Drone Liability in 2026: Privacy, CASA Changes and Insurance Gaps

In February 2026, the Australian Government updated its Drone Privacy Guidelines to reflect a change that had already been quietly reshaping drone operators’ legal exposure since June 2025: a new statutory tort that lets individuals sue over a serious invasion of privacy, regardless of the size of the business behind the drone.

What the Privacy Tort Actually Requires

The Privacy Act 1988 was amended to introduce this statutory tort, in force since 10 June 2025 under Schedule 2 of the Act. The Australian Government’s own Drone Privacy Guidelines confirm it applies to all individuals, including recreational drone users, not just larger organisations bound by the Act’s usual Australian Privacy Principles.

It’s important to be precise about what this actually requires, because it’s a narrower and higher bar than it might first sound. A plaintiff has to establish five separate elements: an invasion of their privacy, either by intrusion on their seclusion or misuse of their information; that a person in their position would have had a reasonable expectation of privacy in the circumstances; that the invasion was intentional or reckless, negligence alone isn’t enough; that the invasion was serious; and that the public interest in their privacy outweighed any competing public interest, such as freedom of expression. Every element has to be proven, and failing any one defeats the claim.

What this means in practice: an operator who incidentally captures a neighbour’s yard while conducting a roof survey is in a genuinely different legal position to one who deliberately films into a bedroom window. The tort targets serious, deliberate or reckless conduct, not the ordinary incidental capture that comes with aerial work. That said, it did add a real federal cause of action where none existed before at this level, on top of state surveillance device laws (which generally apply to all persons already), and the ordinary common law of trespass and nuisance. It didn’t remove a blanket shield that smaller operators previously had. It closed a specific gap in what individuals could sue over.

A Second Change Worth Tracking, With a Narrower Scope Than It First Appears

Separate amendments to the Privacy Act, commencing December 2026, will introduce new transparency obligations around automated decision-making. Worth being precise here too: this sits within the Act’s broader privacy policy obligations, which apply to organisations covered by the Privacy Act, generally those above the $3 million annual turnover threshold, not every operator regardless of size. It also specifically concerns automated decisions that use personal information and significantly affect an individual, which most routine AI-assisted analysis of a roof, a power line, or a crop doesn’t involve.

For operators who are covered by the Act and who use AI-assisted analysis feeding into decisions that could significantly affect a person, this is worth building into your privacy documentation ahead of the December 2026 commencement. For most small operators below the turnover threshold doing standard inspection work, this specific change is less likely to apply directly, though it’s worth confirming your own position rather than assuming either way.

Two Regulatory Regimes, Not One

CASA’s rules govern where and how you’re allowed to fly. They don’t govern what you’re allowed to capture with your camera once you’re up there. Per the Australian Government’s Drone Privacy Guidelines, CASA’s framework addresses air safety, while separate state-based privacy and surveillance laws govern what a drone’s camera is permitted to record and how that data is handled.

This matters operationally because CASA compliance doesn’t automatically mean privacy compliance. A job can be fully approved from an airspace and registration standpoint and still expose the operator to a privacy claim if imagery wasn’t handled correctly. Landholder consent is a related but separate question. Permission to take off and land on private land is clearly required, that much is settled. Whether overflight alone requires separate consent is less settled and depends on factors including height and the degree of interference with the landowner’s use of the property, so this is worth treating as a genuine grey area rather than a fixed rule either way, and confirming with your own legal advice where a specific job raises it.

What’s Actually Changing on the CASA Side

From 15 October 2025, CASA introduced four new broad-area Beyond Visual Line of Sight approval pathways under Temporary Management Instruction TMI 2025-03, confirmed directly on CASA’s own site. This is a 12-month trial, not a permanent change, available to Remotely Piloted Aircraft Operator’s Certificate holders flying drones of 25kg or under, with approvals issued for the trial period while CASA collects data to assess it. The trial runs through to around October 2026, so a post-implementation review and decision on permanent policy should be expected around now or shortly after.

Since 11 May 2026, AusSORA, CASA’s Australian adaptation of the international Specific Operations Risk Assessment methodology, has become the mandatory assessment framework for new BVLOS and complex operations applications, alongside the separate trial pathways above. CASA has also opened consultation (CD-2613US) on a package of Part 101 amendments covering nationally consistent RePL and BVLOS examination standards, following on from its earlier post-implementation review of Part 101. Worth checking CASA’s consultation page directly for the current status and timing, since this is moving.

On Remote ID: CASA is considering a Remote ID requirement for drones, with industry expecting some movement from 2027, but no confirmed implementation date or final framework has been announced. Treat any specific timeline you see elsewhere with caution and check CASA’s own site before making fleet or hardware decisions based on it.

The Insurance Picture: Physical Risk, Data Risk and the Aircraft Exclusion

Start with the gap most operators don’t realise exists. Many general business liability policies explicitly exclude damage or injury arising from the ownership, use or repair of “aircraft,” and in some wordings, anything broader still. If a drone falls due to user error, a flat battery, signal loss, or a straightforward malfunction, and that fall causes property damage or injures someone, there may be no cover at all under a standard business liability policy.

This is the gap specialist drone insurance exists to close: third-party injury or property damage from drone operations, and cover for the drone, payload and sensors themselves. Beyond the physical side, two further covers are worth naming specifically, since they map to different exposures and different policy types. Claims arising from the data, imagery or advice a drone operation generates, an incorrect measurement, a flawed inspection report, a client decision made on faulty analysis, sit in professional indemnity territory, not general liability. Separately, the handling, storage and potential breach of the data itself is a cyber exposure, worth checking against your cyber cover rather than assuming your drone liability policy picks it up. 

Separately from any of the above, CASA doesn’t mandate insurance as a condition of operating. In practice, though, many councils, landowners and commercial clients require proof of public liability cover, often in the range of $10 million to $20 million, before they’ll allow a job to proceed. For most operators, that commercial requirement is a more immediate reason to have adequate cover in place than the privacy tort itself.

What This Means for Your Operation

1. Does your current insurance actually cover “aircraft” exposure, or does a general exclusion clause quietly remove it? Confirm this in writing rather than from a general liability summary.
2. Does your drone liability policy respond to a privacy claim, or does it exclude invasion of privacy and intentional conduct? Given the tort itself requires intentional or reckless conduct, this exclusion overlap is worth checking directly with your insurer.
3. Do you have a documented process for handling and retaining imagery that might capture people or property beyond the immediate job site? The 2025 tort applies regardless of business size, so this isn’t a “large business” problem to defer, even though the fault threshold is genuinely high.
4. If you’re an organisation covered by the Privacy Act using AI-assisted analysis that feeds into decisions significantly affecting individuals, have you started documenting that use ahead of December 2026? Most routine inspection work won’t meet this threshold, but it’s worth confirming your own position.
5. Does your job planning process treat landholder consent and privacy as genuinely separate questions from airspace approval, rather than treating a cleared flight path as a green light for everything?
6. Are you tracking CASA’s BVLOS trial outcome and Part 101 consultation, rather than planning fleet or operational decisions around an unconfirmed Remote ID timeline?

Want to confirm whether your current cover actually responds to a privacy claim, a data-handling exposure, or a straightforward aircraft liability event? Speak with Knightsbridge Insurance Group about your drone insurance.

Important Disclaimer: This article provides general information only and does not constitute legal or financial advice. Drone regulations, privacy law obligations, and insurance coverage for commercial drone operations vary significantly based on individual operators, states and territories, and insurers. Regulatory requirements referenced, including CASA’s trial BVLOS pathways and ongoing Part 101 consultation, are subject to change. Readers should confirm current requirements directly with CASA and the OAIC, and consult with qualified legal and insurance professionals before making decisions about drone operations or coverage. Knightsbridge Insurance Group holds Australian Financial Services Licence 514855.

Frequently Asked Questions