Australia’s Privacy Act reforms: fundamental changes proposed in new exposure draft

Australia's Privacy Act reform process has reached a critical milestone after more than three years of review, consultation, and incremental legislative action. On 31 August 2026, Attorney-General Michelle Rowland released exposure draft legislation for the second, and most substantive, tranche of reforms. It proposes a new ‘fair and reasonable’ test for the collection and use of personal information, a right of erasure targeting large digital platforms, stronger consent standards, a statutory controller/processor framework, restrictions on the trading of personal data, and enhanced data breach and fraud management obligations.

The reforms come at a time when emerging technologies including artificial intelligence, biometric surveillance and smart glasses have sharpened public and regulatory expectations around how organisations handle personal information. While the first tranche of privacy reforms (enacted in late 2024) expanded the Office of the Australian Information Commissioner’s (OAIC) enforcement toolkit and introduced the statutory tort for serious invasions of privacy, this Bill goes significantly further, by reshaping the foundational obligations that apply across the economy. Alongside the Bill, the federal government announced IDLock, a new digital identity protection service that will allow Australians to block, unblock and monitor the use of identity documents such as driver's licences and passports for online verification via myGov. IDLock builds on the existing Credential Protection Register and is expected to be rolled out nationally in 2027, following early access testing later this year. 

The Bill is still just exposure draft legislation released for public consultation. It has not been introduced to Parliament and may be amended, or not proceed, following the consultation process.

Amending core Privacy Act definitions

The Bill proposes to amend the foundational definitions that determine the scope of the Privacy Act. 

Key changes proposed include:

• Replacing ‘about’ with ‘relates to’ in the definition of personal information. This would bring a broader range of data, including online identifiers, location data and behavioural inferences, more clearly within scope of the Privacy Act. The Bill would also insert a statutory definition of ‘disclosure’, clarifying that disclosure occurs when personal information is made accessible to another person or body, by any means, irrespective of intent. 
   
• Introducing a non-exhaustive list of the types of information that may constitute personal information (including technical identifiers such as IP addresses and device IDs).
   
• Codifying that valid consent must be voluntary, informed, specific and unambiguous. If enacted, this would mean passive or pre-selected mechanisms are not likely to satisfy the Act – consent flows would need to involve a clear, affirmative act by the individual. 
   
• Clarifying that, when assessing whether an individual is reasonably identifiable, entities would need to consider the risk of re-identification, including by reference to other information that is reasonably available or accessible. This is not a ‘set and forget’ exercise; the OAIC has made clear that de-identification is context-specific and the risk of re-identification must remain very low in the relevant data access environment. Entities holding de-identified or pseudonymised datasets would need to make an ongoing assessment of whether individuals could be re-identified from their data.

The Bill would also classify precise geolocation tracking data as a new category of sensitive information. Entities would need to obtain consent before collecting precise geolocation tracking data unless an exception applies.

Handling personal information 

Fair and reasonable 

The proposed fair and reasonable test represents a significant change to how Australian privacy law would regulate how personal information is handled. This test would replace the current framework under APP 3, APP 4 and APP 6 with one core rule. Under that rule, an organisation would only be permitted to collect, use or disclose personal information if the handling is both lawful and fair and reasonable in the circumstances. A privacy policy or collection notice would not be sufficient on its own. Consent would not resolve the issue either. The test would apply even where an individual has agreed to the handling of their information. In practice, collection, use or disclosure of personal information may be unlawful even where clear disclosures have been made, if it is not objectively fair and reasonable in the circumstances.

Organisations would need to assess whether their data practices satisfy these seven factors:

1. Reasonable expectation
    
2. Connection to the organisation’s functions and activities
    
3. Transparency
    
4. Data minimisation
    
5. Genuine choice
    
6. Proportionality
    
7. Where children are involved, their best interests. 

No single factor is decisive. The test is holistic and context-specific.

How the test would apply in practice remains uncertain, pending OAIC guidance and early enforcement decisions. Higher-risk activities, including targeted advertising, profiling, data enrichment and secondary uses of personal information would attract the greatest scrutiny. For example, a retailer that uses purchase data to build audience profiles for advertising partners would need to assess:

• whether customers would reasonably expect that use;
   
• whether the retailer has been transparent about the means and purposes of the handling;
   
• the degree of control customers have over their data; and
   
• whether the use poses a risk of unjustified adverse impact or harm to the individuals concerned. 

Consent requirements 

Under the proposed framework, consent would be expressly required in two situations: collecting sensitive information and trading personal information. For all other handling, organisations would need to satisfy the fair and reasonable test. Where consent is required, it would need to be voluntary, informed, current, specific and unambiguous. Implied consent would remain possible but would need to be clearly inferable from the individual’s conduct, and the purpose of data handling would need to be obvious from context.

Bundled consents, pre-ticked boxes and broad permissions would be unlikely to satisfy the specificity requirement. A single tick-box covering a privacy policy, marketing communications and third-party data sharing would also not be sufficient.

Collection notices would also need to be updated. Under the Bill, a notice would need to cover the fact and circumstances of collection and the purposes for use or disclosure. It would need to be written in clear, plain, concise and up-to-date language.

Trading personal information 

The Bill also introduces the concept of ‘trading’ personal information. This would broadly capture disclosures of personal information for money, other consideration or direct marketing purposes. Businesses that share or monetise customer data, including through data brokerage, list-sharing, advertising partnerships and programmatic advertising involving cookies or pixels, would need to obtain the individual's consent before doing so. A business that passes checkout data to advertising partners for campaign activation, or shares customer lists with third parties for revenue, would likely be trading personal information and would require consent.

Carve-outs would apply for incidental disclosures in transactions such as mergers, and for disclosures to processors acting solely on behalf of the disclosing organisation and strictly in accordance with documented instructions.

Direct marketing 

The Bill would simplify APP 7 and, for the first time, define ‘direct marketing’ in the Act. The current technical distinctions based on how personal information was collected and whether the individual would reasonably expect marketing would be replaced by a single technology-neutral definition.

Direct marketing would mean the communication, by any means, of advertising or marketing material to an individual where that individual has been selected, identified or otherwise targeted using their personal information.

Group-level targeting would be expressly captured. The definition is broad enough to cover programmatic advertising, online behavioural advertising, targeted social media campaigns and audience segmentation. Traditional one-to-one communications such as personalised emails, text messages and telemarketing calls would also fall within the definition. 

However, to the extent those communications are already regulated by the Spam Act 2003 (Cth), the Do Not Call Register Act 2006 (Cth) or certain other Commonwealth laws, the new APP 7 opt-out and disclosure obligations would not apply. The fair and reasonable test and trading consent requirements would still apply to the underlying collection, use and disclosure of personal information for those marketing purposes.

Organisations sending direct marketing communications would need to provide a simple opt-out mechanism, include clear and plain opt-out information in each communication, and have a process in place to action opt-out requests.

Where targeted advertising is served through a third-party platform, responsibility for opt-out obligations would generally sit with the platform rather than the advertiser, unless the platform acts solely as a processor. Advertisers whose campaigns are delivered through such platforms should verify that the platform's opt-out mechanism satisfies the proposed APP 7 requirements.

Ad-supported services could offer different terms to users who opt out of direct marketing, provided those terms give a genuine choice to continue using the service without receiving marketing communications. Choice would not be considered genuine where options are illusory or where dark patterns are used to influence a user’s decision.

The Bill would not introduce a standalone opt-out right for targeted advertising or specific transparency obligations for algorithmic profiling. In practice, however, the fair and reasonable test and trading consent requirements would likely impose a higher standard than those specific rights would have. An opt-out from direct marketing alone would not be sufficient. Organisations would also need to consider whether their underlying data practices are fair and reasonable and whether consent is required before any disclosure for marketing purposes.

Permitted general situations 

The Bill proposes two notable changes to the permitted general situations (PGS) framework.

First, PGS 2 would replace ‘misconduct of a serious nature’ with the broader concept of ‘wrongdoing of a serious nature’. This would extend the ground beyond conduct in employment, professional or official settings to capture serious conduct by individuals acting in a private capacity. It clarifies that it would apply whether the person is internal or external to the entity. This is a practically significant clarification. Under the current definition of ‘misconduct’, which is confined to conduct in the course of a duty, there has been uncertainty about whether PGS 2 supports the use or disclosure of personal information to detect or prevent wrongdoing by external actors, such as third-party fraud, scam activity, or the financial exploitation of vulnerable customers. Financial institutions and other organisations that rely on PGS 2 to support fraud prevention and detection activities will benefit from the broadened scope, which would also expressly permit proactive monitoring and risk detection where an entity has reason to suspect serious wrongdoing, even where no specific instance has yet been identified. 

Second, the existing obligation to make a written note of enforcement-related uses and disclosures (currently APP 6.5) would be relocated to section 16A(3) and backed by a civil penalty provision. In addition, the existing carve-out in APP 8.2(d) that currently exempts disclosures relying on PGS Items 4 and 5 (legal claims and alternative dispute resolution) from the cross-border disclosure framework would be removed. This means that disclosures to overseas recipients relying on those grounds would, for the first time, need to comply with APP 8. 

Data security 

Notifiable data breaches

The Bill proposes a hard 72-hour deadline for notifying the OAIC once an entity has reasonable grounds to believe an eligible data breach has occurred. This is a significant tightening of the current regime, which requires notification only ‘as soon as practicable’. Recognising that a complete picture may not be available within that window, the Bill would permit phased notification: an incomplete statement could be provided to the OAIC within 72 hours (setting out what is known, what is missing, and why), with a complete statement to follow as soon as practicable. Affected individuals would need to be notified at the same time as the OAIC where feasible, and otherwise as soon as practicable after. Separately, new standalone obligations would require all APP entities to maintain breach response practices, procedures and systems, and to take reasonable steps to prevent or reduce harm as soon as a breach, or suspected breach, is identified – regardless of whether it meets the eligible data breach threshold.

If enacted in its current form, the 72-hour deadline would leave very little room for ad hoc responses. Organisations would need to consider whether their existing breach response plans would be adequate under the proposed timeframe, including whether escalation pathways, phased reporting processes and pre-drafted incomplete statement templates are fit for purpose.

Security of personal information

The Bill proposes to strengthen APP 11 in three targeted ways. 

First, where personal information is no longer needed for a permitted purpose, entities would be required to actively consider whether to destroy the information before opting to de-identify – acknowledging that de-identified data can still carry re-identification risk. Destruction would not be mandatory where de-identification is appropriate, but entities would need to turn their mind to the question. 

Second, a new obligation would require entities to take ‘reasonable steps’ to identify the personal information they hold, effectively requiring entities to maintain visibility over their data holdings so they can meet their security and destruction obligations. 

Third, a new ongoing obligation would require entities to regularly evaluate the effectiveness of their security and destruction controls.

If these changes proceed, organisations would need to consider:

• maintaining live data inventories;
   
• embedding structured retention-to-destruction processes;
   
• documenting re-identification risk assessments where de-identification is used; and
   
• conducting periodic effectiveness reviews calibrated to emerging threats.

Data access and erasure 

Access requests - technically impossible or infeasible exception

The Bill introduces a narrow exception to the data access obligation under APP 12. This would allow entities to refuse an access request where, despite taking reasonable steps, compliance remains unreasonable or impracticable due to technical impossibility or infeasibility. An entity that has deliberately designed its systems to make access impossible is unlikely to meet that threshold. An analogous (but separate) exception applies under the new right to erasure for large digital platforms (APP 14.3(d)). However, the consultation paper’s discussion of the ‘deliberately designed its systems’ threshold appears only in relation to the access exception under APP 12.3A – it is not expressly stated for the erasure provision, though presumably a similar logic should apply. 

Notably, however, the Bill does not implement several other individual rights proposals that the government agreed to in principle. This includes the enhanced right to access (which would have required entities to identify the source of indirectly collected information and explain what has been done with it).

Right of erasure on large digital platforms

A new APP 14 would introduce a right to erasure that applies exclusively to large digital platforms (LDPs) – organisations providing social media, relevant electronic, or designated internet services (as defined in the Online Safety Act 2021) that meet a $500 million group revenue threshold, have 2.5 million average monthly Australian end users, or are prescribed by regulation. On request, an LDP would be required to destroy an individual's personal information unless an exception (including frivolous requests, legal retention requirements, technical impossibility after reasonable steps, or where the information is strictly necessary to continue providing a service) applies. Information held solely in a processor capacity is excluded; information the LDP controls would remain subject to erasure. If an exception applies to only part of the information, the LDP would still be required to destroy the remainder.

This is a notably narrower right than the Review Report envisaged. It had proposed erasure against all APP entities, with third-party notification obligations and a quarantine mechanism for law enforcement data (all agreed-in-principle but not carried forward). It also positions Australia as an international outlier: unlike the United Kingdom and European Union General Data Protection Regulation's (GDPR) right to be forgotten, which applies to all data controllers regardless of size or sector, the Australian right would be confined to the largest platforms. It also would not require LDPs to direct third parties or processors to delete shared personal information.

The interaction between erasure and AI training also remains unresolved. Where personal information has been used to train a model, it is unclear whether deleting source data would be sufficient to satisfy an erasure request, or whether derived model outputs would also need to be addressed. The technical impossibility exception may cover this, but the Bill does not engage with the question directly. 

Research exception 

The Bill proposes to replace the fragmented public/private sector research exceptions with a single ‘human research’ exception that would apply equally to organisations and agencies. It would extend well beyond health and medical research to capture surveys, interviews, focus groups and other activities. Under proposed section 94B, conduct that would otherwise breach an APP would be exempt where the research is approved and monitored under the National Statement on Ethical Conduct in Human Research and complies with new Privacy Commissioner guidelines to be issued as a legislative instrument. Consent requirements would also be relaxed for approved research. Entities would not need to satisfy the ‘current’ or ‘specific’ elements of the new consent definition. However, formal ethical review would remain mandatory, and the guidelines the Commissioner ultimately issues would dictate the practical boundaries of the exception.

Controller-processor framework 

Drawing on the GDPR model, the Bill introduces a statutory controller/processor framework. A controller determines the purposes for which personal information is handled; a processor handles it on the controller's behalf in accordance with documented written instructions. Where a processor acts within those instructions, the processor's conduct is attributed to the controller for APP compliance purposes. This would relieve the processor of liability under most APPs, though processors would retain direct obligations under APP 1 (privacy policy) and security (APP 11). All other APP obligations would be attributed to the controller where the processor acts within documented instructions. The exception would not apply where a processor exercises independent discretion over the information.

Practically, the framework would require organisations to map and contractually document their controller/processor relationships, maintain accurate written records of instructions, and ensure contracts adequately allocate data privacy liability. This would represent a welcome reduction in compliance burden for genuine service providers, but would demand rigorous governance frameworks from the entities that engage them.

What is not included in the Privacy Act reforms - and what comes next

The Bill does not address several key areas anticipated following the 2022 Privacy Act Review Report. Notable omissions include:

• reform or removal of the employee record exemption;
   
• removal of the small business exemption;
   
• a direct right of action for individuals;
   
• a prescribed whitelist of countries and contractual clauses for overseas data transfers;
   
• a Data Protection Officer requirement;
   
• expansion of the right of erasure to all APP entities; and
   
• other individual rights the government agreed to in principle, including the right to object to the handling of personal information and the right to request de-indexing of search results.

The Consultation Paper does, however, signal that the OAIC would be given enhanced powers. This would include the ability to require entities to respond to complaints within 60 days and to compel reasonable assistance in connection with investigations. It also invites feedback on whether the Bill’s technology-neutral approach adequately addresses privacy risks posed by emerging technologies, including smart glasses and connected vehicles. While several of the Bill’s reforms would apply to information collected through these technologies, the Privacy Act does not regulate individuals acting in a personal capacity. Beyond the Bill itself, Australia’s broader surveillance framework remains fragmented across Commonwealth, state and territory legislation – each with different thresholds, definitions and exceptions. The Australian Law Reform Commission recommended a uniform national surveillance framework as far back as 2014, but that recommendation has not been acted on.

Outside of the Bill, the government also announced IDLock, a new service that will allow Australians to block and monitor the use of identity documents for online verification via myGov, building on the existing Credential Protection Register. Early access testing is expected later this year, with a national rollout in 2027. 

The OAIC’s Children’s Online Privacy Code is also currently being finalised, with the final Code required to be registered by 10 December 2026. The Code is being developed against the current APPs, but the tranche 2 reforms would rewrite several of the core APPs on which it is based. This raises the prospect that the Code may need to be revisited if the Bill is enacted.

Our data privacy team can help you assess the potential impact of the proposed reforms and assist with preparing submissions in response to the Exposure Draft Bill and Consultation Paper, which close on Friday 18 September.