Privacy Amendment (Personal Data Protection) Bill 2026 exposure draft

The Attorney-General's Department released an exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026 on 31 August 2026, together with a consultation paper setting out the second tranche of reform to the Privacy Act 1988. The exposure draft contains roughly 40 proposals, including measures that uplift privacy protections, measures intended to clarify and simplify existing obligations, and measures to improve the efficiency of the Office of the Australian Information Commissioner.

Key proposed changes include modernised and clarified core definitions, including personal information, sensitive information, de-identified, consent and disclosure, a requirement that collection, use and disclosure of personal information be fair and reasonable, a reformed direct marketing regime, a 72 hour timeframe for notifying eligible data breaches, a right to erasure of personal information held by large digital platforms, and new controller and processor concepts drawing on comparable European frameworks. The consultation paper also seeks views on separate measures still under development concerning emerging technologies such as wearable devices and connected vehicles.

Submissions on the exposure draft closed on 18 September 2026. The Bill remains subject to further consideration by government, and no commencement date has been set. The reforms, once settled, would apply to every organisation handling personal information under the Privacy Act, including law practices, and would sit alongside the first tranche of changes already made by the Privacy and Other Legislation Amendment Act 2024.