Yes. Since 10 June 2025, Schedule 2 of the Privacy Act 1988, inserted by the Privacy and Other Legislation Amendment Act 2024, has let Australians sue a person or organisation for a serious invasion of privacy, and creators whose home address, legal name, private messages or offline life are exposed can use it like anyone else. You have to show the other side intruded on your seclusion or misused information about you, that you had a reasonable expectation of privacy, that they acted intentionally or recklessly, that the invasion was serious, and that the public interest in your privacy outweighs any competing public interest.
This is general information, not legal advice. The OAIC's page on the tort says the regulator has no direct role in administering it and that people should get independent legal advice, which is the right starting point for any claim. Criminal doxxing laws are compared in is doxxing illegal, and getting leaked content taken down is covered by the leak response plan.
What counts as an invasion of privacy
The tort recognises two kinds of conduct. Intruding upon your seclusion includes physically intruding into your private space and watching, listening to or recording your private activities or affairs. Misusing information that relates to you includes collecting, using or disclosing it. Clause 7 makes the invasion actionable without proof of damage, so you do not need to show you lost money, and it says it is immaterial whether misused information was true, which matters when someone publishes invented claims alongside real details.
The OAIC notes that the tort is broader than the rest of the Privacy Act because it reaches individuals and organisations that are not covered by the Australian Privacy Principles. For creators, situations that could raise it include a hidden camera at a shoot location, someone filming into your home, a former partner publishing private messages, a person collating your legal name, suburb and gym and posting them next to your stage name, or a former business contact disclosing your health or financial details. Whether any of these succeeds depends on the elements below.
Elements checklist with the evidence to keep
The middle column paraphrases factors listed in clause 7 of Schedule 2; the court may consider others. Start collecting the evidence in the last column as soon as you know about the invasion.
| Element | What the court may weigh | Evidence to keep |
|---|---|---|
| An intrusion upon seclusion or a misuse of information | Physical intrusion, watching or recording private activities, or collecting, using or disclosing information about you | Links, screenshots and dates of each disclosure, any recordings found, and who saw or received them |
| A reasonable expectation of privacy | The means and technology used, the purpose, your age, occupation and cultural background, whether you invited publicity or showed a desire for privacy, the place, the nature of the information and how public it already was | Proof of the steps you took to keep it private, such as a separate stage identity, privacy settings, a suppressed address and who knew the information |
| Intentional or reckless conduct | Recklessness has the same meaning as in the Criminal Code | Messages showing they knew it was private, warnings you gave, and their own posts about exposing you |
| A serious invasion | The offence, distress or harm to dignity a person of ordinary sensibilities in your position would likely feel, whether they knew or ought to have known that, and any malice | A dated impact diary, how far the material spread, and any messages that show spite or intent to hurt |
| The public interest in your privacy outweighs competing interests | Competing interests can include freedom of expression, including artistic expression, media freedom, open justice, public health and safety, and preventing crime and fraud | Context showing the material was gossip or harassment rather than news, commentary or art |
| Proceedings started in time | The limitation periods in clause 14, explained further down | The date you first became aware of the invasion and how you found out |
Being a public creator is not the same as having no privacy
The reasonable expectation factors cut both ways for people who publish content for a living. A court may consider your occupation and whether you invited publicity, and a creator plainly invites attention to the persona they publish. The same clause also lets the court consider whether you manifested a desire for privacy, how you held or communicated the information, and whether and to what extent it was already in the public domain. Keeping a stage name separate from your legal identity, never posting your suburb and limiting who knows your address are all ways of showing that desire.
That makes the separation you build now part of any later claim. Record what you do to keep identities apart, and use the official tools: the guide to keeping your address private in Australia covers silent enrolment and suppressing business register details, and the doxxing exposure audit shows what is findable today. Information that is only partly public, such as a suburb mentioned once years ago, may be weighed differently from information that is widely known, because the Act asks the court to look at the extent.
Defences and exemptions
Clause 8 gives the defendant several defences: the invasion was required or authorised by law or a court or tribunal order; you, or someone with lawful authority for you, consented expressly or impliedly; they reasonably believed it was necessary to prevent or lessen a serious threat to someone's life, health or safety; or it was incidental to defending people or property and was proportionate, necessary and reasonable. Where the invasion involved publishing information, defamation-style defences of absolute privilege, publication of public documents and fair report of proceedings of public concern can also apply.
- Journalists are exempt for collecting, preparing or publishing journalistic material, but only people working professionally as journalists and subject to professional standards or a code of practice; an anonymous gossip account is not automatically a journalist.
- Law enforcement bodies, intelligence agencies, and disclosures made to them are exempt, and government agencies acting in good faith in their functions are too.
- The tort does not apply to an invasion by someone under 18, which rules it out against young leakers even when other routes remain.
- Implied consent is a defence worth watching, so read the consent and confidentiality clauses in any agency or brand contract, starting with the agency contract checklist.
Remedies table
Clauses 9, 11 and 12 set out what a court can order. The limits in the last column come from the Act's text.
| Remedy | What it does | Limits in the Act |
|---|---|---|
| Damages, including for emotional distress | Compensates you without the need to prove financial loss | No aggravated damages; the court can weigh any apology, correction, compensation already received, settlement efforts and the defendant's later conduct |
| Exemplary or punitive damages | Punishes and deters especially bad conduct | Exceptional circumstances only; together with non-economic loss, capped by clause 11(5) at the greater of $478,550 and the defamation maximum for non-economic loss |
| Injunction | Orders the defendant to stop, for example by not publishing or by removing material | Available at any stage, but for publication the court must have particular regard to the public interest in the information being published |
| Account of profits | Makes the defendant hand over money made from the invasion | One of the other remedies a court may grant instead of, or as well as, damages |
| Apology and correction orders | Require the defendant to apologise or publish a correction | A voluntary apology is not an admission of liability under clause 13 |
| Destruction or delivery-up order | Deals with material obtained, made or misused through the invasion, copies included | Covers material the defendant holds or is able to retrieve |
| Declaration | States formally that the defendant seriously invaded your privacy | Listed in clause 12 as a stand-alone remedy the court may grant |
Time limits, courts and process
The deadlines are short. Under clause 14 of the amending Act, you must start proceedings before the earlier of 1 year after you became aware of the invasion and 3 years after it happened, or before your 21st birthday if you were under 18 at the time. A court can extend the deadline where it was not reasonable to start on time, but clause 14(4) stops any extension going beyond 6 years after the invasion. A single publication rule treats a substantially similar republication by the same publisher, in a manner that is not materially different, as happening on the date of the first publication, so a repost does not restart the clock.
Jurisdiction is given to the Federal Circuit and Family Court, and the Act notes that the Federal Court and state courts can hear these matters too, as can territory courts. The court can grant summary judgment for a defendant if your claim has no reasonable prospect of success, and the Information Commissioner may intervene or assist with the court's leave. Ask a lawyer about costs before you file, including what happens if you lose.
How the tort fits with your other options
- Fast removal of intimate images, deepfakes included, usually runs through eSafety rather than a court; the Australian deepfake law map sets out its powers.
- Menacing publication of your personal data can be a crime, which police investigate without you having to fund a case.
- A complaint to the OAIC suits mishandling by organisations covered by the Australian Privacy Principles, which the Attorney-General's Department says apply to government agencies and businesses with an annual turnover of $3 million or more.
- False statements that damage your reputation may also support a defamation claim, which a lawyer can run alongside or instead of the tort.
- The tort is the route when you want compensation, an injunction or a court declaration against the specific person or business responsible.
Limitations of this guide
This explains the text of Schedule 2 as enacted, read on 1 October 2026, and is not legal advice. The tort is new, so there is little court guidance yet on how the factors apply to creators, and outcomes turn on detailed facts. The damages cap can move with defamation law, the deadlines can expire quickly, and a claim carries cost risks. Speak to a lawyer, community legal centre or legal aid service before relying on the tort, and contact police straight away if the invasion involves threats, stalking or someone coming to your home.