Modernising Australia's privacy laws for the digital age

The Attorney-General's Department has released the exposure draft Privacy Amendment (Personal Data Protection) Bill 2026, together with a consultation paper, as the next stage of reform to the Privacy Act 1988. The draft bill follows the amendments made in 2024 and contains about 40 proposed changes, including measures to broaden and clarify core definitions such as personal information, consent and disclosure, strengthen requirements for handling personal information, update direct marketing rules, and address data security, data access and erasure. It also proposes a narrower exception for research and an exception for entities that process information on behalf of others.

The consultation paper separately seeks feedback on measures still under development, including proposals to improve the efficiency of enforcement by the Office of the Australian Information Commissioner and to address privacy issues raised by emerging technologies such as wearable devices and connected vehicles. Submissions on the exposure draft closed on 18 September 2026, and the government has indicated an intention to introduce legislation before the end of the year, though the bill remains subject to further consideration and no provision has commenced.

If enacted in its current form, the reforms would represent the most significant change to the Privacy Act since the Australian Privacy Principles were introduced in 2014, and organisations handling personal information, including those operating artificial intelligence systems or connected devices, would need to revisit how they collect, use, hold and disclose that information. Because the bill is only in exposure draft form, no obligation yet applies and the final content and commencement timing remain uncertain.