TL;DR: Since 10 June 2025, Australians can sue for a serious invasion of privacy in two ways: intrusion upon seclusion (e.g. someone entering your private space) or misuse of information about you. You must have had a reasonable expectation of privacy, and the public interest in your privacy must outweigh other interests. You can sue individuals and organisations. Deadline: generally one year from when you became aware, or three years from the invasion, whichever is earlier.
What changed
Before June 2025, Australia had no general right to sue for invasion of privacy. Now there’s a statutory tort, explained by the OAIC. Unlike the Australian Privacy Principles, which apply only to certain entities, the tort can be used against individuals and organisations.
The two types of invasion
| Type | Example |
|---|---|
| Intrusion upon seclusion | Physically entering your private space; covert surveillance |
| Misuse of information | Publishing or sharing private information about you |
What you need to show
- You had a reasonable expectation of privacy in all the circumstances.
- The public interest in your privacy outweighs any competing public interest.
- The invasion was serious (it’s a tort for *serious* invasions).
Defences and exemptions
- Consent or lawful authority is a defence.
- Exemptions apply to intelligence agencies, law enforcement bodies and, in certain circumstances, journalists.
Time limits
| Your situation | Deadline |
|---|---|
| Under 18 at the time | Before your 21st birthday |
| Everyone else | The earlier of 1 year after you became aware, or 3 years after it happened |
The one-year clock is tight. If something happens, get advice early.
Remedies
The court can award what it considers appropriate, such as:
- damages;
- an injunction (an order to stop);
- an order requiring an apology.
The OAIC’s role
None, directly. This is a court action, so you’ll need independent legal advice. For ordinary privacy complaints against businesses, the OAIC complaint process is still the cheaper route.
The first case: private wedding photos
The first published decision under the tort came in October 2025. In *Kurraba Group Pty Ltd v Williams* [2025] NSWDC 396, the NSW District Court dealt with a man who, after his demand for $50,000 to drop objections to a development was refused, ran a campaign against the developer and its CEO. Among other things, he published the CEO’s private wedding photographs without consent, in a way that suggested things the photos didn’t show, law firm Colin Biggers & Paisley explains.
What the court did:
- found a serious question to be tried on the privacy claim (along with defamation and intimidation);
- noted weddings are meant to be private and the CEO wasn’t a public figure;
- rejected the argument that the journalism exemption applied, calling the conduct coercion rather than reporting;
- granted injunctions to stop publication and require removal within two days.
That was interim relief, not a final judgment or damages, and the allegations were untested at that stage. But it shows the tort working as intended: fast orders to take private material down.
Where else it might apply
The tort is new, so courts are still shaping it. In our view it could be relevant to things like doxxing, hidden cameras or deliberately publishing someone’s private information, but every case turns on its facts. Get legal advice before relying on it.
Reduce your exposure first
Prevention beats litigation. A free exposure check shows where your email has leaked, and silent elector enrolment can keep your address off the public roll.
Frequently Asked Questions
Has anyone used Australia’s privacy tort yet?
Yes. In October 2025 the NSW District Court granted injunctions in Kurraba Group v Williams, partly over private wedding photos published without consent. It was interim relief, not a final judgment.
When did Australia’s privacy tort start?
The statutory tort for serious invasions of privacy commenced on 10 June 2025.
Can I sue an individual for invading my privacy in Australia?
Yes. The tort applies to individuals and organisations, not only entities covered by the Privacy Principles.
How long do I have to sue for invasion of privacy?
Generally the earlier of one year after becoming aware or three years after it happened. If you were under 18, before your 21st birthday.
Are journalists exempt?
Journalists are exempt in certain circumstances, as are intelligence and law enforcement bodies.
Sources
- OAIC: Statutory tort for serious invasions of privacy
- Colin Biggers & Paisley: First application for relief under the statutory privacy tort (Nov 2025)