- with readers working within the Law Firm industries
- within Compliance, Strategy and Real Estate and Construction topic(s)
Australia's privacy framework is about to undergo its most significant transformation in nearly four decades. On August 31, 2026, Attorney-General Michelle Rowland released the exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026 (the Bill), together with a consultation paper (the Consultation Paper).
Summary
Existing collection, use and disclosure obligations (APPs 3, 4 and 6) are replaced with a new framework centred on a "fair and reasonable" test assessed against seven legislated factors, complemented by separate consent requirements for collecting sensitive information and trading personal information.
Core definitions are overhauled, including “personal information,” “sensitive information,” “consent,” “collection,” “disclosure” and “de-identification.” A new concept of “trading” is introduced, requiring consent to disclose personal information for money, consideration or direct marketing purposes.
Entities must notify the Office of the Australian Information Commissioner (OAIC) of eligible data breaches within 72 hours. New positive obligations require breach response systems and harm mitigation for all data breaches.
A right of erasure applies to large digital platforms—that is, organisations providing qualifying Online Safety Act services that meet at least one of two thresholds: AUD500 million in business group gross revenue or 2.5 million average monthly end users in Australia. A statutory controller/processor framework allocates primary compliance responsibility to controllers.
Several previously foreshadowed reforms are absent, including removal of the small business and employee records exemptions, a direct right of action, and mandatory
The proposed changes go well beyond the incremental updates of recent years. From a new “fair and reasonable” test governing all handling of personal information, to the introduction of a controller-processor distinction and a right of erasure, the Bill signals that Australia is finally moving to align its privacy laws with the expectations of a modern digital economy. The Bill is open for public consultation and submissions close on September 18, 2026.
The Bill represents the second—and far more ambitious—tranche of reforms to the Privacy Act 1988 (Cth) (the Privacy Act). The first tranche, legislated in late 2024, laid important groundwork: a statutory tort for serious invasions of privacy, mandatory privacy policy disclosures on automated decision-making, a Children's Online Privacy Code and enhanced OAIC enforcement powers.
But Tranche 1 addressed only a fraction of the 116 proposals in the Privacy Act Review Report (the Review Report), released in February 2023, to which the Government Response of September 2023 agreed or agreed in principle with 106. Tranche 2 picks up where that process left off and raises the bar considerably.
The key proposals and what is not in the Bill is discussed below.
Updated definitions
Before turning to the new obligations, it is worth understanding how the Bill redraws the definitional boundaries. Schedule 1 updates core Privacy Act definitions in ways that will significantly expand the scope of information and activities caught by the regime. The table below sets out the key changes.
| Concept | Current position | Proposed change | Practical impact |
|---|---|---|---|
| Personal information | Information "about" an identified or reasonably identifiable individual. | Replaced with information that "relates to" an identified or reasonably identifiable individual. A new definition of "reasonably identifiable" is introduced: an individual is reasonably identifiable if they could be identified by combining the information with other reasonably available information. A note clarifies that identification does not require knowledge of an individual's name or legal identity. | Broadens the Act's reach. Pseudonyms, device identifiers, location data and behavioural patterns may now fall within scope. Entities using cookies, tracking technologies or similar identifiers will need to treat these as personal information. |
|
Sensitive information |
Includes racial/ethnic origin, political opinions, health information, biometric data and other prescribed categories. | Expanded to include precise geolocation tracking data (location within 500 metres, tracked over time, generated by a device or technology) and genomic information. | Geolocation data collected through mobile devices and wearables will attract the higher protections applicable to sensitive information, including a consent requirement for collection |
| Consent | Must be voluntary, informed, specific and unambiguous (per OAIC guidance, not legislated). | Legislated for the first time: consent must be voluntary, informed, current, specific and unambiguous. May be express or implied, but implied consent must be clearly inferable from conduct and context. | Bundled consents, pre-ticked boxes and broad permissions are unlikely to satisfy the new standard. |
| Collection | Information "collected" when obtained from any source, per OAIC guidance. | An entity collects personal information when it includes information in a record or generally available publication, regardless of source or means. Expressly covers generated, derived and inferred information. New timing rules govern when derived sensitive information is taken to be collected. | Catches information derived through AI, data analytics and similar processes. Entities will not be taken to collect sensitive information merely because the personal information they hold could reveal a sensitive attribute (e.g. a photo showing religious dress); the trigger is when the entity actually uses or records the derived information. |
| Disclosure | Not defined in the Act. | An entity discloses personal information when it makes the information accessible to another person or body. Transmission or storage (including overseas) does not amount to disclosure unless the information is made accessible to a third party. | Provides a clearer line between use (internal access) and disclosure (external access). Overseas hosting alone will not constitute a disclosure. |
| De-identification | Information is "de-identified" if it is no longer about an identifiable individual. | Recast as contextual: information is de-identified at a particular time if, in those circumstances, it no longer relates to an identified or reasonably identifiable individual. | De-identification can degrade over time, so entities holding de-identified or pseudonymised datasets must reassess re-identification risk on an ongoing basis. |
| Traders | Not defined in the Act. | New concept: disclosure of personal information for money or other consideration, or for direct marketing purposes. Consent required unless an exception applies. Four carve-outs: (1) disclosures to the recipient for the purpose of providing a product or service the individual requested; (2) disclosures incidental to a business transfer; (3) disclosures by a controller to a processor acting on documented instructions; and (4) disclosures necessary for prevention, detection, investigation or remedying of unlawful activity or serious fraud-related wrongdoing. | Businesses that monetise customer data through brokerage, list-sharing, advertising partnerships or programmatic advertising will need consent unless a carve-out applies. |
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
[View Source]
