11 Sep 2026
Highlighting the pace of change in digital markets and social media, the Federal Government has, in little more than a week, released exposure drafts of bills amending the Privacy Act 1988 (Cth) and the Online Safety Act 2021 (Cth). They follow amendments to the Australian Consumer Law, passed in July 2026 and commencing operation on 1 July 2027, which introduce a general prohibition on unfair trading practices aimed at digital commerce.
Taken together, these reforms reflect the Government’s recognition of the pace of digital change and the need to future-proof protections for consumers and individuals in digital markets and online environments. They represent a significant strengthening of Australia’s digital safety, privacy and commerce frameworks, and will affect virtually every business that collects personal information or provides products or services online.
The reforms at a glance
Privacy Amendment (Personal Data Protection) Bill 2026: The long-awaited ‘Tranche 2’ privacy reforms follow the Privacy and Other Legislation Amendment Act 2024 (‘Tranche 1’), which, among other measures, introduced a statutory tort for serious invasions of privacy (commencing on 10 June 2025). The exposure draft of the new Bill was released by the Attorney-General’s Department on 31 August 2026 together with a consultation paper containing approximately 40 reform proposals. Public submissions close on Friday 18 September 2026. The Government has indicated that it intends to introduce legislation into Parliament before the end of 2026
Online Safety Amendment (Digital Duty of Care) Bill 2026: draft legislation released on 8 September 2026 for targeted consultation with digital platforms, industry bodies, civil society organisations and advocates. Legislation is to be introduced to Parliament this year, with a 12-month transition period proposed.
Competition and Consumer Amendment (Unfair Trading Practices) Act 2026: passed both Houses on 2 July 2026. The new provisions apply to conduct occurring on or after 1 July 2027.
What are the reforms about?
The overall context for the Privacy, Online Safety and Consumer Law reforms is the creation of a digital economy in Australia structured around principles of accountability, fairness and systemic risk management, with emphases on safety, consumer protection and a decisive shift of the burden of safety to the providers of online services, away from consumer self-protection.
The key theme is a shift toward greater responsibility on businesses and digital service providers to design online systems that are safe, transparent and fair. The reforms recognise that digital markets and online environments in Australia are evolving at a pace that requires proactive, future-focused regulation anticipating further rapid technology change, including continued rapid evolution and uptake of artificial intelligence solutions.
The reforms adopt a principles-based approach aimed at eliminating manipulative design practices, reducing foreseeable harms, increasing transparency and strengthening individuals’ control over consent in relation to access to digital services and collection of personal information.
Who has the ‘Digital Duty of Care’?
The Duty applies by virtue of functionality and risk associated with an online service, rather than turnover or sector. The Duty applies to organisations already subject to the Online Safety Act, including general websites and apps, messaging and gaming services, generative AI tools, hosting providers, internet service providers, search engines, app stores and operating systems.
The framing of the Duty around features, proportionality and risk means that websites providing purely transactional services will tend to have a lower duty of care. Others, while not being in the class of social media platforms, may offer more functionality – such as customer bulletin boards, user forums and review pages, seller-to-buyer messaging, user profiles or pre-qualification facilities, marketplace listings and other fields that enable text or image display. The more functionality, the greater risk of online harm, and the greater the Digital Duty of Care.
This means that websites and apps from suppliers as diverse as banks and car sale services, and even small platforms with user interaction features, are subject to the Duty, and their compliance arrangements will need to match the level of reasonably foreseeable serious harms to which users may be exposed.
The under-18 protections in the draft expressly extend to online games, apps and AI chatbots, not only social media.
Commercial, construction, infrastructure, HR and workforce management
Traditional sectors such as construction, logistics and infrastructure will also be affected.
Businesses using AI-assisted procurement, automated contract management, workforce management tools or data-driven project delivery systems should assess whether those systems use personal information in making, or substantially contributing to, decisions that could significantly affect the rights or interests of individuals. Automated assessments of employee performance, employee disciplinary systems, job application processes and systems for oversight and management of contractors (operating as individuals) are all likely to be captured. Many clients will need to update privacy policies before the automated decision-making transparency requirements from Tranche 1 of the Privacy reforms commence on 10 December 2026.
The expanded definition of sensitive information to include a new category of ‘precise geolocation tracking data’ is significant. The definition of precise geolocation tracking data – “information identifying an individual’s location within a 500-metre radius, collected by reference to location over time” – will capture common GPS tracking systems installed, often as standard, in many fleet vehicles and heavy equipment fleets.
Data collected through site access and control systems interfacing with compliance platforms – such as Sine and WhosOnLocation, Damstra Solutions, Pegasus, HammerTech, Sitepass, Beakon and others – and time-and-attendance systems may constitute personal information and if so will be subject to the proposed enhanced privacy obligations. Data processing contracts relating to these services will also need close attention (see comments below on this point).
These expanded Privacy obligations will also potentially overlap with existing workplace surveillance compliance requirements where site access uses turnstile and gate controls.
And it can be expected that AI-assisted WHS and site safety systems, such as the deployment of Presien by Sydney Trains, will become more widely used. These systems typically utilise a wide range of data collection methods and devices potentially capturing personal, and potentially sensitive, information, the management of which would fall within the scope of the enhanced Privacy reforms and the safe design principles proposed in the Online Safety reforms.
Contracts, procurement and insurance
Contracts, including force majeure, disclaimer and limitation of liability provisions, and insurance policies may need review to ensure they remain fit for purpose and reflect the statutory tort introduced in Tranche 1 of the Privacy reforms, the new Consumer Law provisions, the Digital Duty of Care and the enhanced breach preparedness and notification obligations in the proposed Tranche 2 Privacy reforms.
Systems for automated procurement using AI and algorithmic decision-making will require particular and urgent attention due, as mentioned earlier, to the new APPs 1.7 – 1.9 commencing operation in December this year.
Data breach exposure
In the context of known acceleration of AI-assisted hacking activity and exponential expansion of the range of organisation types and sizes potentially now hacking targets through hackers’ use of agentic AI, the proposed changes around data breaches would create new and more direct potential liabilities for many clients.
The Privacy amendment bill introduces new sections 26WDA and 26WDB, which bring data breach preparedness and harm-mitigation obligations, previously addressed principally through APPs 1.2 and 11.1, into the statutory data breach regime itself. Most importantly, section 26WDA would create within the Act a duty to prepare for potential data breaches, meaning that a failure to prepare that causes foreseeable serious harms would directly invoke the civil penalty provisions of the Act, in addition to potential liability directly to affected individuals arising under the statutory tort introduced in Tranche 1 of the Privacy reforms.
Existing section 26WE is repealed and replaced, separating and clarifying the concepts of a “data breach”, an “eligible data breach”, and when an individual is considered to be “at risk” from an eligible data breach.
The proposed changes would materially tighten the breach readiness and response obligations of entities covered by the Privacy Act and clarify time-frames for analysis of suspected breaches, determination as to whether there are reasonable grounds to believe an eligible data breach has occurred and then notice of breach and remedial actions.
Breach response plans built around the existing obligations in APPs 1.2 and 11.1 and Part IIIC of the Privacy Act as currently enacted are unlikely to be fit for purpose under the proposed new measures.
Data Processors and Controllers
The Privacy Act reforms would also formalise the roles of data controller and data processor in Australia, bringing Australian law more closely into alignment with the EU and UK regimes. This adds a further contracting dimension to the reforms, in relation to data processing services.
Under the draft bill, where a processor acts solely in accordance with a controller’s documented instructions, responsibility for compliance with many Privacy Act obligations may rest primarily with the controller; processors remain subject to their own statutory obligations and may still bear liability where they act outside instructions or breach obligations that apply directly to processors, or if instructions are not documented or poorly documented.
This differs from the EU and UK model, in which obligations of processors and controllers in relation to a particular data processing activity, while different, operate in parallel, and are determined less by written terms of processing instructions than by the facts.
Contract terms would need to address actual data flows, and whether and when parties intend to be (respectively) data processors or controllers. Instructions from controllers to processors will need to be carefully documented and appropriate exclusions, limitations and disclaimers negotiated.
For example, if a construction company collects employee details, induction records, GPS data and timesheet information to manage its workforce, the construction company is likely to be the controller because it decides why those data are being collected and used. Processors – such as cloud storage providers, payroll service providers, managed service providers, IT hosting and outsourced HR platforms – handle that personal information as processors, on behalf of the controller.
Best practice for parties to supplier, cloud, managed services and AI vendor arrangements is likely to require that instructions are documented throughout the data management chain, allocation of risks clearly assigned and contracts amended accordingly.
Clients providing services to children
Clients offering services targeted at, or likely to be accessed by, children are directly affected by the Online Safety amendments. For them, the Duty, the social media minimum age regime and the Children’s Online Privacy Code (‘COP Code’, under the Privacy Act) together represent a new level of responsibility for content, consent, design and access. Given that the COP Code is intended to be registered by 10 December 2026, affected businesses need to review operations and undertake necessary preparations as soon as possible.
Data and AI Governance Frameworks
Establishing a Data and AI Governance Framework can provide clients with a structure to assess potential impacts of the reforms and manage a program of operational, technical, legal and governance updates to address current gaps in compliance and legal risk management, and to prepare for the impending effects of the Online Safety, Privacy and Consumer Law reforms.
Please feel free to make contact if you would like to discuss how these reforms may affect your business or client businesses.
This article is general commentary only, current as at 10 September 2026. It is not legal advice and should not be relied on as such. The Privacy and Online Safety amendment Bills referred to are exposure drafts and remain subject to change.
For further information please contact:
