The Independent Media Agencies of Australia released its first Data Governance and Privacy Guiding Principles, months before the 10 December 2026 automated-decision transparency deadline and a penalty regime reaching A$50 million. If your agency handles your customer data, its exposure is now yours.
The Take: Australia's independent media agencies just published a privacy rulebook, and it is really a warning to their clients. The framework arrives months before new obligations and penalties that reach into the tens of millions. If your agency handles your customer data, its exposure has become your exposure.
The context: The Independent Media Agencies of Australia released its first Data Governance and Privacy Guiding Principles, a set of 12 principles covering consent-based data use, ethical audience targeting, vendor accountability and audit readiness. The timing is the point. From 10 December 2026, organisations must disclose in their privacy policy where personal information feeds an automated decision. The top tier of the reformed penalty regime reaches A$50 million for serious or repeated breaches.
Between the lines: A media agency does not write these rules for sport. It writes them because the audience data flowing through a campaign now carries legal weight that lands on the advertiser as much as the agency. The Office of the Australian Information Commissioner has already run a compliance sweep of around 60 businesses' privacy policies this year, a signal it means to enforce rather than educate.
The top-tier penalty under Australia's reformed privacy regime for serious or repeated breaches
The trade-off: Tighter data rules feel like friction, because they are. They also sort the market. An agency that can show a client exactly how audience data is collected, stored and retired wins the accounts that care about not being the next headline. The ones still running loose practices become a risk their clients quietly move away from. Procurement teams have started asking for this position in writing, and the agencies without one are dropping off shortlists.
For Australian operators: Ask your media agency for its data governance position in writing before the December deadline, not after a breach. Get specifics: where your customer data lives, who it is shared with, how consent is recorded and when data is deleted. If personal information feeds any automated targeting or decisioning, your privacy policy has to say so from 10 December. The agencies preparing now are showing you what good looks like. Hold the rest to the same line.