Updated 2 October 2026 to reflect the draft second tranche of reforms released in August 2026.
The Australian Privacy Act has been on the road to significant reform for several years. The Privacy Act Review Report, released in February 2023, laid down a road map for strengthening individual privacy rights and the regulation and enforcement of those rights, and the Government responded in September 2023.
Since then, reform has arrived in two stages. The first, the Privacy and Other Legislation Amendment Act 2024, received Royal Assent on 10 December 2024. The second, the exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026, was released by the Attorney-General’s Department on 31 August 2026 for consultation that closed on 18 September 2026. At the time of this update it is still a draft, so its details may change. The data governance ramifications for businesses are immense. These reforms are not just compliance checklists to be ticked off; they are redefining the landscape of data governance and customer interactions.
The Crucial Changes
1. Rethinking Consent Mechanisms
The Review Report criticised the current state of notice and consent as unrealistic, and advocated for consent mechanisms and privacy notices that are more transparent and easily understood. The 2026 exposure draft would tighten the requirements for valid consent. Opinion: While there might be an upfront investment involved in revamping these systems, this overhaul could be a game-changer in building customer trust, which is invaluable in the data-driven age.
2. Introduction of the Fair and Reasonable Test
The exposure draft would introduce an overarching “fair and reasonable” test for collecting, using and disclosing personal information, weighing factors such as people’s reasonable expectations, transparency and data minimisation. This would be a paradigm shift in how businesses collect and use data. Opinion: Though this may necessitate a complete review of data collection methods, the benefit lies in ensuring ethical and responsible data management, setting a new industry standard that could differentiate your business.
3. Data Security and Breach Response
This one is already law. Since 11 December 2024, Australian Privacy Principle 11 has made clear that the “reasonable steps” to protect personal information include technical and organisational measures. The exposure draft goes further, proposing that the OAIC be notified of an eligible data breach within 72 hours, instead of the current “as soon as practicable”. Opinion: Although this might seem like an addition to the operational load, it aligns well with proactive insider risk detection and with knowing where your sensitive data is and how it moves. Periodic reviews can serve as a regular health check, pre-empting potential vulnerabilities and data breaches, and an organisation that can see quickly what data was involved in an incident is far better placed to meet a 72-hour deadline.
4. Targeted Advertising Under Scrutiny
Targeted advertising and data-driven marketing were under the spotlight in the Review Report, and the Government’s 2023 response agreed to proposals in this area. Watch how the final second-tranche bill treats them. This is particularly important for businesses that use data analytics for marketing and customer outreach. Opinion: While waiting for the final legislation may seem like a reasonable approach, proactively assessing and restructuring current practices is a solid safeguard against future regulatory hurdles.
5. Individual Control Over Personal Information
Perhaps the most challenging aspect of the reforms is the greater control given to individuals over their data. From 10 December 2026, under the 2024 Act, privacy policies must explain when personal information is used in substantially automated decisions that significantly affect people. The exposure draft would also give individuals a right to ask large digital platforms to erase their personal information. Opinion: Although this might seem like a setback for data-dependent businesses, it’s a pivotal moment for companies to demonstrate respect for consumer autonomy, which could translate into long-term customer loyalty.
6. Regulatory Muscles and Legal Implications
Both of these changes, called for in the Review Report, are now law. The 2024 Act gave the OAIC new enforcement and investigation powers, including a new mid-tier civil penalty and the ability to issue infringement notices for administrative breaches. And since 10 June 2025, individuals have had a direct right of action: a statutory tort for serious invasions of privacy, covering intentional or reckless intrusions upon seclusion and misuse of personal information. The Act also created new criminal offences for doxxing. Opinion: Though this intensifies the risk of legal challenges, it also presents an opportunity for businesses to fortify their compliance frameworks, making them not only robust but exemplary.
What Hasn’t Changed Yet
The Government agreed in principle in 2023 to remove the small business exemption, subject to consultation and impact analysis. The exemption still applies, and the 2026 exposure draft does not remove it.
Next Steps: Time to Act
Part of the reform is already in force and the rest is in draft, so businesses must not remain passive. Review existing privacy policies and practices now, starting with where personal and sensitive information is held, who can reach it, and whether your privacy policy covers automated decisions before 10 December 2026. Companies deeply involved in data governance should follow the second tranche closely as it moves towards Parliament.
In Summary
In my opinion, the changes to the Australian Privacy Act are not a challenge but an opportunity. They offer businesses the chance to go beyond mere compliance and become champions of consumer trust and data ethics. Being proactive and adapting swiftly to these reforms can set your business apart, offering a competitive edge in an increasingly regulated landscape. The time to act is now.
CEO & Co-Founder, ShadowSight
Who is Christopher McNaughton
Chris is a proficient problem solver with a strategic aptitude for anticipating and addressing potential business issues, particularly in areas such as Insider Threat, Data Governance, Digital Forensics, Workplace Investigations, and Cyber Security. He thrives on turning intricate challenges into opportunities for increased efficiency, offering pragmatic solutions derived from a practical and realistic approach.
Starting his career as a law enforcement Detective, Chris transitioned to multinational organisations where he specialised and excelled in Cyber Security, proving his authority in the field. Even under demanding circumstances, his commitment to delivering exceptional results remains unwavering, underpinned by his extraordinary ability to understand both cyber and business problems swiftly, along with a deep emphasis on active listening.