During the period August 2024 to 30 September 2026 there have been only four published determinations by the OAIC where compensation has been awarded, with the compensation awards ranging from $7,500 to $10,000. In March 2026 the OAIC announced a new approach in how it will be handling individual privacy complaints arising out of a data breach which is the subject of court proceedings, an investigation or a representative complaint.
Read more
On 7 September, 2026, the Australian Government released its proposed legislation – Competition and Fair Work Legislation Amendment (Banning Unfair Non-Competes) Bill 2026 – which will ban non‑compete clauses in employment contracts for low and middle income Australian workers, with some exceptions. Businesses affected by the proposed ban can make submissions to the Government on the draft Bill until 2 October 2026 via https://consult.treasury.gov.au/
Read more
The TGA’s principles provide guidance in relation to its compliance activities and priority focus areas for the next two years. Businesses operating in these areas should undertake internal compliance reviews to ensure that they are compliant with the Therapeutic Goods Act and regulations including the Therapeutic Goods Advertising Code.
Read more
Non-compliance with the Therapeutic Goods Act or the Therapeutic Goods Advertising Code can result in infringement notices and court proceedings being issued by the regulator against the company and its directors and officers. Ignorance of the law is no excuse. We review some recent court decisions which highlight key matters for company directors to consider in order to minimize the risk of personal civil liability for breach of the TG Act and related criminal prosecution.
Read more
In this update, Stephens Lawyers & Consultants provides a review of selected determinations made (and published) by the Office of the Australian Information Commissioner (OAIC) during the period August 2024 to 30 September 2026 in relation to privacy breaches in which compensation was awarded – and the factors that the OAIC takes into account in assessing whether compensation should be awarded to the complainant.
Read more
From 30 May 2025 all businesses that have an annual turnover of $3 million in a financial year, must report a ransomware or cyber extortion within 72 hours of making or having a payment made on its behalf. This is in addition to existing reporting obligations under the Notifiable Data Breach scheme. This article explores these reporting obligations and offers guidance on some strategies to consider for data protection and privacy law compliance.
Read more
