Suing for invasion of privacy in Australia: the statutory tort explained

By the ITLAW Team · General information, not legal advice

For decades Australian courts declined to recognise a general right to sue for invasion of privacy. That changed when the Privacy and Other Legislation Amendment Act 2024 inserted a statutory tort into the Privacy Act 1988 (Cth), which commenced on 10 June 2025. Unlike most Privacy Act obligations, the tort can be used against individuals and businesses of any size, and it goes directly to court rather than through a complaint to the OAIC.

What a claimant must prove

• An invasion of privacy by either intruding upon their seclusion (for example, watching, listening to or recording them, or accessing their private space) or misusing information that relates to them (for example, collecting, using or publishing it).
• A reasonable expectation of privacy in all the circumstances.
• Intent or recklessness. Careless or negligent conduct is not enough.
• Seriousness. Courts can consider factors such as the degree of offence, distress or harm likely to be caused, and whether the defendant was motivated by malice.
• Public interest balance. The public interest in the claimant’s privacy must outweigh any countervailing public interest, such as freedom of expression or the proper administration of justice.

Defences and exemptions

Defences include conduct required or authorised by law, consent, conduct necessary to prevent or lessen a serious threat to life, health or safety, and lawful defence of persons or property. For publications, defences similar to those in defamation law apply, such as absolute privilege and fair reports of proceedings of public concern. Journalists and their employers, enforcement bodies and intelligence agencies are exempt in specified circumstances, and claims cannot be brought against people under 18.

Remedies and time limits

Courts can award damages, including for emotional distress, as well as injunctions, apologies, corrections and orders to destroy material. Damages for non-economic loss and exemplary damages are capped. Claims generally must be brought within one year of the claimant becoming aware of the invasion, and no later than three years after it occurred, with extended time for people who were under 18.

What it means for business

Businesses are unlikely to be sued for an honest mistake, but the tort creates real exposure for deliberate or reckless conduct. Higher-risk scenarios include:

• covert recording or surveillance of staff or customers, see our workplace technology guide
• staff deliberately accessing or sharing customer records out of curiosity or malice
• publishing private information about a person in a dispute or on social media
• ignoring known security risks to sensitive data, which may be argued to be reckless

Businesses can also be vicariously liable for employees acting in the course of their employment. Clear policies, access controls and training are the practical defence. For the wider framework, see our privacy law guide.

Frequently asked questions

When did the privacy tort start?

The statutory tort for serious invasions of privacy commenced on 10 June 2025.

Do I have to prove financial loss to sue?

No. The tort is actionable without proof of damage, and damages can include compensation for emotional distress.

Can I sue a business for a data breach under the tort?

Only if the invasion was intentional or reckless and serious. A breach caused by negligence alone is not enough, although other claims and regulatory action may be available.