03 9070 9810

Limitation Periods for Privacy Claims

Strict limitation periods apply. Delay can extinguish your claim entirely, regardless of its merits.

Book a Confidential Assessment

Max file size: 20MB

The Limitation Period for Privacy Claims Under Schedule 2

The statutory tort for serious invasion of privacy under Schedule 2 of the Privacy Act 1988 (Cth) carries strict time limits. If you miss the deadline, the court will refuse to hear your claim. It does not matter how serious the invasion was or how strong the evidence is. The limitation period is a hard boundary.

For any individual considering a privacy claim in Australia (as this cause of action is available only to natural persons, not corporations), this is the first thing to establish. You may have as little as 12 months from the date you became aware of the invasion to commence proceedings. In many cases, that window has already started running. If you believe your privacy has been seriously invaded, the single most important step you can take right now is to confirm whether you are still within time.

We offer a confidential initial assessment for a fixed fee of $770 (inc GST). One of the matters we address in every assessment is whether the limitation period has expired or is about to expire, and if so, whether an extension is available.

The clock is ticking. You may have as little as 12 months to act.

A $770 fixed-fee assessment will confirm whether your claim is still within time and what steps to take next.

How the Privacy Tort Time Limits Work

Three rules determine whether you can still bring a claim under Schedule 2.

Moment of discovering a privacy invasion

Rule 1: One Year From Awareness

You must commence proceedings within one year of the date you first became aware (or ought reasonably to have become aware) that your privacy was invaded. This is the primary limitation period. It runs from knowledge, not from the date of the invasion itself. For example, if someone installed a hidden camera in your rental property in January 2026 and you discovered it in August 2026, the one-year clock starts in August 2026, not January. You would have until August 2027 to file. But if you knew about the camera in January and did nothing, your deadline is January 2027.

Three-year timeline for privacy claims

Rule 2: Three Years From Occurrence (Absolute Backstop)

Regardless of when you became aware of the invasion, you cannot bring a claim more than three years after the invasion occurred. This is the outer limit. It operates as a backstop even where the plaintiff had no way of knowing about the invasion. Using the same example: if the hidden camera was installed in January 2026 and you did not discover it until January 2029 (three years later), you would be out of time under the three-year rule, even though you only just became aware. The three-year period runs from occurrence, not awareness. This means that covert invasions discovered late may fall outside the limitation window.

Court extension applications for privacy claims

Rule 3: Extension of Time (Court Discretion)

In exceptional circumstances, the court may extend the limitation period. Extensions are discretionary, not automatic. The applicant must demonstrate good reasons for the delay. The court will consider the length of and reasons for the delay, any prejudice to the defendant, and whether it remains possible to have a fair hearing. An extension application is a separate proceeding and involves cost and uncertainty. It is not a substitute for acting promptly. If you are approaching or past the one-year or three-year deadline, seek legal advice immediately.

Worked Examples: When Does the Clock Start and Stop?

Example 1: Neighbour Surveillance (Known From the Start)

In March 2026, you notice your neighbour has installed a CCTV camera pointing directly into your backyard. You raise it with them. They refuse to move it. Under state surveillance legislation in Victoria, outdoor surveillance is not a criminal offence. But under the statutory tort for serious invasion of privacy, you may have a civil claim for intrusion upon seclusion. Because you became aware of the camera in March 2026, you have until March 2027 to commence proceedings (one year from awareness). The three-year backstop runs until March 2029, but it is irrelevant here because the awareness clock expires first. If you wait until April 2027, your claim is, on its face, barred by the statute of limitations (the legal deadline for starting a claim).

Example 2: Hidden Camera in an Airbnb (Discovered Later)

You stay in a short-term rental in September 2026. In June 2028, a police investigation reveals that the property had a hidden camera in the bedroom. You are notified by police. Your one-year awareness clock starts in June 2028. You have until June 2029. The three-year backstop runs from September 2026 to September 2029. Both deadlines fall in 2029, but the awareness deadline (June) expires first. You must file by June 2029 at the latest. If you only learned about the camera in October 2029 (more than three years after the stay), you would be outside the three-year backstop and would need to apply for an extension.

Example 3: Ongoing Invasion (Tracking or Account Access)

Where the invasion is continuous, such as an ex-partner tracking your phone or accessing your accounts over a period of months, the limitation period may apply to each act of invasion separately. The one-year and three-year periods would likely run from the most recent act of invasion, not the first. This is an area where there is no Australian case law yet, and courts may look to analogous positions in UK and New Zealand privacy legal principles and case law. The practical point is this: ongoing invasions generally give you more time, but you should not assume this. Confirm your position with a solicitor.

Example 4: Misuse of Private Information Published Online

Someone publishes your private financial information online in April 2026. You see the publication the same day. Your one-year deadline is April 2027. But what if the same information remains accessible online for years? Under defamation law, most Australian jurisdictions have adopted a 'single publication rule' where the time limit runs from the first publication. Currently, only Western Australia and the Northern Territory retain the 'multiple publication rule' where each download may constitute a fresh publication. Whether the same principle applies to the privacy tort has not yet been tested in an Australian court. The safer approach is to treat the original date of publication as the starting point and act within 12 months of becoming aware of it.

The Relationship Between Awareness and Occurrence

The two limitation periods (one year from awareness, three years from occurrence) operate concurrently. The claim expires when the earlier of the two deadlines passes. In most cases, this will be the one-year awareness deadline, because people tend to discover invasions within three years. The three-year backstop becomes critical only where the invasion was covert and discovered late.

A Note on Urgency and Injunctions

If the invasion is ongoing, you do not need to wait. You may be able to obtain an urgent privacy injunction to stop the conduct immediately, and then pursue compensation and damages within the limitation period. Acting early preserves evidence and strengthens your position.

Overlap With Defamation

Where the invasion involved publication of private information that also damaged your reputation, you may have concurrent claims in privacy and defamation. Defamation claims carry their own limitation period (one year from publication in most Australian jurisdictions). If both claims arise from the same conduct, both deadlines must be met. We practise in both areas. For defamation-related matters, see defamationlawyer.au.

Disclaimer: This page provides general information about limitation periods under the statutory tort for serious invasion of privacy. It is not legal advice. Limitation periods depend on the specific facts of each case. If you are unsure whether you are still within time, obtain legal advice without delay.

Do Not Assume You Have Time

The limitation period may already be running. A confidential initial assessment ($770 fixed fee) will establish your deadline and your options.

Why Limitation Periods Matter

Understanding the deadline is not a technicality. It determines whether you have a claim at all.

Miss the Deadline, Lose the Claim

Once the limitation period expires, the court cannot hear your case. The strength of the evidence and the seriousness of the invasion become irrelevant.

Evidence Degrades Over Time

Digital records are deleted. Witnesses forget. Surveillance footage is overwritten. Acting early preserves the material you need to prove your claim.

Injunctions Require Urgency

If you need the court to stop an ongoing invasion, delay weakens your application. Courts expect plaintiffs seeking urgent relief to act promptly.

Extensions Are Discretionary, Not Guaranteed

The court may extend time in certain circumstances, but it is not obliged to. An extension application adds cost, delay, and uncertainty to your claim.

Concurrent Claims Have Separate Deadlines

If your matter involves both privacy and defamation, each cause of action has its own limitation period. Missing one does not excuse the other.

Certainty Costs $770

A fixed-fee confidential initial assessment will confirm whether you are within time, what your deadline is, and what you should do next. No ambiguity.

Common Questions About Privacy Claim Time Limits

You must commence proceedings within one year of becoming aware (or reasonably ought to have become aware) of the invasion, or within three years of the invasion occurring, whichever deadline arrives first. In most cases, the one-year awareness deadline will be the binding constraint.

The one-year clock only starts when you become aware of the invasion (or when you reasonably should have become aware). However, the absolute backstop is three years from the date the invasion occurred. If you discover the invasion more than three years after it happened, you may need to apply to the court for an extension, which is discretionary and subject to a court-determined limit.

The court has discretion to extend the limitation period in certain circumstances. Extensions are not automatic. You must demonstrate good reasons for the delay. The court will weigh factors including prejudice to the defendant and the possibility of a fair hearing. If you believe you may be out of time, obtain legal advice urgently. Do not assume an extension will be granted.

Where the invasion is continuous (for example, ongoing tracking, repeated access to accounts, or a surveillance camera that remains in place), each act of invasion may trigger its own limitation period. The practical effect is that the deadline may run from the most recent act, not the first. This area has not yet been tested in an Australian court. It is prudent to act on the basis of the earliest known date and not rely on an untested argument about ongoing conduct.

No. Defamation claims in most Australian jurisdictions must be commenced within one year of publication. The privacy tort has a separate limitation framework (one year from awareness or three years from occurrence). If the same conduct gives rise to both claims, you must meet both deadlines independently. For defamation matters, see defamationlawyer.au.

Awareness refers to knowledge of the invasion itself, not knowledge of its legal characterisation. If you saw the camera, knew about the tracking, or read the published information, that is likely sufficient to start the clock. You do not need to have known that the conduct was actionable under the statutory tort. Ignorance of the law is not a basis for extending time.

The OAIC complaint pathway under the Privacy Act operates under its own timeframes and is a separate regime from the statutory tort under Schedule 2. The OAIC generally expects complaints to be lodged within 12 months, though the Commissioner has discretion. It is generally understood that lodging an OAIC complaint does not pause or extend the limitation period for a court claim under the statutory tort. If you are considering both avenues, see our comparison at OAIC Complaint vs Suing for Invasion of Privacy.

A pre-action demand letter does not stop or extend the limitation period. It may, however, prompt a resolution without the need for court proceedings. If the limitation deadline is approaching, the priority is to ensure proceedings can be filed in time. A demand letter can be sent in parallel, but it is not a substitute for commencing proceedings before the deadline.

Find Out Where You Stand

A confidential initial assessment establishes your deadline, evaluates the strength of your claim, and sets out your options. Fixed fee: $770 (inc GST).

Call