Major overhaul of Australian privacy laws comes in to land

On 31 August, the Attorney-General’s Department released the Exposure Draft of the Privacy Amendment (Personal Data Protection) Bill 2026 (Bill), together with a consultation paper.

Both the content and timing of this Bill were largely unexpected, given that:

• most ‘Tranche 1’ privacy reforms came into effect nearly two years ago, with only sporadic, targeted amendments since;
• there are previously proposed reforms already agreed in-principle but not yet implemented by the government or included in this Bill – for example, removal of the small-business and employee records exemptions;
• the Children’s Online Privacy Code, due to be registered by 10 December 2026, is yet to be finalised, and the promised expanded guidance on the transparency requirements for Automated Decision-Making practices, due to commence on 10 December 2026, has not been published to date, and
• recently the government has appeared more narrowly focused on AI, online safety and wearables (for example: broad media coverage preceded the release of the Exposure Draft for the Online Safety Amendment (Digital Duty of Care) Bill 2026 in the week following).

Key elements of the Bill

If implemented, the Bill’s changes to the Privacy Act 1988 will be far reaching. They include substantive amendments to core definitions, and the replacement of some existing Australian Privacy Principles (APPs) and introduction of new ones. These will have significant operational and compliance impacts on regulated entities.

Major changes to note include:

• expansion of the scope of the definition of personal information to information that ‘relates to’ (no longer is ‘about’) an individual, and introduction of the concept of ‘individuation’, where individuals may be treated as reasonably identifiable by combining information with other reasonably available information.
• introduction of a requirement for ‘fair and reasonable handling’ for all collection, use and disclosure – repealing existing APPs 3, 4 and 6 and inserting a new consolidated APP 3. This sets out seven tests for lawful, fair and reasonable handling, including that where the individual is a child, the best interests of the child are a primary consideration.
• insertion of a new APP 4 covering consent to collection of sensitive information or trading of personal information, with expanded exceptions – for publicly available information and where there is ‘strict necessity’ for service delivery in defined circumstances. ‘Precise geolocation tracking data’ is now sensitive information. Note: these requirements are in addition to the requirement for ‘fair and reasonable’ handling.
• overhaul of APP 7’s direct marketing prescriptive rules for direct and third-party collection channels. A simplified framework clarifies that all direct marketing communications must provide an opt-out mechanism and information on how to do that. The new APP 7 also allows providers of ad-supported services to offer paid tiered options as long as genuine choice to continue exists for all users.
• update of notification and data breach response requirements, whereby ‘data breach’ and ‘eligible data breach’ are clearly distinguished, a strict 72-hour notification deadline is introduced with provision for incomplete and staged statements, and new positive obligations to implement response systems and mitigate harms as soon as practicable are introduced.
• introduction of the GDPR concepts of ‘controller’ and ‘processor’ (though note that achievement of GDPR ‘adequacy’ will still be hampered by the retention of the small-business exemption.

There is much more change embedded in the detail of this Bill, and it will take time for the full implications of the changes to emerge. Many of the proposed provisions, such as those relating to amended access exceptions, remain uncertain and may be difficult to apply in practice.

However, both the government’s short consultation window ending 18 September, and its limitation on the length of consultation responses, signal that it intends to progress this Bill without delay by the end of this year.

If this Bill passes, regulated entities will need to make considerable investment in all aspects of their privacy programs, systems and governance in order to comply.

We recommend that you keep in touch with your privacy adviser for further updates on the progress of this draft legislation, or for assistance in mapping out the elements of your own work program to address the anticipated reforms.