On 31 August 2026, the Australian Government published a Consultation Paper and released an exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026 (Bill), proposing amendments to the Privacy Act 1988 (Cth) (Privacy Act).  The Bill proposes amendments to the Australian Privacy Principles (APPs) codified in Schedule 1 of the Privacy Act.

The consultation period for the draft Bill closed on 18 September 2026, and the content of the proposed changes remain subject to further government consideration.  Although the proposed reforms are not yet law, businesses should monitor their progress and consider how they may affect their privacy obligations.

This article outlines the key proposed amendments, and the issues businesses should consider when reviewing their privacy practices.

Why changes to the Privacy Act are being proposed

The Bill forms part of a proposed second tranche of reforms to the Privacy Act, following the changes enacted through the Privacy and Other Legislation Amendment Act 2024 (Cth). 

Responding to the 116 recommendations made in the 2023 Privacy Act Review Report (Review), the Bill contains approximately forty (40) proposals, comprising:

• Twenty-five (25) proposals from the Review to strengthen privacy protections;
• Five (5) proposals from the Review to clarify and simplify obligations;
• Four (4) additional measures to further simplify existing obligations; and
• Seven (7) additional measures to improve the efficiency of the Office of the Australian Information Commissioner (OAIC).

The Consultation Paper also sought feedback on measures still under development, beyond those included in the draft Bill, concerning the OAIC’s administration and enforcement of the Privacy Act, and privacy risks associated with emerging technologies, including wearable surveillance devices, such as smart wearable accessories and internet-connected vehicles. 

What are the key proposed changes?

If enacted in its current form, the Bill will affect how businesses collect, use, share and retain personal information.  The key proposed changes include:

• Personal information and location tracking: clarifying when data can identify an individual and extending sensitive information protections to precise location tracking.
• Fair and reasonable handling: requiring businesses to consider whether their collection, use and disclosure practices are lawful, fair and reasonable.
• Consent and collection notices: clarifying what constitutes valid consent and requiring clear, concise explanations of how information will be handled.
• Trading information and direct marketing: generally requiring consent to trade personal information, subject to exceptions, and revising marketing opt-out requirements.
• Security and retention: strengthening expectations for protecting information, disposing of unnecessary records and regularly reviewing compliance.
• Data breach response and notification: requiring notification to the Commissioner within seventy-two (72) hours of awareness of reasonable grounds to believe an eligible data breach has occurred, together with stronger response obligations.
• Access and erasure: introducing qualified deletion rights for individuals dealing with large digital platforms and a limited exception to access requirements where compliance remains technically impossible or infeasible despite reasonable steps.
• Outsourced processing and research: clarifying responsibility for information handled by service providers and introducing an exception for qualifying human research subject to safeguards.

Personal information and location tracking

Proposed sections 6FD–6FG would clarify that personal information includes information relating to someone who can be identified, including by combining it with other reasonably available information.  Removing names would not necessarily de-identify a dataset.

Proposed section 6FE would also classify precise geolocation tracking data as sensitive information.  The definition covers technology-derived information identifying a person’s location within a 500-metre radius and collected and held by reference to their location over time.

Fair and reasonable handling

Proposed amended APP 3 would generally require collection, use and disclosure to be lawful, fair and reasonable, subject to exceptions.  Relevant considerations would include customer expectations, transparency, genuine choice, whether less information could achieve the purpose, and the risks and benefits involved.  Children’s best interests would be a primary consideration where applicable.  Consent or a statement in a privacy policy would not, by itself, establish compliance. 

Consent and collection notices

Proposed section 6AAB would require consent to be voluntary, informed, current, specific and unambiguous, subject to a qualification for certain research.  Consent could remain express or implied.

Proposed APP 4 would generally require consent to collect sensitive information or trade personal information, subject to exceptions. 

Proposed APP 5 would require entities to take reasonable steps to notify individuals of the collection and intended uses or disclosures or otherwise ensure their awareness of those matters.  Notifications would need to be concise, up-to-date and readily understandable, using clear and plain language.

Trading information and direct marketing

Proposed section 6FC would cover disclosures for money or other consideration and disclosures for direct marketing, with specified exclusions.  Consequently, sharing information without payment could still constitute trading.

Proposed APP 7 would require simple opt-out mechanisms, clear instructions and reasonable steps to implement opt-out requests.

Security and retention

Existing APP 11 already requires reasonable security measures and, subject to exceptions, destruction or de-identification of information no longer needed for a permitted purpose.

The proposed replacement would expressly require consideration of destruction, identification of information subject to security and disposal obligations, and regular evaluation of compliance.  Exceptions would remain for Commonwealth records and legally required retention.

Data breach response and notification

Proposed section 26WK would require an entity to notify the Commissioner within seventy-two (72) hours of becoming aware that there are reasonable grounds to believe an eligible data breach has occurred, replacing the current requirement to notify the Commissioner “as soon as practicable”.  It is important to note that this obligation would not apply to every suspected security incident, and an incomplete initial statement would still be permissible in specified circumstances.

Proposed section 26WL would generally require notification to affected individuals simultaneously where practicable, or as soon as practicable afterwards.  Proposed sections 26WDA–26WDB would require response systems and prompt, reasonable steps to reduce harm from actual or suspected breaches.

Access and erasure

In addition to the thirteen (13) pre-existing APPS, proposed APP 14 would introduce a qualified right to request deletion from large digital platforms, rather than every business.  Proposed section 6EB would apply service-type and revenue or Australian user thresholds, or designation by regulations.

Exceptions would include legally required retention and information strictly necessary to continue requested services.  Proposed APP 12.3A would also introduce a qualified access exception where technical impossibility or infeasibility persists despite reasonable steps.

Outsourced processing and research

Proposed section 16D would establish a framework for qualifying processors following a controller’s written instructions.  Exceptions from most APP obligations would apply to qualifying processing, while APP 1 and APP 11 would remain applicable.  Controllers could be responsible for relevant breaches.

What should businesses do now?

Businesses should assess their existing obligations and consider the following steps in preparation for the proposed reforms.

References below are to provisions proposed by the Bill.

• Map information holdings and disclosures: identify what personal information is held, where it is stored, who receives it and whether individuals could be identified by combining datasets (proposed ss 6FD–6FG and APP 11.4).
• Review location tracking: assess whether collected location data would qualify as sensitive information and whether consent or an exception would be required (proposed definition of precise geolocation tracking data in s 6(1), s 6FE and APP 4).
• Assess new uses of information: consider and document whether analytics, profiling, AI tools and other proposed uses would be fair and reasonable, taking account of individual expectations, genuine choice and potential harm (proposed APPs 3.1–3.2).
• Review consent and collection notices: check consent wording and notices across enquiry forms, applications and registration processes for clarity, relevance and consistency with actual practices (proposed s 6AAB and APPs 4–5).
• Examine marketing and information-sharing arrangements: review lead generation, referrals, advertising partners and shared databases, including consent to information trading and consistent implementation of opt-out requests (proposed s 6FC and APPs 4.2 and 7.1–7.4).
• Review security and retention procedures: establish appropriate retention periods, workable deletion processes and regular compliance reviews, covering information held internally and by service providers and accounting for legally required retention (proposed APPs 11.1–11.5).
• Test data breach response plans: review escalation procedures, decision-making authority and supplier reporting obligations to support prompt harm reduction and compliance with proposed notification deadlines (proposed ss 26WDA–26WDB and 26WK–26WL).
• Assess whether individuals are recognisable: consider whether identifiers, behavioural profiles or location histories used in analytics, profiling or artificial intelligence allow individuals to be recognised, including when combined with other reasonably available information (proposed ss 6FD–6FG).
• Check access and deletion capabilities: assess whether systems can locate and provide personal information and, for businesses qualifying as large digital platforms, respond to deletion requests (proposed s 6EB and APPs 12.3A, 12.5 and 14).
• Review supplier agreements: clearly document authorised processing purposes, written instructions and security responsibilities, and assess responsibility for providers’ handling of information (proposed ss 6A(2A) and 16D, and APP 11).

The appropriate review will depend on the business’s activities and coverage under the Privacy Act.  Existing obligations continue while the reforms are considered.

Links and further references

Legislation

Privacy Amendment (Personal Data Protection) Bill 2026 (Cth) – exposure draft, not yet enacted

Privacy Act 1988 (Cth)

Privacy and Other Legislation Amendment Act 2024 (Cth)

Other material

2023 Privacy Act Review Report

Further information

If you need advice on how your business collects, uses or shares personal information, contact us for a confidential and obligation‑free discussion.

Disclaimer

This article contains general commentary only.  You should not rely on the commentary as legal advice.  Specific legal advice should be obtained to ascertain how the law applies to your particular circumstances

Related insights