The HR & Payroll Data to Lock Down Before Australia's 2026 Privacy Changes

Two concrete changes are worth an employer's attention. First, from 1 July 2026, Tranche 2 of the AML/CTF reforms extends anti-money-laundering obligations to new "designated services" — including real estate agents, buyer's agents, property developers, lawyers and accountants. The OAIC estimates more than 100,000 small businesses will, for the first time, have to comply with the Privacy Act for the personal information they handle in connection with those AML/CTF obligations — the long-standing small-business exemption (turnover under $3 million) won't cover it.

Second, the statutory tort for serious invasions of privacy is now in force. Crucially, it applies regardless of whether you're formally covered by the Privacy Act — an individual can sue an entity for a serious invasion of privacy, exemption or not. Note: separate proposals to remove the broader small-business and employee-records exemptions have been discussed but are not yet law — so plan for the direction of travel, not a specific repeal date.

Whatever your exemption status, the data you hold on your own staff is the most sensitive you'll ever handle: tax file numbers, bank account details, superannuation, dates of birth, home addresses, and often health information and disciplinary records. A breach of this data isn't just embarrassing — TFNs and bank details are exactly what identity thieves want, and payroll systems are a known target for business email compromise and ransomware.

That's why the smart move — regardless of exactly which reform lands when — is to treat your HR and payroll files as if they're already in scope. If a breach happens, "we were technically exempt" is not a comfortable place to stand in front of your staff or a court.

If you are covered by the Privacy Act and a data breach is likely to result in serious harm, the Notifiable Data Breaches (NDB) scheme requires you to notify the affected individuals and the OAIC. For HR/payroll data, "serious harm" is easy to reach — leaked TFNs and bank details clear that bar readily. Being able to detect, contain and report a breach quickly is the difference between a managed incident and a crisis.

You don't need to wait for the final shape of the reforms. The controls that matter are the same either way: encrypt HR and payroll data at rest; apply role-based access so only the people who need it can open it; turn on audit logging and data-loss-prevention (DLP) so you can see and stop sensitive data leaving; enforce multi-factor authentication on every account that touches it; and keep tested backups. A short privacy policy and a documented breach-response plan round it out.

The HR/legal side of this — knowing what data you hold and why — is manageable in-house. The technical controls (encryption, DLP, access logging, MFA, backup, breach detection) are where most businesses need specialist help. Our IT partner Frontrow Tech handles Essential 8 cyber and Microsoft 365 security for Australian businesses if you want your HR data locked down before the deadlines bite. General information only — not legal advice.