Australia is making major updates to its privacy laws for the first time in decades. These changes are designed to give people more control over their personal information and hold businesses to higher standards when it comes to protecting that data. The updates are a response to the growing number of data breaches and the way digital technology has changed how information is collected, shared, and stored.

One of the key changes is around how companies must handle personal data. Under the new rules, organisations will need to be more transparent about what they collect and why. This includes giving people clear explanations about what their data will be used for and how long it will be kept. The idea is to stop companies from collecting information “just in case” they might need it later.

Another important update is the right for individuals to request that their data be deleted. This is often called the “right to be forgotten” and is something that already exists in other parts of the world, such as the European Union. If someone asks a business to delete their information, and there’s no legal reason to keep it, the business will have to comply.

Fines and penalties for companies that don’t follow the rules are also increasing. The government wants to make sure that privacy breaches are taken seriously. Larger organisations could face penalties in the millions, especially if they fail to take reasonable steps to secure personal data or ignore people’s privacy rights.

There will also be more support for individuals who experience harm from a data breach. The law aims to make it easier for people to take action if their data is misused, leaked, or accessed without their permission. This could mean stronger options for compensation or ways to make complaints more easily.

These updates are being introduced in stages, and more details will come as the legislation moves forward. For businesses, now is the time to start reviewing how they collect, use, and store data. For individuals, it’s a chance to become more aware of your rights and how your personal information is being handled in a digital world.

For organisations looking to stay ahead of these changes, aligning with international privacy and security standards is a smart move. Frameworks like ISO 27001, which focuses on information security, and ISO 27701, which adds a privacy layer to that system, can help businesses build strong processes and show that they’re taking privacy seriously. These standards don’t just tick compliance boxes—they help create a culture of trust and accountability, which is increasingly expected by customers and regulators alike.

The message is clear: privacy matters, and the law is finally catching up.