By Scott Coulthart, Partner and Rio Ramsey, Paralegal
The Australian Government has released (on 31 August 2026) an Exposure Draft of the Privacy Amendment (Personal Data Protection) Bill 2026, signalling the next major phase of Privacy Act reform.
The package contains around 40 proposed changes, ranging from technical amendments to reforms that could significantly alter how organisations collect, use and manage personal information. While the proposals remain subject to consultation, they provide a clear indication of where Australian privacy law is heading.
The most important theme running through the reforms is a shift away from highly technical compliance rules and towards a broader question: is the organisation’s handling of personal information fair and reasonable?
The reforms would expand the definition of personal information by replacing information “about” an individual with information that “relates to” an individual.
That may sound like a small drafting change, but it reflects a much broader view of what constitutes personal information in a digital environment.
The draft legislation makes clear that a person can be identifiable even if their name is unknown. If someone can be recognised, singled out or treated as a distinct individual through identifiers, behavioural data, location information or online tracking technologies, the information may fall within the Privacy Act.
For many organisations, the practical consequence is that data historically regarded as anonymous, such as device identifiers, advertising IDs, online profiles and behavioural tracking information, may require closer scrutiny.
The proposed reforms would also expand the concept of sensitive information.
Most notably, “precise geolocation tracking data” would become sensitive information where a person’s movements are tracked over time within a 500-metre radius.
Because sensitive information generally requires consent to collect, organisations using location-based services, mobile apps, connected devices or analytics platforms may face additional compliance obligations.
The reforms also address inferred information. An organisation would not automatically be treated as collecting sensitive information simply because it holds data from which a sensitive characteristic could potentially be inferred. Instead, the additional obligations arise when the organisation actually derives, records, uses or discloses the sensitive attribute, or otherwise relies upon the information as sensitive information.
This distinction is particularly relevant for organisations using analytics, profiling and artificial intelligence systems.
Perhaps the most significant proposal is the introduction of a new overarching requirement that personal information may only be collected, used or disclosed if the handling is lawful and “fair and reasonable in the circumstances”.
In assessing fairness and reasonableness, organisations would need to consider factors such as:
Under the current framework, privacy compliance often focuses on identifying a technically available pathway under the Australian Privacy Principles. Under the proposed regime, organisations may increasingly be required to justify why a particular practice is proportionate, transparent and appropriate.
This is a significant shift in emphasis, changing the relevant question from “can we do this?” to “should we do this?”.
The reforms impose slightly more stringent requirements for consent. Consent would need to be voluntary, informed, current, specific and unambiguous.
The consultation material specifically targets practices such as pre-ticked boxes, bundled consents and interface designs that make refusal difficult. Organisations relying on consent may therefore need to rethink both the wording and design of their consent processes.
Importantly, consent would no longer operate as a complete answer to privacy concerns. Even where consent exists, a practice may still need to satisfy the broader fair and reasonable test.
One of the more novel proposals is the introduction of specific rules governing the “trading” of personal information.
In broad terms, trading would include disclosures made for money or other consideration, as well as disclosures connected with direct marketing activities.
This is potentially far wider than simply buying and selling customer databases.
The proposal appears intended to capture many contemporary advertising technology arrangements, including certain uses of cookies, pixels, audience-matching services and targeted advertising ecosystems.
Where personal information is traded, consent would generally be required unless a specific exception applies.
For organisations involved in digital marketing, customer acquisition or advertising technology, this could become one of the most important reforms in the package.
The proposed reforms would significantly strengthen data breach obligations.
Organisations would be required to maintain systems and procedures capable of responding effectively to privacy incidents and take reasonable steps to prevent or reduce harm arising from actual or suspected breaches.
The package would also introduce a 72-hour reporting requirement once an organisation becomes aware that an eligible data breach has occurred.
While Australia is not simply copying the European GDPR model, the introduction of a 72-hour notification timeline reflects a growing expectation that organisations respond rapidly and transparently when incidents occur.
In practice, many organisations may need to review whether their incident response plans, governance structures and legal assessment processes are capable of supporting accelerated notification requirements.
The reforms reinforce the principle that organisations should not retain personal information indefinitely.
If information is no longer required for a permitted purpose, organisations would be required to consider whether it should be destroyed or de-identified and take reasonable steps to implement that decision.
The proposals also recognise that de-identification is not permanent. Information that appears de-identified today may become identifiable tomorrow because of technological developments or the availability of additional datasets.
This places greater emphasis on ongoing information governance rather than one-off compliance exercises.
The Exposure Draft would introduce a limited right to request destruction of personal information held by large digital platforms.
This is not a broad Australian “right to be forgotten” equivalent to Europe. The right would apply only to particular large online services and would remain subject to a range of exceptions.
Nevertheless, it reflects a broader policy objective of giving individuals greater control over their personal information.
The reforms are not yet law, and aspects of the package may change through consultation. However, the direction of travel is becoming increasingly clear.
Organisations should already be considering:
The proposed reforms represent more than a privacy policy update. They signal a broader shift towards accountability, proportionality and justification.
If enacted in anything like their current form, Australian privacy compliance will increasingly be judged not simply by what an organisation discloses, but by whether its information-handling practices are fair, reasonable and capable of being defended when challenged.
If you would like further information or have any queries regarding other matters, please do not hesitate to contact:
