Australia's Privacy Act Reforms, Tranche 2: What the Exposure Draft Means for Your Business
On 31 August 2026, the Attorney-General's Department released the exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026, along with an accompanying consultation paper. This is the second and more substantial tranche of reform to the Privacy Act 1988 (Cth), following the more limited first-tranche amendments passed in December 2024. Submissions on the draft close 18 September 2026.
Unlike the first tranche, which focused on procedural and enforcement changes, this draft goes to the substance of how Australian organisations are permitted to collect, use, store and disclose personal information. It has prompted an unusually large and fast response from the legal profession - firms including Corrs, Clayton Utz, Herbert Smith Freehills Kramer, King & Wood Mallesons, Baker McKenzie, Maddocks, Ironbridge Legal, Spruson & Ferguson, Colin Biggers & Paisley, Johnson Winter Slattery, McCullough Robertson, Wotton Kearney and Squire Patton Boggs all published client alerts within days of release - a strong signal of how significant the profession considers this reform to be.
What's actually being proposed
A new "fair and reasonable" test.
A proposed APP 3 would require that collection, use and disclosure of personal information be objectively fair and reasonable in the circumstances, not merely consented to. Relevant factors would include the sensitivity of the information, whether the individual would reasonably expect the practice, the risk of harm, and proportionality. Child welfare would be a primary consideration where relevant. This is a significant conceptual shift - it moves Australia's framework closer to the "legitimate interests" balancing tests found in the EU's GDPR, and means consent will no longer be a complete answer to a privacy compliance question.
Faster breach notification.
The current Notifiable Data Breaches scheme gives entities roughly 30 days to assess a suspected breach before notifying. The draft proposes a 72-hour notification window to the OAIC once an entity has reasonable grounds to believe an eligible breach has occurred, with individual notification required simultaneously where practicable. This will require organisations to have incident response plans that can genuinely move at that speed - a much tighter timeframe than most current playbooks assume.
Expanded sensitive information categories.
The draft would add genomic information, biometric templates and precise geolocation tracking data (broadly, location data accurate to 500 metres or better, tracked over time) to the list of "sensitive information" under the Act. Sensitive information attracts a stricter consent standard and additional handling obligations, so this expansion has direct implications for health and genomics providers, biometric security and loyalty systems, and any business using location-based tracking or targeting.
A tighter consent standard.
Consent would need to be voluntary, informed, current, specific and unambiguous. Broad or historical consents obtained under looser standards are likely to need refreshing - a practical, resourcing-heavy exercise for organisations with large existing customer bases.
A more prescriptive retention obligation.
APP 11 would move from an aspirational "don't keep information longer than necessary" standard to something closer to an audit requirement - entities would need to regularly assess whether they still need personal information they hold, and delete rather than merely de-identify it once that need has passed.
A right to erasure - but narrowly scoped.
The draft proposes a right to erasure, but limited to large digital platforms and designated internet services (broadly, social media and similar platforms with global group revenue of $500 million or more, or 2.5 million or more average Australian users). Most businesses won't be directly caught by this provision in its current form, but it signals the direction of travel.
A new controller/processor framework.
Processors acting on documented, written instructions from a controller would receive some relief from APP liability for breaches arising from following those instructions. This is likely to drive meaningful changes to cloud services agreements, outsourcing arrangements and data processing addenda - organisations relying on third-party processors should expect their vendor contracts to need updating.
Restrictions on data broking and trading.
Consent would be required where disclosure of personal information involves payment or is for direct marketing purposes, with a proposed carve-out for "ad-supported services."
A parallel digital identity initiative.
The reform package also references a digital identity protection initiative (flagged in some commentary as "IDLock"), aimed at giving individuals more visibility and control over identity credentials such as passports and driver's licences - more a fraud/cyber measure than a privacy provision in the strict sense, but adjacent and worth watching.
What's notably absent
Several commentators have flagged gaps in the current draft: there is no reform of the employee records exemption, no change to the small business exemption (still set at $3 million annual turnover), no direct private right of action for individuals to sue over Privacy Act breaches, no mandatory privacy impact assessment requirement for high-risk activities, and - perhaps most notably for cross-border businesses - no provisions addressing cross-border data transfer rules in this draft.
AI: a case study, not yet a regulatory target
The consultation paper treats artificial intelligence, wearable devices and connected vehicles as case studies rather than subjects of direct regulation in this draft. It specifically raises AI-enabled smart glasses as an example of "unobtrusive data collection... with sophisticated AI functionality" that current settings may not adequately address, and asks stakeholders whether further reform is needed. This sits alongside a broader shift in the government's approach to AI regulation: a Joint Select Committee on Artificial Intelligence was appointed on 20 August 2026 and is due to report by 30 November 2026, with enforceable AI-specific legislation flagged for early 2027. The privacy reform and AI regulation workstreams are clearly intended to inform one another, and organisations building or deploying AI systems that touch personal information should expect this draft to be the first of several regulatory moves, not the last.
Who should be paying attention
Healthcare, health-tech and genomics providers, given the new genomic information category
Retail, hospitality and other businesses using facial recognition or biometric systems (loyalty programs, access control, loss prevention)
Ad-tech, marketing and data-broking businesses, particularly those using location data or profiling
HR technology and recruitment platforms handling candidate and employee data
Financial services, insurers and fintechs relying on data-driven risk assessment
Cloud, SaaS and outsourced service providers processing data on behalf of clients
Large digital platforms and social media services, given the proposed erasure right
Any organisation developing or deploying AI tools trained on or applied to personal information
What organisations should do now
Businesses in the categories above have a genuine, if narrow, opportunity to shape this reform before it is finalised - submissions close 18 September 2026. Beyond making a submission, organisations should start mapping which of their current data practices rely on consent alone (and would need to satisfy the new fair and reasonable test instead), auditing retention practices against the more prescriptive APP 11 standard, reviewing vendor and processor contracts in light of the proposed controller/processor framework, and stress-testing incident response plans against a 72-hour notification clock.
This article is general information only and does not constitute legal advice. It should not be relied upon as a substitute for advice tailored to your organisation's specific circumstances. Contact us to discuss how these reforms may affect your business. Apply to all posts etc
Book a free 15-minute call to discuss your situation.
Connected Legal + Commercial is a Sydney-based commercial law firm. This article is general information only and does not constitute legal advice. For advice specific to your situation, please contact us.