Australia's Privacy Act 1988 is getting its most significant overhaul in decades. The 2025 reforms. Building on the Attorney-General's review. Bring Australian privacy law closer to global standards like the GDPR, with new rights for individuals and new obligations for businesses. If you collect any customer data (and you do. Even a contact form counts), these reforms affect you.
Key changes for businesses
Expanded consent requirements
The reforms strengthen consent requirements. Consent must be voluntary, informed, specific, current, and unambiguous. Pre-ticked boxes and bundled consents (where you can't use a service without agreeing to marketing) are out. Your sign-up forms and consent mechanisms need to be clear and granular.
Right to erasure
Individuals will have a right to request deletion of their personal information. Businesses must comply within a reasonable timeframe unless an exception applies. This means you need to know where all customer data lives across all your systems. Including marketing tools, CRMs, and social media platforms.
Automated decision-making transparency
If you use AI or automated systems to make decisions that significantly affect individuals (including targeted advertising and credit scoring), you'll need to provide transparency about how those decisions are made.
Strengthened breach notification
The Notifiable Data Breaches scheme is being strengthened with shorter notification timelines and broader scope. Businesses need robust breach detection and response processes.
What this means for marketing
- Review and update your privacy collection notices
- Implement granular consent mechanisms (separate opt-ins for different purposes)
- Map where customer data lives across all tools and platforms
- Prepare processes for handling erasure requests
- Document your automated decision-making processes
- Choose Australian-hosted tools to simplify cross-border obligations
Future-proofing with sovereign tools
The Privacy Act reforms make data residency more important, not less. Overseas data transfers face stricter scrutiny. Using Australian-hosted tools. Where data stays in Australia, under Australian law. Simplifies compliance with both current and future privacy obligations. Brand and Go's Sydney-hosted infrastructure means your marketing data is already where the law wants it to be.