Privacy Law Reforms: What Strata Managers Need to Know – 10 December 2026 Compliance Date
Posted 13 November 2026
Category: Strata
The Privacy and Other Legislation Amendment Act 2024 (Cth) (‘Amending Act’) is the first tranche of reforms to modernise the Privacy Act 1988 (Cth) (‘Privacy Act’). It received Royal Assent on 10 December 2024 and most changes commenced on 11 December 2024.
This article explains four key changes for strata managers: cross-border disclosure, eligible data breaches, automated decision-making and civil penalties.
Cross-border disclosure
Before disclosing personal information to an overseas recipient, an APP entity “must take such steps as are reasonable in the circumstances to ensure that the overseas recipient does not breach the Australian Privacy Principles” (Privacy Act, Schedule 1, APP 8.1).
The Amending Act adds an exception where the recipient is “subject to the laws of a country that is prescribed by the regulations” or “a participant in a binding scheme that is prescribed by the regulations” (APP 8.2(aa), 8.3). Before prescribing, the Minister must be satisfied the protection is “at least substantially similar” to the APPs, and that individuals can access mechanisms to enforce it (s 100(1A)). This applies to disclosures after 11 December 2024.
Strata managers using cloud platforms, offshore staff or overseas software providers should map where personal information goes, update contracts and keep records of the reasonable steps taken.
Eligible data breaches
The Minister may now make an “eligible data breach declaration” where satisfied it is “necessary or appropriate” to prevent or reduce a risk of harm from the misuse of personal information following a breach (s 26X(1)). The declaration must specify the kinds of information, the entities involved and the “permitted purposes” (s 26X(2)). It ceases after 12 months at the latest (s 26XA).
While a declaration is in force, an entity may collect, use or disclose information within its terms (s 26XB). A person who receives information this way and discloses it further, outside listed exceptions, commits an offence carrying “60 penalty units or imprisonment for 1 year, or both” (s 26XC). A data breach statement that does not comply with s 26WK(3) is now a civil penalty contravention (s 13K(2)).
Strata managers should update breach response plans, train staff and ensure IT providers’ contracts cover breach response.
Automated decisions
From 10 December 2026, privacy policies must disclose automated decision-making where a computer program makes, or does a thing “substantially and directly related to making”, a decision that “could reasonably be expected to significantly affect the rights or interests of an individual” (APP 1.7). The policy must set out the kinds of personal information used, decisions made “solely by the operation of such computer programs”, and decisions where the program assists (APP 1.8).
Strata managers should identify systems used for automated notices, maintenance allocation or rule interpretation and plan now.
Civil penalties
The Amending Act creates a three-tier penalty system:
Key takeaways
- Overseas disclosures should be reviewed against the new prescribed country exception.
- Breach response plans must account for ministerial declarations and new offences.
- Privacy policies must disclose automated decision-making from 10 December 2026.
- Even minor privacy failures can now attract civil penalties.
***The information contained in this article is general information only and not legal advice. The currency, accuracy and completeness of this article (and its contents) should be checked by obtaining independent legal advice before you take any action or otherwise rely upon its contents in any way.
