Australia’s Privacy Act Reforms: Inside the Second Tranche

Almost two years after the first tranche of amendments to the Privacy Act 1988 (Cth) (Privacy Act), the second major tranche of proposed changes has been released.

On 31 August 2026, the Exposure Draft Privacy Amendment (Personal Data Protection) Bill 2026 (Exposure Draft Bill) was released, together with the Privacy Reform – Consultation Paper (Consultation Paper).[1] Together, the Exposure Draft Bill and Consultation Paper propose a swathe of changes to how APP entities may collect, use and disclose personal information, as well as data breach response and notification requirements.

While the first tranche of reforms, implemented in 2024,[2] was characterised by a strong focus on enforcement, litigation rights and regulatory powers, the second tranche represents a fundamental change – and uplift – to many building blocks of Australian privacy law. Both tranches follow extensive earlier consultation through the Privacy Act Review.[3]

These changes aim to bring the Privacy Act into the contemporary digital era, while future-proofing through a technology-neutral approach, as artificial intelligence and other data-intensive technologies continue to amplify the ways in which personal information is collected, generated, analysed and used. Indeed, the Australian Government has explicitly positioned the second tranche reforms as a means to help tackle emerging risks and public concern associated with AI-powered tools and devices, such as those used in connected vehicles, as well as wearable devices such as smart glasses.[4]  The harms to vulnerable Australians, and the national security risks posed by privacy breaches, are also key drivers of the reforms.[5]

We detail below the most significant proposed changes, what remains outstanding in the broader privacy reform agenda, and the actions that organisations can take now in preparedness for the upcoming changes.

New ‘fair and reasonable’ test

In a significant rewriting, the Exposure Draft Bill proposes to remove entirely the current APPs 3, 4 and 6, and substitute them with a new framework, featuring a streamlined test prohibiting the collection, use or disclosure of personal information unless it is ‘fair and reasonable in the circumstances’ and ‘lawful’.

This test places the onus on APP entities to determine whether their collection, use and disclosure practices are fair and reasonable in given circumstances, having regard to the following seven factors:

1. Reasonable expectation – Whether a reasonable person would expect the collection, use or disclosure in the circumstances, assessed objectively.
2. Relationship to entity’s functions or activities – Whether the collection, use or disclosure relates to the entity’s functions or activities (or any other purposes).
3. Transparency – Whether the entity is transparent about both the means and purposes of collection, use or disclosure (including through clear, accessible collection notices).
4. Data minimisation – Whether the purpose could be achieved with less (or non-personal or de-identified) information.
5. Genuine choice – Whether the individual is provided with a genuine choice regarding the collection, use or disclosure of their personal information.
6. Impact and harm – The impact on the relevant individual’s privacy and any risk of harm to them, including proportionality having regard to any benefits arising.
7. Best interests of the child – Where the information relates to a child, the child’s best interests must be a primary consideration.

The new test would require organisations to look beyond the form of their privacy policies and collection mechanisms and consider the substance of their data-handling practices.

Save for limited exceptions, the test applies irrespective of whether or not consent has been obtained – it is intended to operate as an objective, baseline standard that cannot be displaced merely because consent is given. In practical terms, organisations will need to consider not only whether an individual has been told of why and how their information will be handled, or given consent, but whether the organisation should be handling the information in that way at all.

The current concepts of ‘solicited’ and ‘unsolicited’ information, ‘reasonable necessity’ and ‘primary’ and ‘secondary’ purposes would be repealed and subsumed within the above singular test. The Privacy Act’s current exemptions, subject to certain amendments, will continue to apply.

Expansion of fundamental concepts

The Exposure Draft Bill proposes new (or amended) definitions for several core concepts embedded throughout the Privacy Act, intended to reflect contemporary digital environments, data practices and community expectations. In turn, this has the effect of widening the scope of the Privacy Act in various important respects. Key changes include:

• Personal information – In a proposed expansion of the meaning of ‘personal information’, the requirement that information or an opinion be ‘about’ an individual would be replaced with a requirement that information or an opinion ‘relates to’ an identified or reasonably identifiable individual. An individual may be identified or reasonably identifiable where information allows them to be recognised, singled out or otherwise dealt with as a distinct individual in practice, even if their name or legal identity is unknown. By way of example, the expanded definition of personal information would capture not only names or addresses, but also characteristics, behaviours, traits, preferences, patterns of activity, location data or geolocation data. An individual may also be ‘reasonably identifiable’ by combining the relevant information or opinion with other, reasonably available, information or opinions.
• Sensitive information – A proposed expansion of the meaning of ‘sensitive information’ would capture ‘genomic information’ and ‘precise geolocation tracking data’. The latter would include location data generated or derived from technology that identifies an individual’s location within a radius of 500 metres and that is tracked over time.
• Collects – It is proposed to recognise that information may be ‘collected’ regardless of the source or means, provided it is collected for inclusion in a record or a generally available publication. This includes where an entity generates it using its own processes, systems, observations or measurements, but also where it derives it elsewhere – for example, from third parties or websites or via AI, profiling or data analytics. Additionally, changes are proposed to clarify if, and when, an entity is deemed to collect sensitive information that can be derived from personal information.
• De-identified and disclosure – Clarificatory definitions are proposed for these terms.

Read together with the fair and reasonable test, these changes would require organisations to think more carefully about any personal and sensitive information they handle – including information they create, derive or infer – in determining whether their data handling practices are caught by, and compliant with, the Privacy Act.

Simplified notice requirements

Simplified notice requirements are proposed for the collection of personal information, through collection notices or otherwise, with less prescriptive content – namely, the fact and circumstances of collection, and the intended purposes for use or disclosure. Notification must however be readily understandable, in clear, plain language, up-to-date and concise.

Uplift in consent requirements

Consent may remain express or implied, but it must be voluntary, informed, current, specific and unambiguous, reflecting an uplift in the expected standard.

Consistent with current requirements, APP entities would be required to obtain consent before collecting sensitive information.

Consent would also be mandated before trading any personal information. ‘Trade’ is defined to capture selling personal information for money (or other forms of consideration, such as an exchange of customer lists), and disclosures made for direct marketing purposes, subject to certain carve-outs. This is particularly significant for businesses whose activities involve data broking, targeted advertising or other arrangements under which customer information is commercially exchanged.

Various exceptions are proposed to the consent requirements for collecting sensitive information (reflective of current law) and for trading personal information. Existing permitted general situations are intended to undergo certain amendments to clarify and expand their scope.

Usefully, as regards the collection of sensitive information, the Exposure Draft Bill proposes two new exceptions: (a) where sensitive information is collected from any ‘publicly available document’; and (b) where the collection is ‘strictly necessary’ to provide or deliver a good or service explicitly requested by the individual. Collection of sensitive information for direct marketing is deemed to never be ‘strictly necessary’.

Simplified direct marketing regime

The Exposure Draft Bill would also replace existing APP 7 with a simplified direct marketing regime. The term ‘direct marketing’ would be clarified with a technology-neutral definition (from emails, SMS and telemarketing to targeted social media and online behavioural advertising). The existing simple opt-out requirement would be retained, but mandated for each direct marketing communication. Entities would also be subject to a reasonable steps requirement to give effect to opt-out requests. Modified opt-out requirements would apply to ad-supported services.

Limited new right to erasure and updated right to access

Proposed new APP 14 would introduce a right to erasure, requiring ‘large digital platforms’ to destroy personal information they hold upon request, subject to certain exceptions. This would capture social media or online services providers that meet a revenue and/or user threshold (gross revenue of at least $500 million or at least 2.5 million average monthly Australian end-users).

The limitation to ‘large digital platforms’ is notable – while the Privacy Act Review had recommended extending the right to APP entities generally, in closer alignment with the GDPR right to erasure, the Exposure Draft Bill instead targets platforms holding significant volumes of personal information.

Proposed changes to APP 12 include preserving and clarifying the existing right to access, and adding an exception where, despite taking reasonable steps, provision of access remains technically impossible or infeasible.

Destruction and de-identification

The Exposure Draft Bill also seeks to strengthen APP 11 through new data minimisation obligations. It would require that, if an entity holds personal information, it must be able to identify it, specifically consider whether to destroy it if no longer needed for the purposes for which it may be used or disclosed (given that de-identification can result in risks of re-identification), and take reasonable steps to then either destroy or de-identify it. Entities would also be explicitly required to regularly evaluate the effectiveness of their security and destruction measures. These express, more stringent obligations would necessitate a robust approach to data mapping, data security and data minimisation through governance, technical and ongoing assurance systems and tools.

Controllers and processors

In a step towards alignment with GDPR concepts, the Exposure Draft Bill seeks to introduce a controller and processor framework into Australian privacy law, as follows:

• ‘Controller’ – an APP entity on whose behalf a processor handles personal information.
• ‘Processor’ – an APP entity which acts on behalf of a controller, in accordance with the controller’s documented instructions, handling personal information only for the purposes specified in those instructions.

Under the proposals, a processor acting within the above parameters will not breach the APPs, other than APP 1 (open and transparent management of personal information) and APP 11 (security of personal information), for which processors remain directly responsible. Where a processor engages in conduct that would breach an APP if done by the controller (other than APP 1 or 11), the controller is treated as engaging in that conduct and committing that breach.

However, a processor acting outside its documented instructions, or for purposes beyond those specified, will not be acting on behalf of the controller and will not benefit from the partial liability exemption.

The above framework will require entities to better understand the roles performed by their service providers – by closely scrutinising their contractual and outsourcing arrangements, including with cloud, SaaS and AI platforms and IT, HR or other third parties who handle personal information on their behalf. They will also need to ensure that their contractual terms clearly document the purposes and parameters of any processing and impose fulsome obligations to comply with the APPs. Importantly, controllers should not assume that outsourcing processing activities will transfer their privacy compliance obligations, as liability risk will largely remain with controllers.

Ethically reviewed human research

The existing exceptions for health and medical research would be replaced with a single exception for ‘human research’ (research conducted with or about individuals that involves personal information), meaning that an act done in the course of human research will be taken not to breach the APPs. The rationale for this is a balancing of the public interest in privacy protection, against the public interest in research which benefits society. To be exempt, research must be reviewed, approved and monitored in accordance with the National Statement on Ethical Conduct in Human Research, and comply with human research guidelines to be issued by the Privacy Commissioner. The Privacy Commissioner will also have the power to limit the scope of research that may be covered by the exception, to ensure privacy risks are appropriately managed.

Eligible data breaches: 72-hour reporting window

The Exposure Draft Bill intends to significantly tighten notification requirements under the Notifiable Data Breaches scheme, to:

• Require notification to OAIC within 72 hours of becoming aware of reasonable grounds to believe that an eligible data breach has occurred. This 72-hour reporting window aligns with other incident reporting regimes (such as those applicable under the Security of Critical Infrastructure Act 2018 (Cth) and the Cyber Security Act 2024 (Cth)). The new deadline would not impact upon the current 30-day timeframe for assessment of ‘suspected’ eligible data breaches, where there are not yet reasonable grounds to believe that an ‘eligible’ data breach has occurred.
• Expand the content of the notification statement to be provided to OAIC.
• Allow an incomplete statement to be submitted initially, where it is impossible or impractical to provide a complete statement within 72 hours (with the missing information to be provided as soon as practicable). Any material changes or corrections must also be provided as soon as practicable.
• Clarify when all affected individuals must be notified of an eligible data breach (or alternatively, those individuals at risk of serious harm, or otherwise public notice), subject to the ‘remedial action’ exception.
• Give the Information Commissioner power to direct an entity to provide a notification statement and notify affected individuals. This would provide an alternative notification pathway where the Commissioner becomes aware of an eligible data breach by other means.

Beyond notification, there is proposed introduction of:

• A new term, ‘data breach’ (defined broadly, to distinguish it from an ‘eligible data breach’);
• A positive obligation for entities to take reasonable steps to prevent or reduce harm to affected individuals in any actual or suspected data breach; and
• A positive obligation for entities to take reasonable steps to implement practices, procedures and systems that enable them to comply with their relevant obligations, respond effectively to any data breaches, and prevent or reduce harm to affected individuals.

Further enhancements to OAIC’s regulatory powers

The Consultation Paper also proposes an additional range of reforms aimed at improving the efficiency and effectiveness of the Privacy Act’s dispute resolution framework and OAIC’s case management and enforcement powers.

Earlier resolution of privacy complaints is proposed by requiring individuals, in most cases, to first raise their concerns with the relevant APP entity before complaining to OAIC. APP entities would be required to maintain accessible complaint mechanisms, respond within 60 days, and provide written decisions explaining the outcome and any review or external dispute resolution options. Breaches of the new complaint-handling obligations would, themselves, be classified as an interference with the privacy of an individual.

A range of measures are also proposed to strengthen OAIC’s investigative, information-gathering, oversight and reporting powers, as well as streamlining its complaint intake processes and clarifying and improving requirements applicable to representative actions.

In addition, the current broad ‘reasonable excuse’ defence to OAIC’s information-gathering notices would be replaced with a defined set of specific defences, including legal professional privilege, privilege against self-incrimination, journalists’ privilege, inability to comply due to genuine practical barriers, and situations where requested documents cannot be located despite reasonable searches being undertaken and documented.

Australian privacy laws: Where to from here?

Despite the ambitious reach of the second tranche, it may not mark the end of Australia’s privacy reform agenda. In particular, the Exposure Draft Bill makes no mention of the following key recommendations arising from the Privacy Act Review:

• Removal of the small business exemption (whereby most businesses with an annual turnover of $3 million or less currently remain outside the scope of the Privacy Act). The Privacy Act Review recommended removing that exemption, but only after further consultation and appropriate support for small businesses. In its 2023 response, the Government agreed in principle, while also recognising that small businesses would need sufficient assistance and time to adjust to new privacy obligations.[6]
• Removal of the employee records exemption. The Government had agreed in principle to further consultation on how privacy protections for private sector employees should operate and interact with workplace relations laws.[7]
• Other designated measures, including additional individual rights, the appointment of Privacy Officers, the prescribed use of privacy impact assessments and standardised templates and other tools for privacy policies and collection notices.

The second tranche reforms are expected to pass into law relatively quickly, with a short consultation period closing on 18 September 2026.[8]  APP entities should consider preparatory steps now – as well as ensuring, to the extent not yet done, that they have updated their privacy policies to disclose automated decision-making using personal information by the upcoming deadline of 10 December 2026.

Given the nature of the second tranche proposals, organisations would be wise to:

• Assess their data handling practices against a ‘fair and reasonable’ lens and the associated seven factors to be taken into account, identifying what changes may be necessary to meet the incoming test.
• Scrutinise the effectiveness and clarity of their consent mechanisms, privacy policies and collection notices, given the expanded concepts, thresholds and definitions being tabled.
• Examine their readiness for the proposed new rules for direct marketing and other commercial uses of personal information.
• Review their data breach response plan, in view of the incoming 72-hour reporting window, and ensure that effective breach prevention, response, escalation, mitigation and reporting practices, procedures and systems are implemented, monitored and regularly tested, given the other express obligations proposed.
• Consider any supplier and outsourcing arrangements to identify potential controller and processor relationships, and consider whether existing contracts adequately document processing instructions and the allocation of privacy and security responsibilities.
• Ensure that systems are capable of easily and quickly retrieving, deleting or de-identifying personal information, as well as evaluating security and destruction measures, and undertake data minimisation where possible.

If you would like to discuss these issues and next steps, please contact our team.

[1] Attorney-General’s Department, ‘Privacy Reform – Consultation on Exposure Draft legislation’ (31 August 2026).

[2] Privacy and Other Legislation Amendment Act 2024 (Cth). See also LK, ‘Litigation, Enforcement, AI and More: The First Tranche of Australia’s Privacy Reforms Explained’ (18 September 2024).

[3] Attorney-General’s Department, Privacy Act Review Report (2022).

[4] The Hon Michelle Rowland MP, Attorney-General, ‘Modernising Australia’s privacy laws for the digital age’ (Media Release, 31 August 2026).

[5] Ibid.

[6] Australian Government, Government Response to the Privacy Act Review Report (September 2023), response to proposal 6.1.

[7] Ibid, response to proposal 7.1.

[8] Attorney-General’s Department, ‘Privacy Reform – Consultation Paper’ (31 August 2026).