Australia's Privacy Act Reforms: What Has Changed and What Is Coming in 2026

Australia's Privacy Act 1988 (Cth) is in the middle of the most significant overhaul since the Australian Privacy Principles were introduced in 2014. The first tranche of reforms became law in December 2024 and its most consequential provisions have been arriving in stages ever since. The second tranche — the exposure draft Privacy Amendment (Personal Data Protection) Bill 2026, released by the Attorney-General's Department in late August 2026 — proposes around forty further changes that would reshape how every Australian business collects, uses and secures personal information. Submissions on the draft close on 18 September 2026, and the Government has signalled its intention to introduce the Bill to Parliament before the end of the year. This article explains where the reforms came from, what has already changed, what is coming, and what businesses should be doing now.

How did the Privacy Act reforms come about?

The reform process began with the ACCC's Digital Platforms Inquiry in 2019, which concluded that Australia's privacy framework had not kept pace with the data-driven economy. The Attorney-General's Department then conducted a comprehensive review, culminating in the Privacy Act Review Report of February 2023 and its 116 recommendations. In December 2023 the Government agreed to 38 of those recommendations outright and a further 68 in principle. The legislative response has been split into tranches: the first dealt with matters the Government considered settled; the second, now on the table, addresses the harder structural questions.

What did the first tranche change?

The Privacy and Other Legislation Amendment Act 2024 (Cth) received assent on 10 December 2024. Its headline measures include:

A tiered civil penalty regime. Alongside the existing penalty for serious or repeated interferences with privacy, the Act introduced a mid-tier civil penalty for interferences that are not serious, and a low-tier infringement notice regime for administrative breaches such as deficient privacy policies. The practical effect is that the Office of the Australian Information Commissioner (OAIC) can now take proportionate action against everyday non-compliance, rather than reserving enforcement for catastrophic breaches.

Expanded OAIC powers. The Commissioner gained stronger information-gathering, investigation and public-inquiry powers, together with the ability to make binding APP codes — including a Children's Online Privacy Code, which the OAIC must finalise within two years of commencement and which is currently in draft.

A statutory tort for serious invasions of privacy. Commencing on 10 June 2025, Australians now have a direct cause of action where a person intentionally or recklessly intrudes upon their seclusion or misuses information relating to them, in circumstances where there was a reasonable expectation of privacy and the invasion was serious. A plaintiff need not prove financial loss, the public interest in the privacy must outweigh any countervailing public interest such as freedom of expression, and — critically — the tort applies regardless of the defendant's turnover. Small businesses that have long relied on the Privacy Act's small business exemption are fully exposed to it.

Doxxing offences. New criminal offences in the Criminal Code target the malicious release of personal data.

Automated decision-making transparency. From 10 December 2026, privacy policies must disclose the kinds of personal information used in computer programs that make, or substantially assist in making, decisions that significantly affect an individual's rights or interests. Any business using automated screening, scoring or eligibility tools has fifteen months to audit those systems and update its policy.

What does the second tranche propose?

The exposure draft Bill is considerably more ambitious. Its principal proposals fall into six groups.

Modernised definitions. "Personal information" would be redefined as information that relates to an identified or reasonably identifiable individual — a broader test than the current "about" an individual, and one that would capture technical data such as device identifiers and inferred attributes. "Sensitive information" would expand to include precise geolocation tracking data and genomic information. The draft makes explicit that de-identification is context-dependent and not a permanent state, that "collection" includes information generated or derived from other data, and that consent must be voluntary, informed, current, specific and unambiguous — effectively ending reliance on pre-ticked boxes and bundled consents.

A "fair and reasonable" handling standard. The draft would replace APPs 3, 4 and 6 with a single requirement that the collection, use and disclosure of personal information be fair, reasonable and lawful, assessed against factors including the individual's reasonable expectations, transparency, data minimisation, genuine choice and proportionality. This is the reform with the widest reach. It shifts the compliance question from "did we have consent or a notice?" to "would a reasonable person regard what we did with this information as fair?" — a standard that cannot be satisfied by drafting alone.

Consent for sensitive information and data trading. Organisations would need consent before collecting sensitive information or "trading" personal information, a new statutory concept covering disclosure for consideration or for direct marketing purposes. Limited exceptions would apply, including for information in publicly available documents and collection strictly necessary to provide a requested good or service.

A reformed direct marketing regime. APP 7 would be replaced with a technology-neutral definition of direct marketing, mandatory opt-out mechanisms, specific rules for ad-supported services and clearer allocation of responsibility in multi-party advertising arrangements.

Data breach and security obligations. The draft introduces a standalone definition of "data breach" distinct from an "eligible data breach", imposes a positive duty to take reasonable steps to contain a breach and minimise harm, and — most significantly for incident response planning — would require eligible data breaches to be notified to the OAIC within 72 hours of the entity becoming aware of reasonable grounds to believe a breach has occurred, with ongoing updates thereafter. APP 11 would be strengthened to require entities to identify the personal information they hold, destroy or de-identify information no longer needed, and regularly evaluate the effectiveness of their security measures.

Structural reforms. The draft would introduce a GDPR-style controller and processor framework allocating primary responsibility to the entity that determines the purposes of processing; a right to erasure, initially confined to large digital platforms meeting specified thresholds; a limited "technical impossibility" exception to access requests; and further strengthening of the OAIC's complaint-handling and enforcement powers, including representative complaints.

What is not in the draft?

Several of the Review Report's most debated recommendations do not appear in the exposure draft. The small business exemption — which excludes most businesses with annual turnover under $3 million from the Act — remains in place for now, as does the employee records exemption. The Government has indicated that these questions remain under consideration, and the consultation paper also seeks views on emerging technologies including smart glasses and connected vehicles, suggesting that further measures may follow. Businesses currently relying on the small business exemption should not assume it will survive indefinitely — and should remember that the statutory tort already applies to them.

What should businesses do now?

The reforms are arriving in a sequence, and each step has a date. The statutory tort is live. Automated decision-making disclosures are due by 10 December 2026. The Children's Online Privacy Code is expected around the same time. The second tranche, if introduced this year, is likely to carry a transition period, but the "fair and reasonable" standard and the 72-hour notification window will require changes to systems and culture, not merely documents.

Sensible preparation now includes: mapping what personal information the business actually holds and why; reviewing consent mechanisms against the proposed voluntary-informed-current-specific-unambiguous standard; auditing any automated decision-making tools; testing whether the incident response plan can realistically produce a regulator notification within 72 hours; identifying data that could be destroyed or de-identified today; and, for businesses with a view on the proposals, lodging a submission before 18 September.

Stellar IP Law advises businesses across Sydney, the Gold Coast, Brisbane, the Sunshine Coast, Newcastle and Wollongong on privacy compliance, data handling and the intersection of privacy with intellectual property and technology contracts. If you would like to understand how the reforms affect your business, or need help preparing for the changes already in force, contact us.