The Australian Government has released an exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026 (Bill), which introduces further reforms to the Privacy Act 1988 (Cth) (Privacy Act).
Public consultation on the draft closed on 18 September 2026. The Attorney-General's Department has said that the feedback will inform the final reforms, and the Bill remains subject to further consideration by Government. Given the short consultation period, we expect the Government intends to pass the Bill at the end of the year.
Key takeaways
- The Bill will introduce significant changes to the Privacy Act that will carry a significant operational and compliance cost for businesses. The major changes include:
- A broad "fair and reasonable" test will govern how you collect, use and disclose personal information. The current APP 3 (collection), APP 4 (unsolicited information) and APP 6 (use and disclosure) will be repealed and replaced with a new APP 3 with this test.
- More data will count as personal information. The definition will cover information that "relates to" a person, and the Bill spells out that pseudonyms, device identifiers, location data and behavioural patterns can identify someone even without a name.
- Precise location tracking data becomes sensitive information. Apps and devices that track where people are over time will generally need consent to collect that data.
- You will need consent to "trade" personal information. Trading covers disclosing data for payment or other value, and any disclosure for direct marketing purposes. The Consultation Paper says this may include cookie and pixel sharing in programmatic advertising.
- Direct marketing rules become simpler but wider. Targeting people as part of a segment or cohort using their data will be direct marketing, every communication will need clear opt-out information, and opt-outs must be actioned.
- Data breach obligations tighten. The Commissioner must be notified within 72 hours of an entity becoming aware of reasonable grounds to believe that an eligible data breach has occurred, and there will be a new positive duty to contain breaches and reduce harm.
- A new controller and processor framework will shift primary responsibility to the business that decides how data is used, provided the service provider acts on documented written instructions.
- Existing data is not grandfathered. Most of the new rules will apply to information you already hold when the changes commence.
- Two first tranche reforms arrive in December 2026. Separate to the Bill, the new automated decision-making transparency rules commence on 10 December 2026, and the Children's Online Privacy Code is due to be registered by the same date.
Background: how we got here
The Privacy Act regulates how APP entities (including private sector organisations with an annual turnover above $3 million, or who are otherwise providing a health service and holding health information, trading in personal information, or are contracted service providers for a Commonwealth contract) handle personal information. A substantial amount of reforms to the Privacy Act were recommended in the Attorney General’s Privacy Act Review Report in 2023.
The Privacy and Other Legislation Amendment Act 2024 (Cth) received assent in December 2024 and delivered on a number of these reforms to the Act, including a statutory tort for serious invasions of privacy, transparency obligations for automated decision-making, a Children's Online Privacy Code and a new tiered civil penalty regime.
The Bill is the second tranche of these reforms. The accompanying Consultation Paper describes it as a package of roughly 40 measures: 25 Privacy Act Review proposals that lift privacy protections, five that clarify and simplify obligations, four further simplification measures and seven measures to improve the efficiency of the Office of the Australian Information Commissioner (OAIC).
What is changing
1. A wider definition of personal information
Under the current Act, personal information is information "about" an identified or reasonably identifiable individual. The Bill replaces "about" with "relates to" (new s 6FD). The Consultation Paper explains that information can relate to a person because of what it says about them, or because of the context in which it is used, including where it is used to inform decisions that affect them.
The Bill also adds a statutory note confirming that a person can be identifiable even if their name is not known, where the information allows them to be "recognised, singled out, or otherwise dealt with as a distinct individual in practice". The examples include pseudonyms and identifiers, location data, and characteristics, behaviours, traits, preferences and patterns of activity. A new definition of "reasonably identifiable" confirms that the test considers what other information is reasonably available to combine with the data.
In practice, businesses should expect most cookie, device, advertising ID and web analytics data to be treated as personal information. Hashed or pseudonymised datasets will not automatically fall outside the Act.
2. Wider categories of sensitive information
The Bill makes two changes to the list of sensitive information. "Precise geolocation tracking data" is personal information generated by or derived from a device or other technology that identifies a person's location within a radius of 500 metres and is collected and held by reference to their location over time. The Consultation Paper specifies that one-off location captures and city-level data are not intended to be caught. The existing category of genetic information is also widened to cover genomic information.
Sensitive information attracts a consent requirement for collection. Any business whose app or product tracks user location over time will need to revisit its consent flows.
3. De-identification is a state, not an event
Information will be de-identified "at a particular time, or in particular circumstances" if it has ceased to relate to an identifiable individual. The Consultation Paper is explicit that de-identification can be lost as datasets, technology and access controls change. Businesses that rely on "de-identify and forget" approaches for analytics or data sharing will need ongoing re-identification risk management.
4. Codified consent
Consent will need to be voluntary, informed, current, specific and unambiguous (s 6AAB). Consent can still be implied where it is clear from conduct and context. The Consultation Paper says bundled consents, pre-ticked boxes and interfaces that make it unreasonably difficult to decline are unlikely to meet the standard. These elements largely reflect existing OAIC guidance on the subject.
5. The fair and reasonable test
This is the centrepiece of the Bill. The current APP 3 (collection), APP 4 (unsolicited information) and APP 6 (use and disclosure) are repealed and replaced with a new APP 3. An entity must not collect, use or disclose personal information unless doing so is fair and reasonable in the circumstances, and lawful.
The Bill lists seven matters an entity must consider: whether a reasonable person would expect the handling; whether it relates to the entity's functions or activities; whether the entity is transparent about the means and purposes; whether the purpose could be met with less information or with information that is not personal information; whether the individual has genuine choice; the privacy impact and risk of harm, and whether it is proportionate to the benefits; and, where the individual is a child, the best interests of the child as a primary consideration.
Two points stand out. First, the test is not satisfied simply by disclosing a practice in a privacy policy or obtaining consent. The Consultation Paper says a practice does not become reasonably expected merely because it is described in a notice, and that a "take it or leave it" choice is not a genuine one. Second, the test applies throughout the data lifecycle, not only at collection. Businesses will need to be able to explain and evidence why their handling of personal information meets the standard.
6. Consent to collect sensitive information or to trade personal information
A new APP 4 provides that entities must not collect sensitive information without consent and an organisation must not "trade" personal information without consent.
"Trade" is now defined as disclosing personal information for money or other consideration, or for the purposes of direct marketing. The Consultation Paper says disclosure for direct marketing is to be read broadly and includes disclosures that support or inform marketing, which may include sharing cookie or pixel data in programmatic advertising. Exceptions includes disclosure so that the recipient can provide a product or service the individual has requested, disclosure that is incidental to a sale or transfer of a business, disclosure by a controller to its processor, and certain fraud-related disclosures. Consent to trade is also not required where the disclosure is required or authorised by law or a court or tribunal order, or where a permitted general situation or permitted health situation exists.
There are two new exceptions to the consent requirement for sensitive information, These are collection from a publicly available document (which can include social media posts and material behind a paywall or registration wall), and collection that is "strictly necessary" to provide goods or services the individual has asked for. Collection of sensitive information for direct marketing is never strictly necessary.
7. Direct marketing
APP 7 is replaced with a more simplified framework. A new statutory definition of direct marketing covers advertising or marketing material communicated to a person who has been selected or targeted using their personal information, whether individually or as a member of a class. Targeted social media advertising and online behavioural advertising are squarely within scope.
Organisations must provide a simple opt-out, take reasonable steps to give effect to opt-outs, and include clear, plain, concise and up-to-date opt-out information in every direct marketing communication. The requirement to include that opt-out information will be a civil penalty provision. The current rules built around the source of the data and reasonable expectations disappear, but the underlying use and disclosure of personal information for marketing must still pass the fair and reasonable test, and any disclosure for marketing purposes is a trade requiring consent.
Ad-supported services, such as social media and streaming platforms, are services that earn revenue from making direct marketing communications to their users. They may offer a different version of the service to users who opt out, provided the alternative gives a genuine choice. The Consultation Paper draws on the "consent or pay" approach taken in the United Kingdom and European Union.
8. Shorter collection notices
The long list of matters that must currently be included in a collection notice is replaced with two: the fact and circumstances of the collection, and the purposes for which the entity intends to use or disclose the information. Notices must be in clear and plain language, readily understandable, up to date and concise. Most existing collection notices will need to be rewritten, and businesses will need a process to update notices when their practices change.
| Area | Current position | Proposed position | What it means for you |
|---|---|---|---|
| Personal information | The Act covers information or an opinion "about" an identified or reasonably identifiable individual. | The definition will cover information or an opinion that "relates to" an identified or reasonably identifiable individual. A statutory note lists pseudonyms, identifiers, location data and behavioural patterns as examples of identifying information. | Identifiers, cookie and device data and pseudonymised datasets will generally be personal information. Existing holdings are assessed against the new definition from commencement. |
| Reasonably identifiable | The term is used but not defined outside of OAIC guidance. | An individual will be reasonably identifiable if they could be identified by combining the information with other reasonably available information. | Re-identification risk from combining datasets becomes a statutory test rather than a matter of guidance. |
| Sensitive information | The categories include health, genetic and biometric information. | Precise geolocation tracking data (device-derived, within a radius of 500 metres, collected and held by reference to location over time) is added, and the genetic information category is widened to cover genomic information. | Location tracking over time will require consent to collect unless an exception applies. |
| De-identified | Information is de-identified if it is "no longer about" an identifiable individual. | Information will be de-identified "at a particular time, or in particular circumstances" if it has ceased to relate to an identifiable individual. | De-identification is a state that can be lost, so ongoing re-identification risk assessment will be required. |
| Collects | Collection occurs only where information is collected for inclusion in a record or generally available publication. There is no statutory rule on inferred information. | The record test is retained, but collection expressly occurs regardless of source or means, and generating or deriving information is a collection. A timing rule applies to sensitive information derived from personal information. | Inferences drawn by analytics or AI tools are collections, and inferring sensitive attributes triggers the consent requirement. |
| Discloses | The term is not defined. OAIC guidance treats disclosure as release from the entity's effective control. | An entity discloses personal information if it makes the information accessible to another person or body. Mere transmission or storage, including overseas, is not a disclosure unless the information is made accessible. | Giving a third party access is a disclosure even where the entity keeps control of the data. |
| Consent | Consent is defined only as express or implied consent. OAIC guidance sets out the elements of valid consent. | Consent must be voluntary, informed, current, specific and unambiguous. | Bundled consents, pre-ticked boxes and dark patterns are unlikely to satisfy the statutory test. |
| Trade | There is no concept of trading. A small business loses its exemption where it discloses personal information for a benefit or provides a benefit to collect it. | A trade is a disclosure for money or other consideration, or for the purposes of direct marketing, subject to four carve-outs. The small business exemption is re-cast around this concept. | Sharing data for advertising purposes, including cookie and pixel data, will generally be a trade requiring consent. |
| Collection, use and disclosure | APP 3 governs collection, APP 4 unsolicited information and APP 6 use and disclosure, using concepts of reasonable necessity, primary purpose and reasonable expectation. | APPs 3, 4 and 6 are repealed. A new APP 3 prohibits collection, use or disclosure unless it is fair and reasonable in the circumstances, and lawful, having regard to seven mandatory matters. | Notice and consent will not be sufficient on their own. Each material data practice will need a documented fair and reasonable assessment. |
| Consent for sensitive information and trading | Consent for sensitive information sits in APP 3.3. There is no consent requirement to sell or share data as such. | New APP 4 requires consent to collect sensitive information and to trade personal information. New exceptions apply for publicly available documents and strictly necessary collection. | Digital advertising data flows and location tracking are the practices most affected. |
| Permitted general situations | The exceptions refer to misconduct of a serious nature. | The table of permitted general situations is expanded to absorb enforcement-related exceptions currently located in the APPs. The misconduct exception becomes "wrongdoing of a serious nature" by any person. | Entities gain clearer authority to act on suspected financial abuse and other serious wrongdoing by outsiders. |
| Collection notices | APP 5.2 lists around ten matters to be notified. | APP 5 has been simplified. They must now provide for the fact and circumstances of the collection, and the intended purposes of use or disclosure. Notices must be clear, plain, readily understandable, up to date and concise. | Existing notices will need to be shortened and kept current. |
| Direct marketing | APP 7 restricts use and disclosure for direct marketing based on source, reasonable expectations and consent. | A technology-neutral definition captures targeting of individuals or classes using personal information. New APP 7 requires a simple opt-out, reasonable steps to action opt-outs and opt-out information in every communication, with a modified regime for ad-supported services. Failure to include opt-out information is a civil penalty provision. | Cohort and behavioural advertising is direct marketing. Every channel needs compliant opt-out information, and any disclosure for marketing purposes is a trade. |
| Data breach preparedness and mitigation | The scheme focuses on assessing suspected eligible data breaches within 30 days and notifying them. There is no express containment duty. | A "data breach" is defined separately from an "eligible data breach". Entities must take reasonable steps to implement practices, procedures and systems that ensure compliance with the scheme, and must take reasonable steps to prevent or reduce harm as soon as practicable after becoming aware of reasonable grounds to believe or suspect a breach. | The containment duty applies to every breach, including breaches below the serious harm threshold. |
| Notifying the Commissioner | The statement is due as soon as practicable after the entity forms a belief that an eligible data breach has occurred. OAIC guidance recommends notification occurs within 72 hours. | The statement is due within 72 hours of the entity becoming aware of reasonable grounds to believe that an eligible data breach has occurred, and must describe the response steps. An incomplete statement is permitted with a written explanation, and material changes and errors must be notified. Late notification is a civil penalty provision. | A tested response plan with pre-approved templates will be needed to meet the 72-hour window. |
| Notifying individuals | Entities notify the contents of the statement to affected or at-risk individuals, or publish it. | individuals must also receive follow-up and correction notices. Individuals must be notified at the same time as the Commissioner if practicable, and otherwise as soon as practicable afterwards. No notification is required where remedial action means serious harm is no longer likely for that individual. | Communications to individuals will need to track updates given to the Commissioner. |
| Security and destruction | APP 11 requires reasonable steps to protect information and to destroy or de-identify it when no longer needed. | Entities must consider whether to destroy information they no longer need, must be able to identify the personal information they hold, and must regularly evaluate the effectiveness of their security and destruction measures. | A data inventory, a retention schedule and a review cycle become practical necessities. |
| Access | The APP 12 exceptions do not include technical impossibility. | Access is not required to the extent that, despite reasonable steps, it remains unreasonable or impracticable due to technical impossibility or infeasibility. | The exception is narrow, and anything that can be provided must be provided. |
| Erasure | There is no right to erasure. | Large digital platforms (worldwide business group revenue of at least $500 million, an average of at least 2.5 million monthly Australian end users, or prescription by regulation) must destroy personal information on request, subject to exceptions. | Most small and mid-sized businesses will not be large digital platforms. Larger groups that operate websites or apps should check the definition, and suppliers to platforms may see contractual flow-down. |
| Research | Separate exceptions apply for health and medical research. | A single exception applies for ethically approved human research that complies with Commissioner-made guidelines, replacing the current guideline-based exceptions. | Research organisations will move to a single set of guidelines once made. |
| Controllers and processors | Every APP entity is fully responsible for its own acts and practices. | A processor acting on a controller's documented written instructions does not breach the APPs (other than APPs 1 and 11). The controller is taken to have committed any breach. | Documented processing instructions will determine who carries liability and should become a standard contract schedule. |
What is not in the Bill
The Bill does not remove the small business exemption or the employee records exemption, and it does not introduce a general right to erasure or a requirement to conduct privacy impact assessments. The OAIC efficiency measures described in the Consultation Paper, including a requirement to complain to the business before going to the OAIC and a 60-day complaint response obligation, do not yet appear in the exposure draft. The Government also sought views on wearable technologies and connected vehicles without proposing specific rules.
Also coming in December 2026
Two reforms from the first tranche take effect before the draft Bill is likely to become law. Both have fixed dates, so they should be on your compliance calendar now.
Automated decision-making transparency. From 10 December 2026, new APPs 1.7 to 1.9 will require additional content in your privacy policy if you have arranged for a computer program to make, or to do something substantially and directly related to making, a decision that could reasonably be expected to significantly affect an individual's rights or interests, and personal information about the individual is used in the process. The policy must describe the kinds of personal information used, the kinds of decisions made solely by computer programs, and the kinds of decisions where a computer program does something substantially and directly related to making the decision. The term "computer program" is not limited to artificial intelligence and can include simple rules-based automation. The obligation applies to decisions made after commencement, even where the program was already in use.
Children's Online Privacy Code. The Information Commissioner must register a Children's Online Privacy Code by 10 December 2026. The OAIC consulted on an exposure draft between 31 March and 5 June 2026 and is now finalising the Code. The Code will bind APP entities that provide a social media service, relevant electronic service or designated internet service (as defined in the Online Safety Act 2021 (Cth)) that is likely to be accessed by children, being people under 18, unless the entity is providing a health service. Because a designated internet service can include ordinary websites and apps, the Code is not confined to social media platforms. A breach of a registered code is an interference with privacy. The OAIC has said the exposure draft would require the handling of children's personal information to be consistent with the best interests of the child, which is also one of the seven matters in the draft Bill's fair and reasonable test.
What you should do now
The Bill is a draft, and details may change. Even so, the core concepts have been signalled since 2023 and are unlikely to disappear. We suggest businesses use the coming months to take the following steps.
- Map the personal information you hold, where it came from, why you hold it and who can access it. The fair and reasonable test, the APP 11 changes and the 72-hour breach notice period all depend on knowing this.
- Review your digital marketing and advertising technology. Identify where you share cookie, pixel, customer list or device data with third parties.
- Audit location tracking in your apps and products against the new sensitive information category.
- Test your consent flows against the five elements: voluntary, informed, current, specific and unambiguous. Remove pre-ticked boxes and bundled consents.
- Review and test your data breach response plan against a 72-hour notification window and the new containment duty.
- Review your supplier and customer contracts. Where you act as a processor or engage one, consider whether your current agreements contain documented instructions that would satisfy the new framework.
- Prepare for 10 December 2026. Identify where computer programs make, or substantially contribute to, significant decisions using personal information and update your privacy policy. Assess whether your websites, apps or other online services are likely to be accessed by people under 18, and watch for the registered Children's Online Privacy Code.
How we can help
Our commercial, technology and privacy team advises businesses on Privacy Act compliance, data breach response, privacy policies and collection notices, and the data terms in technology and services agreements. If you would like to discuss how the draft Bill may affect your business, or would like help preparing for the changes that commence in December 2026, please contact our office using the details below.