Someone has filmed you without asking, shared your private messages, or published your address. You feel your privacy has been breached. Or maybe you have been told that something you posted about another person breaches their privacy.
Privacy law in New South Wales is not in one place. Since 10 June 2025 there has also been a federal right to sue for a serious invasion of privacy, which the old version of this page did not cover. This guide explains the laws that now apply, what you have to prove to sue, what a court can order, the time limits, and what to do first.
Privacy law in NSW at a glance
- The new right to sue: a statutory tort for serious invasions of privacy, in Schedule 2 to the Privacy Act 1988 (Cth), in force since 10 June 2025.
- Two ways it happens: intruding upon someone’s seclusion, or misusing information about them.
- Fault required: the invasion must be intentional or reckless, not merely careless.
- Court-ordered money: damages for emotional distress are possible, with a cap on non-economic and exemplary damages (the greater of $478,550 and the defamation cap).
- Time limit: generally the earlier of 1 year from when you became aware and 3 years from the invasion (cl 14).
- The one thing to do now: keep the evidence, do not respond publicly, and get legal advice before the time limit runs.
What privacy laws apply in NSW?
Four sets of rules can apply for privacy laws, and which one fits depends on who invaded the privacy and how. There is no single “NSW privacy law”.
| Law | Who it covers | What it does |
|---|---|---|
| Statutory privacy tort (Privacy Act 1988 (Cth), Sch 2) | An individual can sue another person, including an individual or business, subject to the exemptions below | A right to sue for a serious invasion of privacy |
| Australian Privacy Principles (Privacy Act 1988 (Cth)) | Federal agencies and larger organisations (businesses with annual turnover of $3 million or less are generally outside it) | Rules for collecting, holding and disclosing personal information, plus a data breach notification scheme |
| NSW PPIP Act and HRIP Act | NSW public sector agencies (PPIP Act); health information (HRIP Act) | Privacy principles, internal review and NCAT review |
| Criminal offences (Commonwealth and NSW) | Anyone | Offences for harassing publication of personal data, secret surveillance and intimate images |
The tort is different because it can be used against a person, not only against an agency or a large business.
What is the federal statutory tort for serious invasions of privacy?
It is a new civil cause of action that lets an individual sue another person who seriously invaded their privacy. It commenced on 10 June 2025 and is found in Schedule 2 to the Privacy Act 1988 (Cth).
Before then, Australian courts had not recognised a general right to sue for invasion of privacy, and the common law position was not settled. A “tort” is simply a civil wrong you can sue over.
It does not replace other claims. Under cl 21, State and Territory laws continue to operate alongside it, and the same event may also support a claim in defamation or breach of confidence. For the defamation side, see our defamation fact sheet.
What do you have to prove?
To succeed, a plaintiff (the person suing) has to prove five things under cl 7(1) of Schedule 2. Each is a separate hurdle.
- An invasion of privacy, by intruding upon your seclusion, misusing information about you, or both. Intruding includes physically entering private space and watching, listening to or recording private activities or affairs. Misusing information includes collecting, using or disclosing it.
- A reasonable expectation of privacy in all the circumstances, judged from the position of a person like you.
- Intent or recklessness. The invasion must have been intentional or reckless. Mere carelessness is not enough.
- Seriousness. Minor or fleeting intrusions are unlikely to qualify.
- Public interest. The public interest in your privacy must have outweighed any countervailing public interest, such as freedom of expression, the media, open justice or the prevention of crime and fraud.
You do not need to prove a financial loss. Also, if the claim is about information, it does not matter whether it was true.
A court weighing expectation and seriousness may look at the place, the device used, and the nature of the information. The types of information include intimate, family, health and financial matters. Whether malice was involved is also a huge factor the courts will consider.
What defences and exemptions apply?
The Act gives specific defences, and it excludes some people and bodies from the tort altogether. It helps to separate the two.
Defences (cl 8). It is a defence if the invasion was:
- Required or authorised by an Australian law or a court or tribunal order;
- Consented to, expressly or impliedly, by you or someone with lawful authority for you;
- Reasonably believed necessary to prevent or lessen a serious threat to a person’s life, health or safety; or
- Incidental to a lawful defence of persons or property, and proportionate, necessary and reasonable.
Where the invasion was a publication, defamation-style defences may also apply. These might include absolute privilege, publication of public documents, and a fair report of proceedings of public concern.
Exemptions (Part 3). The tort does not apply to:
- Journalists and people assisting them, to the extent the conduct involves collecting, preparing or publishing journalistic material. A “journalist” must work professionally as one and be subject to professional standards or a code of practice.
- Law enforcement bodies, including NSW Police, the NSW Crime Commission, ICAC and the Law Enforcement Conduct Commission, and their staff doing their jobs.
- Intelligence agencies, such as the Australian Criminal Intelligence Commission.
- Other government agencies and their staff acting in good faith in their functions, and people under 18.
Therefore a complaint about how the police handled your information will not go through the tort. See our guide to NSW Police exemptions from privacy laws.
What can a court order, and how much?
A court can award damages, order an apology or correction, grant an injunction and make other orders. Damages are not unlimited.
| Remedy | Detail (Sch 2) |
|---|---|
| Damages | Available, including for emotional distress (cl 11(3)). Aggravated damages cannot be awarded (cl 11(2)) |
| Exemplary or punitive damages | Only in exceptional circumstances (cl 11(4)) |
| Cap | Non-economic loss plus exemplary damages combined cannot exceed the greater of $478,550 and the defamation non-economic loss cap (cl 11(5)) |
| Injunction | Can be granted at any stage to stop an invasion of privacy (cl 9) |
| Other orders | An account of profits, an apology, a correction, destruction or delivery up of material, and a declaration (cl 12) |
A court can consider whether the defendant apologised or took reasonable steps to settle (cl 11(6)), and an apology is not an admission of liability (cl 13). That helps people on either side resolve a dispute without a hearing.
How long do you have to sue?
Generally you must start proceedings before the earlier of one year from when you became aware of the invasion and three years from when it happened. If you were under 18 at the time, the deadline is your 21st birthday.
A court can extend the time if it was not reasonable in the circumstances to start within the normal period, but never beyond six years after the invasion. As the standard period is short, do not wait to see whether the problem goes away.
What is the NSW privacy regime for government agencies and health information?
NSW has its own privacy laws for the public sector and for health information, separate from the federal tort. They give you a complaint and review path against agencies, not a right to sue an individual neighbour or ex-partner.
- PPIP Act. The Privacy and Personal Information Protection Act 1998 (NSW) sets 12 Information Protection Principles. It covers NSW government agencies, local councils, universities, and Ministers and their offices. It does not bind individuals, so it is not the route against a neighbour or an ex-partner.
- HRIP Act. The Health Records and Information Privacy Act 2002 (NSW) sets 15 Health Privacy Principles for how health information is collected, held, used and disclosed.
- The regulator. The Information and Privacy Commission NSW (IPC) is the independent statutory authority that administers both Acts.
- Internal review. If you think an agency has breached your privacy, you can ask the agency to review its conduct. Strict time limits apply, so check the current guidance from the Information and Privacy Commission NSW straight away.
- NCAT. If you are unhappy with the result, or no outcome arrives, you may be able to ask the NSW Civil and Administrative Tribunal (NCAT) to review the conduct. A short time limit applies, so check the date on your outcome letter and get advice straight away.
What counts as personal information and health information?
Privacy laws protect “personal information”, and give extra protection to “health information”. Knowing which one your problem involves helps work out which law applies.
Personal information is any information or opinion about a person whose identity is apparent, or can reasonably be worked out from it. It includes:
- your name, address and other personal details in a written record;
- information in a database, even if it is not recorded in material form;
- photographs, images, video or audio of you; and
- your fingerprints, blood or DNA samples.
Health information is a kind of personal information. It covers information or an opinion about your physical or mental health or disability, your wishes about future health services, or a health service you receive. It also includes other personal information collected to provide a health service or in connection with donating body parts, organs or body substances, genetic information that could predict your health or a relative’s, and healthcare identifiers.
What about data breaches?
If an organisation lost or leaked your personal information, a separate notification scheme may apply. Larger Australian organisations that must follow the Australian Privacy Principles have to assess and notify “eligible data breaches”, meaning unauthorised access or disclosure likely to result in serious harm (Part IIIC of the Privacy Act, s 26WE).
Our guide to what to do after a privacy breach covers the steps. For how NSW compares with other states, see comparing privacy rights in Australia.
When can a privacy invasion become a criminal charge?
Some conduct that breaches privacy is also a criminal offence, which is why this topic matters for people who have been charged as well as people who have been affected. The civil tort and the criminal law are separate, and one event can lead to both.
- Doxxing. Using a carriage service to make available, publish or distribute someone’s personal data in a way reasonable persons would regard as menacing or harassing is an offence under s 474.17C of the Criminal Code, with a maximum of 6 years’ imprisonment. A related offence in s 474.17D, with a maximum of 7 years, applies where the conduct is engaged in because of a belief that a group is distinguished by characteristics such as race, religion, sex, sexual orientation, disability or national or ethnic origin.
- Secret recording and tracking. The Surveillance Devices Act 2007 (NSW) regulates the use of surveillance devices, including listening and tracking devices.
- Intimate images and voyeurism. The Crimes Act 1900 (NSW) contains offences for filming private acts and for sharing intimate images. See our revenge porn NSW fact sheet.
A maximum penalty is not a prediction: real outcomes depend on the facts, the person’s history and the court. If you are facing one of these charges, see our criminal defence services.
Your rights and what you can do now
The first steps are about protecting evidence and not making things worse. What you do in the first few days often matters more than anything you do later.
If your privacy has been invaded:
- Preserve the evidence. Take dated screenshots, save URLs, keep messages and note who saw or received the material. Do not rely on it staying online.
- Do not retaliate publicly. A hostile reply can create a problem for you, including a defamation claim.
- Work out the date you became aware. The one-year period in cl 14 is measured from then.
- Ask for removal. Platforms often have takedown processes. Keep a record of each request.
- Choose the right route: an individual or business (the tort), a NSW agency (internal review and NCAT), or an organisation that lost your data (the notification scheme).
- Get advice early. A short time limit and a high seriousness threshold both reward early assessment.
If you have been accused of invading someone’s privacy:
- Do not delete anything. Deleting material can look like an attempt to hide it and may make things worse.
- Do not contact the other person to argue or apologise informally until you have advice.
- Do not speak to police beyond confirming your identity. Get legal advice before answering questions about a possible criminal matter.
How a lawyer could help your privacy case
A solicitor can tell you honestly whether a matter clears the high bar the tort sets, and which route is the right one. That assessment saves time and cost whichever side you are on.
Depending on the circumstances, a lawyer may be able to:
- Assess the five elements, particularly seriousness and whether the public interest in your privacy outweighs competing interests.
- Identify the right claim, such as defamation, breach of confidence or the NSW internal review path.
- Move quickly on evidence and injunctions, where stopping further sharing is the main aim.
- Negotiate an outcome, such as removal of material, an apology, a correction or a settlement.
- Defend a claim, by testing whether the plaintiff can show reasonable expectation, intent or recklessness and seriousness, and by raising defences or exemptions where they apply.
- Advise where a charge is also involved, so that what is said in the civil matter does not harm the criminal one.
Every matter turns on its own facts. No solicitor can promise a particular result.
Frequently asked questions
Is there a right to sue for invasion of privacy in Australia?
Yes, since 10 June 2025. Schedule 2 to the Privacy Act 1988 (Cth) created a statutory tort for serious invasions of privacy. It requires an invasion by intrusion or misuse of information, a reasonable expectation of privacy, intent or recklessness, seriousness, and that the public interest in privacy outweighed competing interests.
Does the privacy tort apply in NSW?
Yes. It is a federal law that applies across Australia, and the Act says state and territory laws continue to operate alongside it. Federal and state courts can hear these claims.
Who can I sue for a serious invasion of privacy?
Another person, including an individual or a business. Journalists (for journalistic material), law enforcement bodies, intelligence agencies, agencies acting in good faith and people under 18 are exempt. Complaints about NSW public sector agencies generally go through PPIP Act internal review instead.
Can I sue if the information about me is true?
Yes. For the information-misuse branch of the tort, it does not matter whether the information was true (cl 7(7)). That is a key difference from defamation, where truth is a defence.
How long do I have to start a privacy claim?
Generally before the earlier of one year after you became aware of the invasion and three years after it happened. If you were under 18, you have until your 21st birthday. A court can extend the time in limited circumstances, but never beyond six years after the invasion.
Is it a crime to share someone’s personal details online?
It can be. Publishing personal data in a way reasonable persons would regard as menacing or harassing can be an offence under s 474.17C of the Criminal Code, with a maximum of 6 years’ imprisonment. Other offences, such as those about intimate images, may also apply depending on the facts.
Can I complain about NSW Police or another NSW agency handling my information?
Possibly, but not through the new tort. Law enforcement bodies are exempt from it. For NSW public sector agencies, the PPIP Act internal review route, and then NCAT, is the path to consider. Time limits apply, so ask for advice promptly.
How O’Brien Criminal & Civil Solicitors can help
O’Brien Criminal & Civil Solicitors is an established Sydney firm acting in both criminal and civil matters, which matters in privacy disputes because the same conduct can raise a civil claim and a criminal charge at once. We can give you a clear view of which rules apply, whether you are the person affected or the person accused, and how to protect your position early.
Our team can help you preserve evidence, negotiate, or respond to a claim or charge, always tailored to the facts and never with a promised result.
Request initial advice (no-obligation) via the form below or call us on (02) 9261 4281.
This content is for general information purposes only and does not constitute legal advice. You should seek independent legal advice relevant to your specific circumstances.
