Explainer
What Australia's Privacy Act reforms mean for B2B prospecting on LinkedIn
7 days free. No card. Then US$79/mo · See pricing
By the Bingle team · Published 27 October 2026 · Researched from the sources listed below, drafted with AI help and checked against those sources
Short answer
What do Australia's Privacy Act reforms mean for B2B prospecting on LinkedIn?
Since 10 June 2025 anyone, small businesses included, can be sued under a statutory tort for serious invasions of privacy, though the invasion has to be intentional or reckless and serious, and we found no case applying it to sales prospecting. Businesses the Privacy Act covers (generally those over A$3 million turnover) also face new civil penalty tiers and OAIC infringement notices from 11 December 2024, and from 10 December 2026 their privacy policies must describe computer-made decisions that significantly affect people. The larger 2026 rewrite is still an exposure draft, and if you want a prospecting tool that holds lead data in Sydney and waits for your OK before messages go, Bingle is one.
How we researched this
On 27 October 2026 we read the 2024 amending Act, the Privacy Act compilation of 4 June 2026, five OAIC pages and fact sheets, and the Attorney-General's Department consultation page, exposure draft and consultation paper. Parliament's website blocked our requests. The one court decision we mention comes from a secondary source, a NSW Crown Solicitor's Office summary.
What passed in 2024, and when each part starts
The Privacy and Other Legislation Amendment Act 2024 received Royal Assent on 10 December 2024, after the OAIC welcomed its passage on 29 November. Its commencement table staggers the start dates. The parts that touch prospecting are below.
| Change | In force from | Who it binds | Where prospecting meets it |
|---|---|---|---|
| Statutory tort for serious invasions of privacy (new Schedule 2) | 10 June 2025 | Any person. Its exemptions cover journalists, some government bodies and their staff, law enforcement, intelligence agencies and people under 18. None is based on turnover | What you collect about a lead and how you use it |
| New civil penalty tiers (s13G serious, s13H any interference) | 11 December 2024 | APP entities: businesses the Privacy Act covers | Any breach of the Australian Privacy Principles in your lead handling |
| Infringement and compliance notices (s13K) | 11 December 2024 | APP entities | Missing opt-out wording, slow opt-outs, not saying where you got someone's details |
| Automated decisions in privacy policies (APP 1.7 to 1.9) | 10 December 2026 | APP entities | Software that scores or ranks people, if the decisions significantly affect them |
| Small business exemption | Unchanged | Businesses with A$3 million turnover or less, with exceptions | Still the first question to ask |
That last row decides how much of the table reaches you. Under section 6D a business with annual turnover of A$3 million or less in the previous financial year is a small business, and the Australian Privacy Principles don't bind it. The exemption falls away if the business discloses personal information for a benefit, pays to collect it, provides a health service or holds a Commonwealth contract. On the Act's wording, paying for a lead list looks like providing a benefit to collect personal information, which is the exception most likely to catch a small seller; section 6D does carve out cases where the people concerned consented. That is our reading, not a ruling. The tort, below, has no such exemption.
The privacy tort: what someone would have to prove
Clause 7 of the new Schedule 2 gives an individual a cause of action against another person only when all five of these are true. The wording is the Act's; the order is ours.
- The defendant invaded their privacy by intruding upon their seclusion, by misusing information that relates to them, or both.
- A person in their position would have had a reasonable expectation of privacy in all of the circumstances.
- The invasion was intentional or reckless. Carelessness alone doesn't meet that wording.
- The invasion was serious.
- The public interest in their privacy outweighed any countervailing public interest, such as freedom of expression or the prevention of fraud.
For anyone working from public profiles, note what a court may weigh on a reasonable expectation of privacy in a misuse case: whether the information relates to intimate, family, health or financial matters, how the person held or shared it, and "whether and to what extent the information was already in the public domain". On seriousness, it looks at the likely offence, distress or harm to dignity for a person of ordinary sensibilities, and whether the defendant knew or should have known that. Consent, express or implied, is a defence.
If a claim succeeds, the invasion is actionable without proof of damage. Damages for non-economic loss and any exemplary damages together are capped at the greater of A$478,550 and the defamation cap, and aggravated damages are ruled out. A claim must start within one year of the person becoming aware of the invasion and no later than three years after it, though a court can extend that to six.
Has it been tested? The NSW Crown Solicitor's Office (a secondary source here) describes Kurraba Group v Williams [2025] NSWDC 396 as the first published application of the tort: an urgent injunction against a defendant who misused private wedding photographs in an alleged extortion campaign. That is a long way from a sales message. We found no decision applying the tort to business prospecting, so we offer no view on where a court would draw the line.
Our own practice, as caution rather than a legal rule: keep lead notes to work, company and the public signal you're answering.
Penalties, worked out in Australian dollars
These bind APP entities only. The OAIC uses a Commonwealth penalty unit of A$364 as at July 2026, and rows marked as our arithmetic multiply that unit by the number in the Act.
| Provision | What it covers | Maximum | Source |
|---|---|---|---|
| s13G | A serious interference with privacy | Body corporate: the greatest of A$50 million, three times the benefit obtained, or 30% of adjusted turnover. Anyone else: A$2.5 million | OAIC Guide to privacy regulatory action, chapter 7 |
| s13H | Any interference with privacy, serious or not | 2,000 penalty units: A$728,000. A body corporate can face five times that: A$3.64 million | The Act; OAIC chapter 7 for the five-times rule; dollars are our arithmetic |
| s13K, in court | Listed APP breaches, including direct marketing opt-out and source rules | 200 penalty units: A$72,800, and five times that for a body corporate | The Act; OAIC chapter 7 for the five-times rule; dollars are our arithmetic |
| s13K, infringement notice | The same breaches, without going to court | 12 penalty units (A$4,368) for an individual, 60 (A$21,840) for a body corporate, 200 (A$72,800) for a listed company, per alleged contravention | OAIC, Infringement notices (published 22 Sep 2026) |
The s13K list is the part a prospecting team can trip over in an ordinary week: a simple way to opt out of direct marketing, drawing attention to it, acting on an opt-out in a reasonable period, telling someone where you got their details when they ask, and a privacy policy with the required contents. From 10 December 2026 the new automated-decision paragraph in APP 1.7 joins the list.
One limit on that: APP 7, the direct marketing principle, steps aside to the extent the Spam Act 2003 applies. For a commercial LinkedIn message, the Spam Act's own consent, identification and unsubscribe rules may be the ones that apply, and our post on LinkedIn outreach in Australia covers what it says about LinkedIn messages.
Automated decisions from 10 December 2026: does lead scoring count?
From 10 December 2026, an APP entity's privacy policy must say more if three things are all true: it has arranged for a computer program to make a decision, or do something substantially and directly related to making one; the decision could reasonably be expected to significantly affect an individual's rights or interests; and personal information about that person is used in the program. The policy then lists the kinds of personal information used and the kinds of decisions involved.
The OAIC's September 2026 fact sheet says a computer program includes rule-based processes, ordinary software and generative AI. A decision can be in scope "even where a computer program output does not replace the entire decision-making process or is subject to human review". Buying a third-party program and relying on its advice both count as having arranged for it. Significantly means more than trivial, with the potential to considerably influence the person's circumstances or outcomes.
Its list of decisions generally in scope includes recruitment screening, credit, insurance and "programmatic advertising relating to the decision to sell significant goods or services". It has no example about choosing which business contacts to send a sales message to.
Whether ranking LinkedIn leads significantly affects the people ranked is an open question, and we don't answer it. Two points are clear. The OAIC generally expects the obligation to sit with the business using the program, with vendors giving customers high-level information about how their software makes decisions. And the OAIC says an entity in doubt "should take a cautious approach" and put the information in its policy. If you are below the A$3 million line and still exempt, APP 1.7 doesn't apply to you at all.
What's still to come: the 2026 exposure draft
On 31 August 2026 the Attorney-General's Department released an exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026, with a consultation paper describing roughly 40 proposals. Submissions closed on 18 September. On 27 October the department's page still says the bill "remains subject to further consideration by government", the draft's commencement table is blank, and we found no sign it has been introduced to Parliament. Parliament's own bills pages blocked our requests, so we couldn't confirm that there.
| The law today | What the exposure draft proposes |
|---|---|
| Collecting personal information | |
| APP 3: collect by lawful and fair means, and from the person unless that's unreasonable or impracticable | One test: collection, use and disclosure must be fair and reasonable in the circumstances, and lawful |
| What fair and reasonable weighs | |
| No such test | What a reasonable person would expect, transparency, whether less data would do, genuine choice, and harm against benefit. The consultation paper adds that expectations depend on whether information is publicly available and how it became public |
| What counts as direct marketing | |
| Not defined by a targeting test | Marketing material sent to someone selected or targeted, individually or as a member of a class, using their personal information |
| Consent for direct marketing | |
| Needed for some data from third parties, unless impracticable (APP 7.3) | "The framework does not require consent for direct marketing, but entities must obtain consent to trade personal information" |
| Opt-out | |
| A simple way to opt out; where the data came from someone else, a prominent opt-out statement in each message | A simple way to opt out, and each message must say how, in clear and concise language |
| Small business exemption | |
| A$3 million turnover line | Not removed. The draft changes section 6D only to fit its new definition of trading |
The draft also defines trading to include disclosing personal information for the purposes of direct marketing, and makes trading need consent. For a small seller, the practical reading is that sharing lead lists with a partner or buying them would come under closer rules, while messaging your own leads would not need consent under the Privacy Act, provided collecting them passed the fair and reasonable test. That is our reading of a draft that may change, and the Spam Act would still apply alongside it, as the draft's own APP 7 says.
A checklist for small Australian sellers, and where Bingle fits
Most of these are housekeeping you can start this week. They follow from the provisions above, and the choice of steps is ours.
- Work out whether you're an APP entity: check last financial year's turnover against A$3 million, and whether you buy, sell or swap personal information.
- Keep the source of every lead: the post, comment or job change that brought them in, with a date and link, so you can answer "where did you get my details?"
- Give every sales message a way to opt out, act on opt-outs quickly, and keep a record that you did.
- Keep lead notes to work facts. Leave out family, health, money and private life.
- If you're an APP entity and software ranks or filters the people you contact, decide before 10 December 2026 whether APP 1.7 applies, and write down why.
- Check the Attorney-General's consultation page again before you rebuild anything for the 2026 draft.
Bingle is the LinkedIn outreach tool we make. Its privacy policy says the app and its database both run in Sydney, the database host encrypts stored data, and some services Bingle uses, including the AI providers, may process data outside Australia. What it keeps about a lead is public LinkedIn profile details, posts and buying signals for people who fit your ideal customer. Its user guide says each lead's intent is something dated they or their company did, shown with the date and a link to the source.
So every lead carries its source. And if you decide APP 1.7 covers your use of lead scoring, the guide describes the score: a number from 0 to 100 that blends how well someone fits your ideal customer with how strong and recent their signals are. Message drafts wait in an approval queue for your OK unless you switch review off for a sequence, any reply stops the sequence, and you can switch automatic sending off and send each step yourself.
Where Bingle won't help: it doesn't write your privacy policy. Profile visits, likes and blank invites in a running sequence go out without a review step. It's LinkedIn only, with no email sequences and no self-serve CRM integration, so opt-outs you receive elsewhere need recording by hand. Its privacy policy also says it is an early product with no security certifications yet. Bingle is 7 days free with no card, then from US$49 a month; see pricing.
Questions
Does the Privacy Act apply to my small business?
Not if your annual turnover last financial year was A$3 million or less and no exception applies; buying or selling personal information, health services and Commonwealth contracts are the common ones. The statutory privacy tort applies to you either way.
Can someone sue me for sending them a LinkedIn message?
Under the tort they would need to show, among other things, an intentional or reckless invasion of privacy that a court finds serious. We found no published decision applying it to a sales message; for your own situation, ask an Australian lawyer.
When do the automated decision-making rules start?
On 10 December 2026, for APP entities only. They apply to decisions made after that date, whenever the software was set up or the data collected.
Has the second tranche of Privacy Act reform passed?
No. As of 27 October 2026 it is the exposure draft Privacy Amendment (Personal Data Protection) Bill 2026; consultation closed on 18 September 2026 and the Attorney-General's Department says it remains subject to further consideration by government.
Sources
- Federal Register of Legislation, Privacy and Other Legislation Amendment Act 2024 (No. 128, 2024), as made. read 27 Oct 2026
- Federal Register of Legislation, Privacy Act 1988 (compilation 4 June 2026), s6D, Schedule 1 and Schedule 2, endnotes. read 27 Oct 2026
- OAIC, Passing of bill a significant step for Australia's privacy law. published 29 Nov 2024; read 27 Oct 2026
- OAIC, Guide to privacy regulatory action, Chapter 7: Civil penalties. published Dec 2024; read 27 Oct 2026
- OAIC, Infringement notices. published 22 Sep 2026; read 27 Oct 2026
- OAIC, New resources on transparency for use of AI and automated decision-making. published 30 Sep 2026; read 27 Oct 2026
- OAIC, APP 1.7-1.9 Transparency Obligation Fact Sheet. dated September 2026; read 27 Oct 2026
- Attorney-General's Department, Privacy reform consultation. read 27 Oct 2026
- Attorney-General's Department, Exposure draft Privacy Amendment (Personal Data Protection) Bill 2026. read 27 Oct 2026
- Attorney-General's Department, Privacy reform consultation paper. read 27 Oct 2026
- NSW Crown Solicitor's Office, Key legal decision: Kurraba Group Pty Ltd & Anor v Williams (secondary source). last updated 30 Jan 2026; read 27 Oct 2026
More from the blog
- Is LinkedIn outreach legal in Australia? What the Spam Act and Privacy Act mean for your messages
- How to choose a LinkedIn outreach tool in Australia (prices in A$)
- How to score LinkedIn leads by fit and intent (with a worked formula)
- How to find Australian startups that just raised funding (and when to reach out)
- Skylead alternatives: LinkedIn and email tools compared
- UserGems alternatives for small teams: job-change tracking without an enterprise contract
See who's looking right now
Your first leads show up in minutes, each with its reason. Free for 7 days, no card.