Australia | Proposed Tranche 2 Privacy Act Reforms: Exposure Draft And Consultation Paper Released

On 31 August 2026, the Australian Government released the exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026 and an accompanying Consultation Paper, marking one of the most substantial proposed reforms of the Privacy Act 1988 (Cth) in recent times and warranting close attention from all regulated entities.

If enacted in their current form, these proposals represent significant potential changes to Australia’s privacy landscape.

For many regulated entities, the proposals will require a review of privacy practices and personal information handling. This may be a substantial compliance burden, but an inevitable one given the increasingly active enforcement posture of the Office of the Australian Information Commissioner (OAIC).

What are the potential practical implications of these Privacy Act reforms? We provide a high-level overview of the significant changes below.

The path to tranche 2 privacy reforms

The reforms represent the second tranche of changes arising from the Privacy Act Review Report 2022, which itself was the product of two years of intensive consultation and review.

The first tranche, enacted through the Privacy and Other Legislation Amendment Act 2024 (Cth), introduced the statutory privacy tort; new transparency obligations around AI and automated decisions; a tiered civil penalty regime building on the substantial uplift in maximum penalties under the Privacy Legislation Amendment (Enforcement and Other Measures) Act 2022 (Cth); enhanced enforcement powers for the OAIC; and approval to develop a Children’s Online Privacy Code.

This second tranche is considerably broader in scope, packaging roughly 40 proposals: 25 that uplift privacy protections; 5 that simplify and clarify obligations; 4 additional simplification measures; and 7 measures to improve regulatory efficiency. Consultation closes on 17 September 2026.

Key proposed changes

Fair and reasonable test (updated APP 3)

Arguably the most significant structural change is the introduction of a single “fair and reasonable” test for the collection, use and disclosure of personal information. Currently, APP 3 prohibits an entity from collecting personal information unless the information “is reasonably necessary for one or more of the entity’s functions or activities”. Under the new APP 3, an entity must not collect, use or disclose personal information unless doing so is fair, reasonable and lawful.

Regulated entities must have regard to legislated factors including reasonable expectations; the entity’s functions; transparency; data minimisation; genuine choice; proportionality of impact; and where children are involved, their best interests as a primary consideration. The shift from a “reasonably necessary” collection standard to this broader test embeds data minimisation and proportionality assessment throughout the information lifecycle, and represents a meaningful departure from the current position.

Consent requirements (updated APP 4)

Consent requirements are refined by requiring that consent be voluntary, informed, current, specific and unambiguous. Consent is now required for two high-risk activities: the collection of sensitive information and the “trading” of personal information. “Trade” is a newly defined concept capturing disclosures for monetary or other consideration, or for direct marketing purposes. This concept could have material implications for regulated entities whose business models involve the commercialisation of personal information.

New and updated definitions

The Bill updates several key definitions. “Personal information” now covers information that “relates to” an identified or reasonably identifiable individual, expanding the reach beyond information “about” a person. Precise geolocation tracking data and genomic information are classified as sensitive information.

“Collection” is clarified to capture information regardless of how it is obtained, including inferences drawn by data analysis, artificial intelligence or other technological processes. De-identified information is defined as information that, in the circumstances, does not relate to an identified or reasonably identifiable individual.

Direct marketing (updated APP 7)

APP 7 would be replaced with a simplified, technology-neutral framework. Direct marketing is defined to include advertising or marketing material directed to an individual using their personal information, whether targeted individually or as part of a broader audience, segment or cohort.

The framework retains a simple opt-out mechanism; provides flexibility for ad-supported services; and clarifies obligations in multi-party advertising arrangements. Entities must obtain consent to “trade” personal information, which includes disclosures to third parties for direct marketing purposes.

Data breaches

The Bill proposes changes to the notifiable data breaches scheme, introducing a distinction between a “data breach” (unauthorised access to, disclosure of, or loss of personal information) and an “eligible data breach” (a subset that is likely to result in serious harm). Obligations now apply to all data breaches, regardless of whether the serious harm threshold is met.

This means that regulated entities must implement practices, procedures and systems to respond effectively, and must take reasonable steps to prevent or reduce harm as soon as there are reasonable grounds to believe or suspect any data breach has occurred. These containment and harm mitigation obligations apply to both actual and suspected breaches. For eligible data breaches, regulated entities face a 72-hour notification period to provide the Information Commissioner with a statement. If a complete statement cannot be provided in time, an incomplete statement may be submitted with outstanding information to follow.

Security obligations (updated APP 11)

APP 11 is also strengthened, requiring entities to actively consider destruction or de-identification of personal information that is no longer needed for any purpose for which it may be used or disclosed under the APPs; to identify the personal information they hold (as entities must know what personal information they hold in order to protect it appropriately, determine whether it is still needed, and decide whether it should be destroyed or de-identified); and to regularly evaluate the effectiveness of their security and destruction measures.

Access requests (updated APP 12)

The Bill introduces a new exception to access requests under APP 12, where providing access remains unreasonable or impracticable due to technical impossibility or infeasibility, provided the entity has first taken reasonable steps to give access.

Right to erasure (new APP 14)

The Bill introduces a new standalone right to erasure that applies to “large digital platforms” (LDPs). Regulated entities qualify as LDPs if they provide or operate a digital platform and meet either or both of the following thresholds: gross revenue for the previous financial year of $500 million or more; or 2.5 million or more average monthly end users.

A regulated entity may also be prescribed as an LDP by regulation. LDPs would be required to destroy personal information they hold relating to an individual upon request, unless an exception applies.

Controller/processor framework

The Bill introduces a controller/processor framework. A controller is an APP entity on whose behalf a processor handles personal information. A processor is an APP entity that acts or engages in practices on behalf of a controller. Processors remain directly responsible for breaches of APPs 1 and 11. Acts of a processor will otherwise not breach the other APPs or a registered APP code.

Where a processor acts in accordance with a controller’s documented instructions, those acts are taken to be acts of the controller. Where a processor’s act on behalf of a controller would breach an APP (other than APP 1 or APP 11) or a registered APP code if done by the controller, the controller is treated as having committed the breach.

OAIC powers and regulatory efficiency

The Bill includes measures to enhance the OAIC’s regulatory capacity. A new early dispute resolution framework requires individuals to first raise complaints with the relevant entity; and regulated entities must provide accessible complaint mechanisms and respond within 60 days, with failure constituting an interference with privacy.

The Commissioner also gains clearer powers to oversee privacy protections under the Social Media Minimum Age scheme; to require reasonable assistance during investigations; and to manage representative complaints more efficiently.

Emerging technologies

The Consultation Paper also addresses the privacy implications of emerging technologies, seeking specific feedback on whether the proposed measures adequately address risks associated with wearable surveillance technologies (such as smart glasses and earbuds) and connected vehicles.

The Consultation Paper explains that the Bill’s reforms are intended to apply directly to wearable technologies. Updated definitions extend personal information to behavioural and device-generated data and broaden “collection” to capture AI-drawn inferences. Precise geolocation data is classified as sensitive information, requiring consent before collection. The fair and reasonable test also requires developers and deployers to implement risk-appropriate safeguards meeting individuals’ reasonable expectations of privacy.

The Consultation Paper poses five specific questions to stakeholders, including whether these definitions are sufficient and the extent to which consent can remain meaningful where wearable technologies compromise the transparency of data capture.

What regulated entities should be doing now

While the Bill remains subject to consultation and its final form is not yet certain, regulated entities may wish to begin considering their readiness across the following areas:

• Consider how information handling practices align with the proposed fair and reasonable test. The proposed test is not a relabelling of existing obligations and would introduce a broader, principles-based standard requiring a holistic assessment across the entire information lifecycle. Regulated entities may wish to consider how their collection, use and disclosure practices would align with the proposed test if it is enacted.
• Reassess privacy impact assessments. The expanded scope of “personal information” and “sensitive information”, particularly the inclusion of precise geolocation data and genomic information, may bring data sets previously outside the regime squarely within it, with direct implications for data strategy and risk management.
• Consider reviewing data breach response plans. The proposed reforms would, if enacted, significantly expand breach obligations. Containment and harm mitigation duties would apply to all data breaches, not just those meeting the serious harm threshold, and would attach as soon as there are reasonable grounds to believe or suspect a breach has occurred. Regulated entities may also wish to ensure that practices, procedures and systems are in place to respond effectively before any breach occurs. For eligible data breaches, the proposed 72-hour notification period; the requirement to include information about response steps; and the staged reporting framework (permitting incomplete statements where necessary) would represent a shift toward faster and more structured incident reporting. Existing breach response plans may warrant review and testing to ensure they could be implemented within the proposed timeframes.
• Consider the proposed controller/processor framework. If enacted, regulated entities acting as processors would need documented instructions and clear contractual arrangements, while controllers would need to recognise that a processor’s non-compliant acts would be attributed to them. Existing outsourcing, data processing, and service agreements may warrant review against the proposed framework.
• Consider auditing data holdings and retention practices. The proposed changes to APP 11 would place renewed emphasis on knowing what personal information is held and actively managing its lifecycle. The proposed requirement to consider destruction or de-identification, coupled with the ongoing evaluation obligation, could mean that passive retention of data “just in case” may not be justifiable if the Bill is enacted. Regulated entities may wish to begin reviewing their data holdings; retention schedules; and whether de-identified data sets remain appropriately de-identified in light of evolving re-identification risks.
• Consider the enforcement context. The already expanded civil penalty regime, proposed new complaint-handling obligations, and broader investigative powers would further strengthen the OAIC’s regulatory toolkit, following a period of markedly increased enforcement activity and public regulatory signalling. Regulated entities that begin monitoring these developments and assessing their potential impact will be better positioned to respond efficiently once the Bill is finalised and enacted.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.