Privacy Act Changes: Findings from the F&P Forum and How Your NFP Can Stay Ahead

Update, November 2026: The first stage of the Privacy Act reforms discussed here, the Privacy and Other Legislation Amendment Act 2024, passed Parliament in November 2024. As the OAIC noted, it expanded the OAIC’s enforcement powers, with new tiers of civil penalties and the ability to issue infringement notices. It also requires privacy policies to include information about substantially automated decisions from 10 December 2026. A stricter definition of consent, under which consent must be voluntary, informed, current, specific and unambiguous, is in the exposure draft of the next stage of reforms, which was released for consultation in August 2026. That draft bill remains subject to further consideration by government.

At the recent F&P Forum in Sydney, where I had the honour of speaking, a powerful moment occurred - one that made clear just how urgent the data protection conversation has become for the not-for-profit (NFP) sector. When we asked the audience how many had experienced a data breach within their organisation, approximately 25% of attendees raised their hands. This figure was much higher than anticipated and certainly greater than the breaches officially reported to the Office of the Australian Information Commissioner (OAIC). It highlighted a growing concern within the sector: NFPs, large and small, are vulnerable to data breaches, and many may not yet have the frameworks in place to handle the increasing scrutiny from regulators like the Australian Charities and Not-for-profits Commission (ACNC), the Australian Communications and Media Authority (ACMA), and the Australian Competition and Consumer Commission (ACCC).

As we look towards imminent changes to the Privacy Act, it’s clear that non-profits must take urgent, proactive steps to safeguard donor trust and ensure compliance. At Marketsoft, we’ve been helping organisations navigate these complex regulatory landscapes, and we understand that the stakes for NFPs are high.

Why data protection matters more than ever for NFPs

In recent years, NFPs have become increasingly reliant on data to drive fundraising, outreach, and service delivery. Donor data, financial records, and even volunteer information form the backbone of many organisations, and protecting this data is not just a regulatory requirement - it’s essential to maintaining trust.

The challenge, however, is that many NFPs lack the resources to implement comprehensive data protection strategies. In fact, data governance is often seen as secondary to more immediate concerns like fundraising or program delivery. But with rising donor complaints and whistleblower reports, it’s clear that data breaches can have a devastating impact on an organisation’s reputation, donor relationships, and ultimately, their ability to deliver on their mission.

One of the key findings from the F&P Forum was that NFPs are particularly vulnerable to cyberattacks because of the sensitive nature of the data they hold. Donors trust NFPs with their personal information, and any breach of that trust can lead to both financial and reputational damage. What’s more, as the regulatory landscape tightens, NFPs will face greater accountability, with stricter reporting requirements and potential penalties for non-compliance.

Preparing for the upcoming Privacy Act changes

The Privacy Act is undergoing significant reforms that will impact how the organisations it covers, including NFPs with an annual turnover above $3 million and some smaller ones, manage personal data. These changes are designed to bring Australia’s privacy laws in line with global standards, such as Europe’s GDPR, and will include stricter consent requirements, increased transparency, and higher penalties for non-compliance.

At Marketsoft, we’ve been working closely with NFPs to help them prepare for these changes. Our approach is grounded in practical, actionable steps that ensure compliance while also strengthening the overall security and governance of data. Here’s what we recommend NFPs focus on as these regulatory changes approach:

Audit your data practices

The first step to compliance is understanding your current data protection practices. Conduct a thorough audit of how data is collected, stored, and processed within your organisation. Identify any potential gaps or vulnerabilities that could expose your organisation to risk.

Update privacy policies

The new Privacy Act will require more transparency around how personal data is used. Ensure your privacy policies are up to date and clearly explain how data is collected, processed, and shared. This not only helps with compliance but also reassures donors that their data is being handled responsibly.

Implement stronger consent mechanisms

With stricter consent requirements proposed, NFPs need to ensure that donors are fully informed about how their data will be used and that they have given clear permission for its use. Review your consent forms and procedures now, so they are ready if the proposed standards become law.

Invest in data security

Data breaches are often the result of weak security measures. Implement stronger security protocols, such as encryption, multi-factor authentication, and regular security audits. This will help protect your organisation from cyberattacks and reduce the risk of a data breach.

Train your team

Finally, ensure that everyone in your organisation understands their role in protecting data. Regular training sessions on data privacy and security best practices are essential to maintaining compliance and reducing the risk of human error.

Marketsoft’s expertise in data governance for NFPs

At Marketsoft, we specialise in helping NFPs develop strong data governance frameworks that not only ensure compliance but also enhance the overall effectiveness of their operations.

NFPs are recognising the importance of data protection, not just as a compliance measure but as a critical component of maintaining trust with donors and stakeholders. Our team has worked with a variety of NFPs to implement data protection strategies that fit their specific needs and resource constraints, and we’re committed to continuing this support as the regulatory landscape evolves.

Final thoughts

The findings from the F&P Forum were a wake-up call for many in the NFP sector. Data protection is no longer a ‘nice to have’ - it’s an essential part of any organisation’s risk management strategy. With changes to the Privacy Act imminent, now is the time for NFPs to take action, ensuring that their data practices are compliant, secure, and trustworthy.

At Marketsoft, we’re here to help NFPs navigate this complex journey. Our expertise in data governance, combined with our deep understanding of the not-for-profit sector, means we can support your organisation through these changes. Contact us to talk it through.