From my quick reading Privacy Act 1988 and GDPR are fairly consistent with eachother, but our legislation is a bit outdated. It seems to be amended every few months, but only in relation to niche clauses that cover very specific circumstances about someone in a particular role and their specific ability to interact with data.
-There is no distinction in Privacy Act between a data processor and a data controller. GDPR regulates individual responsibilities for both.
-In the Privacy Act there's nothing to stop multiple de-identified datasets from being cross referenced together in a way that could re-identify the data subject.
-The legal basis to protect consumers from collection of personally identifiable data is stronger under GDPR. The only thing an Aus organisation needs to do to collect sensitive data is establish that it's 'reasonably necessary' for their core business operation.
Also note that although GDPR is a European union regulation, many Australian businesses are still beholden to it, e.g. if they knowingly collect information from European customers or have a branch located in EU. You can't really have an EU branch that's GDPR-compliant if your parent company overseas isn't.