03 September 2026
5 min read
Published by:
The Attorney-General has released an exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026 (Bill), proposing the most significant changes to the Privacy Act 1988 since the Australian Privacy Principles (APPs) were introduced.
The draft touches core definitions, the APPs, the notifiable data breach scheme, data security, and rights of access and erasure. Even if only part of the Bill proceeds through Parliament in its current form, organisations should treat it as a clear signal to review and strengthen their privacy policies, procedures and risk management framework now.
The Bill replaces the current definition of personal information with a standalone provision confirming that an individual is "reasonably identifiable" if they could be identified by combining information with other information that is reasonably available, and expressly lists location data, pseudonyms, identifiers, and behavioural patterns as examples. It also introduces a new category of sensitive information: precise geolocation tracking data, defined as information that identifies an individual's location within a 500-metre radius over time.
Organisations that rely on device data, analytics, geolocation or behavioural profiling will need to reassess whether that data now falls within scope, and whether it attracts sensitive information handling requirements.
For the first time, the Privacy Act will define what constitutes valid consent. Consent must be voluntary, informed, current, specific and unambiguous. Pre-ticked boxes, bundled consents, and stale or generic consent language are unlikely to satisfy this standard. Every privacy collection statement, consent flow, cookie banner and marketing opt-in will need to be reviewed against this five-part test.
The Bill introduces a new Australian Privacy Principle 3 requiring that collection, use and disclosure of personal information be fair and reasonable in the circumstances, having regard to matters such as reasonable expectations, data minimisation, transparency, genuine choice, and the best interests of children. This is a substantive, outcomes-based test that sits above and beyond simply following the existing APPs.
An organisation can technically comply with the APPs on paper but still breach the Privacy Act if its actions are not fair and reasonable. Privacy risk assessments, product design reviews and data governance frameworks will all need to incorporate this new threshold.
The notifiable data breach scheme is substantially rebuilt. Entities will be under an express, standalone obligation to implement practices, procedures and systems to ensure compliance with the data breach provisions, and to take reasonable steps to mitigate harm as soon as practicable once aware of an actual or suspected breach.
Where an eligible data breach occurs, entities must give the Privacy Commissioner a statement within 72 hours, a materially tighter timeframe than the current "as soon as practicable" standard. Incident response plans, breach playbooks and cyber insurance arrangements should be reviewed now to ensure this new timeframe is achievable in practice.
Australian Privacy Principle 11 is expanded beyond the security of personal information. It will require APP entities to destroy or de-identify personal information when it is no longer needed for any permitted purpose, and to regularly evaluate their compliance with these obligations. This converts data retention and security from a one-off policy setting into an ongoing, documented governance process. Data retention schedules, deletion protocols and security assessment cycles will need to be revisited and evidenced.
The Bill creates a new Australian Privacy Principle 14, giving individuals a right to require large digital platforms, generally those with business group revenue of at least $500 million or at least 2.5 million Australian end-users, to destroy their personal information on request, subject to limited exceptions. Qualifying platforms will need erasure request-handling processes, response-timeframe tracking and clear internal criteria for when an exception applies.
Exposure drafts are not final law, and this Bill may be amended, narrowed or delayed as it moves through Parliament. However, the policy direction is clear: broader definitions of personal information, a codified consent standard, a fair and reasonable overlay on the APPs, faster breach notification, and affirmative security, retention and erasure obligations. These themes are consistent with reform proposals that have been under discussion for several years, and it is unlikely that all of them will be abandoned.
Organisations that wait for the final text before uplifting risk a compressed implementation timeline once the Bill passes, particularly given some provisions (such as the 72-hour breach notification window) require operational, not just legal, change. Starting the gap assessment now, while the drafting is still open for comment, also gives organisations the opportunity to engage in consultation on provisions that may be unworkable in practice.
For other changes in the Bill, see the exposure draft here. We will continue to monitor the Bill's progress and provide updates when available.
In the meantime, please get in touch with us here if you would like a tailored gap assessment against the exposure draft.
Disclaimer
The information in this article is of a general nature and is not intended to address the circumstances of any particular individual or entity. Although we endeavour to provide accurate and timely information, we do not guarantee that the information in this article is accurate at the date it is received or that it will continue to be accurate in the future.
Published by:
