Privacy Commissioner John Edwards says his office is considering naming and shaming agencies that break the rules on personal information.
Mr Edwards said until now, agencies and companies that breach the Privacy Act have rarely been named publicly.
He said the new policy would enable the office to be a more effective regulator, particularly in cases of repeat offenders.
The Office of the Privacy Commissioner will release a discussion document on the naming policy next week to get public feedback on the idea.
In the interim, Mr Edwards said he planned to make more use of the regulatory powers he already had and take a tougher line on privacy breaches.