The OAIC Is Already Reading Privacy Policies
In January 2026, the Office of the Australian Information Commissioner began its first-ever privacy compliance sweep, reviewing the privacy policies of around 60 businesses across six sectors that collect personal information face to face: real estate and property management, chemists and pharmacies, licensed venues, car rental companies, car dealerships, and pawnbrokers and second-hand dealers.
The OAIC can now issue infringement notices of up to $66,000 per contravention for a non-compliant privacy policy — without going to court. This sweep is the first. It will not be the last.
What Changes on 10 December 2026
From 10 December, Australian Privacy Principles 1.7 to 1.9 come into force. If your organisation uses a computer program to make, or substantially help make, a decision that could significantly affect a person’s rights or interests, your privacy policy must say so.
Your Privacy Policy Must Now Describe
- The kinds of personal information the program uses
- The kinds of decisions made solely by the program
- The kinds of decisions where the program does something substantially and directly related to the decision
The OAIC released its final guidance on 30 September. That leaves roughly ten weeks to comply.
Why Most Organisations Are in Scope — and Don’t Know It
This is not just about AI. “Computer program” covers rule-based scoring engines, machine learning models, AI assistants and the software already embedded in your operations — tenant and applicant screening, credit and insurance eligibility checks, fraud and ID verification, recruitment platforms and CRM lead scoring.
Your Privacy Policy Is Public. So Is Your Exposure.
A privacy policy is one of the few compliance documents anyone can read — the regulator, journalists, competitors and threat actors. If it is out of date, vague or missing required content, that is visible from the outside.
The same applies to the rest of your public footprint: what your website, domains, staff profiles and third-party listings reveal about your systems and the data you collect. We assess exactly that, using passive, outside-in methods. No systems accessed. Nothing touches your network.
Mapped to ISO/IEC 27001
Privacy compliance does not sit on its own. ISO/IEC 27001 is the international standard for information security management, and it is the framework boards, customers, insurers and auditors increasingly expect organisations to work towards.
Every finding in our assessment is mapped to the relevant ISO/IEC 27001 Annex A control. That means one piece of work answers two questions: where you stand against the Privacy Act, and where you stand against the international standard. If you already run an information security management system, the results slot straight in. If you are working towards certification, they become your starting gap analysis.
More Change Is Coming
The second tranche of Privacy Act reform — the Privacy Amendment (Personal Data Protection) Bill 2026 — was released in draft on 31 August. It proposes around 40 further changes, including a “fair and reasonable” test for handling personal information and reporting of eligible data breaches within 72 hours. The Government intends to introduce it before the end of 2026.
Organisations that get their privacy foundations right now will absorb those changes far more easily than those starting from scratch next year.
- What we assess: privacy policy against APP 1 requirements, ADM readiness for APP 1.7–1.9, trackers and data collection compared with your policy, external attack surface, credential and breach exposure, and email security (SPF, DKIM, DMARC)
- ISO/IEC 27001 alignment: every finding mapped to the relevant Annex A control, ready for your ISMS or certification roadmap
- What you receive: structured risk register (Critical / High / Medium / Low), board-level executive summary and prioritised remediation roadmap
- Full remediation provided: clear, step-by-step fixes for every finding, so your team knows exactly what to change
- Fixed scope, fixed price — delivered within 5 business days, passive only, no systems accessed
Places are limited by delivery capacity. Engagements must be booked before 10 December 2026.
Get Compliance Ready →