OAIC Annual Report 2025–26
The Office of the Australian Information Commissioner (OAIC) has released its 2025–26 Annual Report, revealing a significant increase in privacy complaints, data breaches and freedom of information (FOI) requests. The findings highlight growing public expectations around transparency, accountability and the responsible management of information, reinforcing the critical role records and information management (R&IM) professionals play in protecting information rights and maintaining public trust.
The report reveals a 60% increase in privacy complaints, a 42% rise in Information Commissioner review applications, an 18% increase in data breach notifications and a 35% increase in FOI complaints. A record 1,327 notifiable data breaches were reported during 2025–26, while 15 cyber incidents affected more than one million individuals each, compared with just two incidents of that scale the previous year. These figures reinforce the importance of effective information governance, robust security controls, defensible retention and disposal practices and proactive risk management.
Freedom of information also remains a significant focus, with Australian Government agencies and ministers receiving a record 46,933 FOI requests, an increase of 8%. The OAIC has prioritised improving FOI timeliness, strengthening agency compliance and promoting greater transparency in government decision-making. For R&IM professionals, these findings highlight the importance of accurate recordkeeping, effective classification, reliable information retrieval and well-managed information lifecycles to support timely access to government-held information.
Artificial intelligence and automated decision-making (ADM) are emerging as major regulatory priorities. The OAIC has increased its focus on transparency, privacy protections and accountability in the use of emerging technologies. With new ADM transparency obligations commencing on 10 December 2026, affected organisations will need to disclose certain uses of automated decision-making in their privacy policies. The report also highlights the OAIC's work examining government agencies' transparency around ADM and the importance of protecting information rights as AI becomes increasingly embedded in organisational processes.
The report also signals a more proactive approach to regulatory compliance and enforcement. During 2025–26, the OAIC undertook privacy compliance activities, investigated information-handling practices and secured Australia's first civil penalty order under the Privacy Act, with Australian Clinical Laboratories ordered to pay $5.8 million following a 2022 data breach. Looking ahead, the OAIC's 2026–29 Strategic Plan identifies information integrity, transparency, accountability and fairness in emerging technologies as key priorities, signalling continued regulatory attention to how organisations collect, manage, protect and use information.
For RIMPA Global Members, the message is clear: strong records and information management has never been more important. As privacy expectations increase, AI adoption accelerates and regulatory scrutiny intensifies, R&IM professionals have a vital role in ensuring information remains secure, accessible, trustworthy and appropriately governed throughout its lifecycle. The OAIC's findings provide a valuable opportunity for organisations to review their information governance frameworks, strengthen compliance practices and recognise the strategic value of effective R&IM.