Privacy Act reform: what it changes for your website and forms

What the 2024 amendments changed

The Privacy and Other Legislation Amendment Act 2024 delivered the first tranche of reform: a statutory tort for serious invasions of privacy, expanded enforcement powers and civil penalty tiers for the OAIC, a Children's Online Privacy Code, and new transparency requirements for automated decisions that significantly affect individuals.

The automated-decision provisions require privacy policies to disclose the kinds of personal information used in substantially automated decisions and the kinds of decisions made, with a transition period running to December 2026. If any part of your intake, scoring or eligibility flow is automated, that disclosure needs drafting now rather than in the last quarter.

Collect what you need, not what the form template offered

Australian Privacy Principle 3 permits collection of personal information only where it is reasonably necessary for your functions or activities. Most lead forms fail this quietly — a date of birth, a full address or a health detail collected because a form builder made it easy, then retained indefinitely in a CRM nobody audits.

The remedy is unglamorous: list every field, name the business use, delete the fields with no answer, and write the retention period next to the ones that survive. Shorter forms also convert better, which is a rare case of privacy and performance pointing the same way.

• Every field has a stated purpose and a retention period
• Privacy notice sits at the point of collection, not only in the footer
• Analytics and pixel behaviour matches what the policy says
• Breach response plan names who acts in the first 24 hours

Analytics, pixels and the third parties on your pages

Advertising pixels and session-recording tools can transmit personal information to third parties, including data entered into forms before submission. Where sensitive information is involved — health services being the obvious case — the exposure is materially higher, and the OAIC has been increasingly direct about tracking technologies.

Audit what actually loads on your pages, exclude form fields and sensitive URLs from recording tools, and make sure the privacy policy describes the real configuration. A policy that describes an older setup is worse than no policy, because it is a documented inaccuracy.

Be ready for the notifiable breach

The notifiable data breach scheme requires an assessment within 30 days and notification to the OAIC and affected individuals where serious harm is likely. Preparation is what makes that manageable: a data inventory, a named decision-maker, contact templates, and a developer who knows how to pull access logs quickly.

This article is general information, not legal advice. Obligations depend on your organisation, the data you hold and the sector you operate in; obtain specialist advice where the risk is material.