On 31 August 2026 the Australian Government released an exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026, with comments closing on 18 September. The Attorney-General's Department consultation page says the aim is to "modernise and strengthen Australia's privacy laws for the digital age", citing risks from AI and wearables such as smart glasses. It also stresses that the Bill "remains subject to further consideration by government." This is the second tranche of reform, and it deserves a careful read because several provisions are good policy while others hand regulators and courts a great deal of discretion.
The strongest case for the draft
Australia's Privacy Act dates from 1988. The Attorney-General's Department's Privacy Act Review Report (February 2023) made 116 proposals, and the Government's September 2023 response agreed or agreed in principle to 106 of them, according to A&O Shearman's analysis of the draft. Tranche 1 passed Parliament on 29 November 2024 and received Royal Assent on 10 December 2024, but it delivered only a fraction of that agenda, mainly tiered civil penalties and a statutory tort for serious invasions of privacy, as Norton Rose Fulbright summarised. Reformers have a fair point that consumers face real harm from large breaches and opaque data trading while the law waits.
What the draft does
According to A&O Shearman, the draft:
- Consolidates collection, use and disclosure rules. Australian Privacy Principles 3, 4 and 6 become a single APP 3 requiring handling to be fair, reasonable and lawful, judged against seven non-decisive factors: reasonable expectations, link to the entity's functions, transparency, data minimisation, genuine choice, impact and risk of harm, and the best interests of children.
- Tightens consent. Consent is required to collect sensitive information and to trade personal information, and must be voluntary, informed, current, specific and unambiguous. Implied consent is allowed only where it is clearly inferable from conduct and context. Two exceptions are added: publicly available documents, and collection strictly necessary to provide a requested service.
- Widens sensitive information to include genomic information and precise geolocation (accurate to within 500 metres and tracked over time).
- Imposes a 72-hour breach deadline. Eligible data breaches must be reported to the OAIC within 72 hours of the entity having reasonable grounds to believe one occurred, replacing "as soon as practicable." An incomplete statement may be filed first, with details to follow. All breaches also trigger duties to maintain response systems and take reasonable steps to reduce harm.
Where the draft is right
The breach rules are the clearest win. The OAIC received 532 notifications in January to June 2025, with malicious or criminal attacks the largest source (308 notifications). A fixed clock, paired with permission to file an incomplete notice, gives firms certainty and lets regulators warn affected people earlier without demanding a perfect forensic picture on day three. That is proportionate: it matches the 72-hour expectation familiar from other major regimes and so lowers compliance cost for multinationals.
Treating genomic data as sensitive is also defensible. Genetic information is immutable, identifies relatives who never consented, and cannot be reissued after a leak. Limiting precise geolocation to data tracked over time sensibly avoids catching every one-off map lookup.
Where it risks overreach
The central concern is the "fair and reasonable" test. Seven factors, none decisive, applied to all collection, use and disclosure, is an invitation to litigate every product decision. A start-up building a fitness app or a diagnostic tool cannot know in advance how the OAIC will weigh "impact and risk of harm" against "genuine choice." Large incumbents with legal departments absorb that ambiguity; small developers do not. The draft leaves the details of that weighing to OAIC guidance that does not yet exist, so the practical meaning of the law would be written after the compliance obligation attaches.
The consent exceptions add to the uncertainty. "Strictly necessary to provide a requested service" is a narrow gate for innovative services whose data needs are not obvious at launch, such as health models that improve with use. A workable regime would pair the standard with safe-harbour examples in the statute or regulations, not rely on later guidance alone.
There is also a gap between the framing and the text. The public description of the package points to expanded OAIC enforcement, but A&O Shearman reports that the Bill itself contains no new OAIC powers. Proposals such as a 60-day complaint-response requirement, group representative complaints and a power to compel assistance in investigations appear only in the Consultation Paper, without draft provisions. Stakeholders could not comment on legislative text for the most consequential enforcement changes. Those powers should be published as drafted law and consulted on separately, with proper safeguards on compelled assistance.
The same analysis notes what is missing: the small business exemption, the employee records exemption and a direct right of action are all absent, though they were agreed in principle. Leaving them out reduces cost for small firms, but it also means the compliance burden lands unevenly on mid-sized companies just above the threshold.
What to watch
The commencement table is blank, so no start date exists. The consultation closed on 18 September 2026 and the department says it will not consider late submissions. The next signal will be whether the Government introduces a revised Bill, whether it tightens the fair-and-reasonable test with concrete examples, and whether the OAIC enforcement measures arrive as text. Australia should adopt the breach clock and the sensitive-data upgrades quickly, and slow down on the open-textured test until developers can see how it will be applied.