administering the tort.
Who is exempt from the privacy tort?
Exemptions include intelligence agencies, law enforcement bodies and, in certain circumstances, journalists, and acting with consent or lawful authority is a defence. Ordinary businesses — clinics, law firms, accountants, retailers — have no blanket exemption, whatever their size or turnover.
How long does someone have to sue for a serious invasion of privacy?
Generally the earlier of one year after they became aware of the invasion, or three years after it happened; someone under 18 at the time has until their 21st birthday. Because the clock can start when a person finds out, an incident that surfaces long after it happened can still become a claim.
What can a court order a business to pay or do?
Courts can award damages — including for emotional distress, without the person proving financial loss — and, in exceptional cases, exemplary damages. They can also grant an injunction or order an apology, a correction, an account of profits, or the return or destruction of the material.
Check your footing
If you hold sensitive client information and cannot point to the controls protecting it, that is now a legal exposure as well as a security one. Key IT's free 30-minute cybersecurity health check shows you the gaps — and what to fix first — before someone else's lawyer does.
Related services & guides
More insights
Automated decisions & your privacy policy
New Privacy Act rules from 10 December 2026 make businesses disclose automated decision-making…
Read article →ScamsAnatomy of a payment-redirection scam
Payment redirection scams explained: how criminals swap a supplier's bank details via a hacked…
Read article →RansomwareRansomware reporting now has teeth
Australia's 72-hour ransomware payment reporting rule moved from education to enforcement in 2026…
Read article →Book your free IT & Cyber Security Review
See exactly where your IT and security stand, and what to fix first. No jargon, no obligation.