Australia Data Protection & Privacy Regulation

Lawful Processing & Special Data

The Privacy Amendment (Personal Data Protection) Bill 2026, released as an exposure draft, would introduce a requirement that personal information be collected, used and disclosed only where doing so is fair and reasonable — an overarching test that has no direct equivalent in the current Privacy Act, which instead relies on specific Australian Privacy Principle obligations without a general fairness-and-reasonableness threshold. As at 9 October 2026 the Bill had not been introduced to Parliament, so this test remains proposed rather than law, and no legal-effective date exists for it.

If enacted, the fair-and-reasonable test would sit above the existing APP framework as an additional threshold condition on collection, use and disclosure, meaning organisations could satisfy existing specific APP obligations while still failing a new general fairness standard. This structural feature — a general test layered on top of specific rules, rather than replacing them — is the aspect of the proposal most likely to require operational reassessment of existing data-handling practices once and if it becomes law.

Outlook

Introduction of the Bill to Parliament is the gating event for this reform. Until that occurs, organisations have no legal obligation to apply a fair-and-reasonable test beyond their existing APP compliance, though the proposal's direction is a signal of where the regulatory standard for lawful processing in Australia is heading.

Lawful Processing & Special Data

The second-tranche exposure draft proposes to replace the current architecture of lawful-processing concepts, specifically the distinctions between solicited and unsolicited information, the reasonable-necessity test, and the primary-purpose/secondary-purpose distinction, with a single fair-and-reasonable data-handling test. This is a structural simplification in form but a potentially significant substantive shift: rather than requiring entities to characterise information collection and use against several discrete tests, the proposed single test would ask whether handling of personal information is fair and reasonable in the circumstances, a standard with more interpretive latitude for the regulator and the courts going forward.

Alongside this restructuring, the exposure draft proposes tightening the consent standard applicable under the Act. Consent would be required to be voluntary, informed, current, specific and unambiguous, an explicit uplift on the current standard, which has historically been read more loosely by entities relying on bundled or broad consents. Notably, the draft would continue to allow consent to be given either expressly or impliedly, meaning the uplift targets the quality of consent obtained rather than eliminating the availability of implied consent altogether.

Together, these two changes point toward a Privacy Act that, if enacted as proposed, would narrow the room for entities to rely on broadly worded, loosely obtained consents or an expansive secondary-purpose justification for using personal information beyond its original collection purpose. The fair-and-reasonable test in particular would introduce an overarching reasonableness check that applies regardless of whether a specific exemption or consent basis is also satisfied, a structural feature with some resemblance to proportionality-style tests used in comparable overseas frameworks, while remaining its own distinct Australian formulation rather than a direct transplant.

Neither change has yet taken legal effect; both remain at the exposure-draft, proposed stage, pending formal introduction to Parliament and subsequent passage.

Outlook

The practical effect of the fair-and-reasonable test, once and if introduced, will depend heavily on guidance the OAIC issues interpreting the standard, since reasonableness-based tests tend to generate greater initial compliance uncertainty than the more mechanical rules they would replace. The consent uplift is comparatively more concrete and likely easier for entities to operationalise once the Bill's final text is settled. Both provisions remain contingent on the Bill's introduction, which the Government has signalled is intended before the end of 2026.

Controller/Processor Duties

Australia's current breach-notification standard under the Notifiable Data Breaches scheme contains no fixed-hour deadline: organisations must notify the OAIC when a breach is likely to result in serious harm, acting 'as soon as practicable' rather than within a defined number of hours. The Tranche 2 exposure draft would change this materially, requiring notification to the OAIC within 72 hours of becoming aware of reasonable grounds to believe an eligible data breach has occurred. The draft would retain the existing 30-day assessment window that currently applies to suspected breaches, and would expand the content required in the notification statement itself.

The practical effect, if enacted, would be to compress the timeframe between an organisation forming reasonable grounds to believe a breach has occurred and its obligation to notify the regulator, bringing Australia's regime closer to fixed-deadline models used elsewhere. As at 9 October 2026 the Bill carrying this change had not been introduced to Parliament, so the current 'as soon as practicable' standard remains the operative law.

Outlook

Until the Tranche 2 Bill is introduced and passed, the current serious-harm-triggered, no-fixed-hour notification standard remains in force. Organisations should watch for parliamentary introduction as the point at which a genuine 72-hour compliance clock would begin to apply.

Controller/Processor Duties

Two distinct proposals under the second-tranche exposure draft affect controller and processor duties. First, the draft introduces a formal, GDPR-like recognition of controller and processor roles, a structural concept not currently present in the Privacy Act 1988. The current Act applies its obligations to "APP entities" without distinguishing between an entity that determines the purposes and means of processing and an entity that processes personal information on another's behalf or instruction; the proposed framework would introduce that distinction formally, which would bring role-based clarity but also potentially shift where specific statutory obligations attach within a data-handling chain involving outsourced processors or service providers.

Second, the draft proposes shortening the breach-notification timeline substantially: entities would be required to notify the OAIC within 72 hours of becoming aware of reasonable grounds to believe an eligible data breach has occurred. This proposed timeline is understood to align with equivalent notification windows already in place under the Security of Critical Infrastructure Act 2018 and the Cyber Security Act 2024, suggesting a deliberate effort to harmonise breach-notification timing across Australia's several overlapping breach-reporting regimes rather than operate the privacy regime's timeline in isolation. Importantly, the existing 30-day window for assessing whether a suspected breach is in fact an eligible data breach would remain unaffected; the 72-hour clock would apply only once that assessment concludes with reasonable grounds to believe an eligible breach occurred. The content required within the notification statement itself would also expand under the proposal.

Together, the controller/processor framework and the accelerated notification timeline would represent a meaningful tightening of entities' obligations once a breach, or a service-provider relationship involving personal information, is identified. Neither proposal has yet taken legal effect.

Outlook

The harmonisation rationale behind the proposed 72-hour notification window, aligning with the Security of Critical Infrastructure Act and Cyber Security Act timeframes, suggests this element of the reform may face less resistance during the Bill's passage than more novel elements such as the controller/processor framework, since entities subject to multiple overlapping breach regimes already operate to comparable timeframes under those other Acts. The exact clause numbering and final drafting of the 72-hour requirement had not been retrieved as at this cycle and will become clearer once the Bill, if introduced as the Government has signalled before the end of 2026, is formally tabled.

Sectoral Watch

The 1 July 2026 expansion of AML/CTF obligations to Tranche 2 sectors — real estate, legal, accounting, conveyancing, and trust and company service providers — has a direct Privacy Act consequence: entities in these newly captured sectors must now comply with the Privacy Act in respect of their AML/CTF-related data handling, including small businesses that would otherwise fall under the Act's general small-business exemption. This is a sectoral overlay effect rather than a standalone privacy reform: the AML/CTF expansion itself is the primary regulatory event, with Privacy Act coverage of newly regulated small businesses following as a consequence of that expansion rather than as an independent privacy-law change.

The specific statutory provision that overrides the small-business exemption for these entities was not independently located, so the precise legal mechanism by which coverage is extended remains to be confirmed, though the practical effect — Privacy Act obligations now reaching small businesses in these sectors for their AML/CTF data handling — is reported with confidence.

Outlook

Locating the specific statutory provision effecting this exemption override would clarify the precise scope of newly covered small businesses' Privacy Act obligations. This sectoral overlay should be read alongside the AML/CTF Tranche 2 enrolment-enforcement activity being tracked separately, since the same population of newly regulated entities is subject to both AML/CTF enrolment duties and this Privacy Act coverage consequence.

Sectoral Watch

The 1 July 2026 expansion of AML/CTF obligations to Tranche 2 sectors — real estate, legal, accounting, conveyancing, and trust and company service providers — has a direct Privacy Act consequence: entities in these newly captured sectors must now comply with the Privacy Act in respect of their AML/CTF-related data handling, including small businesses that would otherwise fall under the Act's general small-business exemption. This is a sectoral overlay effect rather than a standalone privacy reform: the AML/CTF expansion itself is the primary regulatory event, with Privacy Act coverage of newly regulated small businesses following as a consequence of that expansion rather than as an independent privacy-law change.

The specific statutory provision that overrides the small-business exemption for these entities was not independently located this cycle, so the precise legal mechanism by which coverage is extended remains to be confirmed, though the practical effect — Privacy Act obligations now reaching small businesses in these sectors for their AML/CTF data handling — is reported with confidence.

Outlook

Locating the specific statutory provision effecting this exemption override would clarify the precise scope of newly covered small businesses' Privacy Act obligations. This sectoral overlay should be read alongside the AML/CTF Tranche 2 enrolment-enforcement activity being tracked separately, since the same population of newly regulated entities is subject to both AML/CTF enrolment duties and this Privacy Act coverage consequence.

Algorithmic, Biometric & Surveillance Governance

Two distinct developments define this module's current posture: a forward-looking disclosure duty approaching its commencement date, and an active enforcement investigation already underway. New APP 1.7-1.9, commencing 10 December 2026, will require many organisations to disclose in their privacy policy when a computer system, including AI, is used in a decision that significantly affects an individual. This is a transparency obligation rather than a substantive restriction on automated decision-making itself.

Separately, and already active, the OAIC opened an investigation on 7 October 2026 into the maker of the 'HeyCyan' smart-glasses phone application. This sits within a broader pattern of increasing OAIC scrutiny of smart glasses and other connected or surveillance-capable devices. The Commissioner has stated that entities can be liable as accessories for enabling such devices, a theory of liability that would extend OAIC enforcement reach beyond the device manufacturer itself to other entities facilitating the device's surveillance-capable functionality.

Taken together, the ADM disclosure duty and the active HeyCyan investigation indicate the OAIC is pursuing both a prospective transparency framework and present-tense enforcement against surveillance-capable technology simultaneously, rather than waiting for the Tranche 1 obligations to commence before acting on device-related privacy risk.

Outlook

The HeyCyan investigation's outcome will be an early test of the OAIC's accessory-liability theory for connected and surveillance-capable devices. Separately, 10 December 2026 will bring the ADM disclosure duty into force, requiring covered organisations to update privacy-policy disclosures for AI-driven significant decisions.

Algorithmic, Biometric & Surveillance Governance

From 10 December 2026, APP entities that use automated decision-making significantly affecting individuals must disclose in their privacy policy which decision types are made by automated means and what personal information is used in making them. This obligation is enacted under the Privacy and Other Legislation Amendment Act 2024 but has not yet taken legal effect; it commences on the stated date. The OAIC has already moved to operationalise the coming duty at the guidance level, issuing Australian Privacy Principles Guidelines Chapter 1 version 2.0, effective 29 September 2026, which requires privacy policies to address computer-program and automated-decision usage ahead of the statutory obligation's commencement. Together these two instruments, one a guidance document and one a commenced-but-not-yet-effective Act provision, form the current shape of Australia's algorithmic-transparency regime: a disclosure duty tied specifically to privacy-policy content, applying where automated decision-making significantly affects an individual, rather than a broader algorithmic-accountability or audit regime.

Outlook

The obligation's legal effective date of 10 December 2026 is the determinative marker. Entities relying on automated decision-making that significantly affects individuals have until that date to align privacy-policy disclosures with both the statutory requirement and the OAIC's Chapter 1 v2.0 guidance; no further legislative change to this specific obligation was identified this cycle.

Children & Vulnerable Groups

The OAIC's Children's Online Privacy Code, developed against the current Australian Privacy Principles rather than against the Tranche 2 reform framework, must be registered by 10 December 2026. This registration deadline places the Code on the same operative timeline as the new APP 1.7-1.9 automated-decision-making disclosure duties, meaning organisations serving children will face two converging compliance obligations on the same date: the finalised Children's Code itself, and the ADM disclosure duty where applicable to services used by children.

Because the Code is developed against the current APPs rather than the still-pre-parliamentary Tranche 2 framework, its content and obligations are not contingent on the Tranche 2 Bill's introduction or passage; it proceeds on its own statutory basis toward the 10 December 2026 registration deadline regardless of the broader reform's progress.

Outlook

The period immediately before 10 December 2026 is the key compliance-preparation window for organisations providing services to children in Australia, as the Code's registration converts its content from developed-but-unregistered guidance into a binding instrument.

Children & Vulnerable Groups

Under Tranche 1 of the Privacy Act reforms, already enacted ahead of this cycle, the OAIC is statutorily required to develop and register a Children's Online Privacy Code by 10 December 2026. As at this cycle, the Code is understood to remain in draft, meaning registration has not yet occurred, though the statutory deadline remains in force and approaching.

This is a distinct development track from the second-tranche exposure draft discussed elsewhere in this brief: the Children's Online Privacy Code obligation derives from already-enacted Tranche 1 provisions, placing it on a firmer legal footing than the still-proposed second-tranche reforms, even though the Code's content has not yet been finalised or registered. The practical effect of the Code, once registered, would be to impose specific obligations on entities handling children's personal information online, a vulnerable-group protection mechanism with some conceptual parallel to children's codes operating in other jurisdictions, adapted to the Australian Privacy Principles framework.

The approaching deadline means this is one of the more concretely dated developments in Australia's current privacy reform landscape, in contrast to the second-tranche Bill's introduction timeline, which remains contingent on parliamentary scheduling. Because the Code derives its legal requirement from already-enacted provisions, its 10 December 2026 deadline is not dependent on the second-tranche Bill's progress or ultimate enactment.

Outlook

The statutory deadline of 10 December 2026 for registering the Children's Online Privacy Code falls within the current reporting period's near horizon and is independent of whether the second-tranche Bill is introduced to Parliament on the Government's signalled timeline. Given the Code remains in draft, the key near-term question is whether the OAIC will register it by the statutory deadline or whether a delay occurs; no information available this cycle indicates which outcome is more likely.

Enforcement & Redress

The OAIC is pursuing an explicitly enforcement-first posture in 2026, visible across several simultaneous strands. On 15 June 2026 the OAIC published a determination ordering American Express Australia Limited to compensate a complainant, having found that American Express failed to adequately mitigate the risk of employees improperly accessing personal information. On 7 October 2026 the OAIC opened a new investigation into the maker of the 'HeyCyan' smart-glasses application, part of a wider pattern of scrutiny of connected and surveillance-capable devices.

This active enforcement posture sits in tension with a separate, structural capacity constraint: as at February 2026, the OAIC stated it is unlikely to substantially progress newly lodged, validly-made individual privacy complaints for around six to twelve months after lodgement, absent exceptional circumstances. The combination is analytically significant — the regulator is simultaneously escalating high-profile, higher-materiality enforcement actions (determinations, new investigations) while acknowledging a multi-month structural delay for ordinary individual complaint handling, indicating a prioritisation of resources toward systemic or higher-impact matters over routine individual redress.

Outlook

Whether the OAIC's complaint-handling backlog narrows over the coming months, even as its enforcement-first posture on higher-profile matters like HeyCyan continues, is the key operational question for this module. The outcome of the HeyCyan investigation will also be a signal of how the OAIC's accessory-liability theory for connected devices develops in practice.

Enforcement & Redress

Australia's civil-penalty architecture under the Privacy Act 1988 (Cth) remains tiered: serious interferences with privacy carry civil penalties up to the greater of AUD 50 million, three times the benefit obtained, or 30 percent of adjusted turnover, non-serious interferences carry penalties up to AUD 3.3 million, and administrative breaches carry penalties up to AUD 330,000. This penalty structure was carried from the first Privacy Act reform tranche and was not independently re-verified this cycle beyond the APP Guidelines update. Separately, a statutory tort for serious invasions of privacy, which commenced 10 June 2025, continues to permit individuals to bring direct action regardless of whether the OAIC is involved, subject to exemptions for journalism, law enforcement and intelligence activity; no change to the tort was identified this cycle. On the reform horizon, public consultation on the exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026, comprising around forty proposed reforms including a fair-and-reasonable handling test and a right of erasure for large digital platforms, closed 18 September 2026. The government has signalled an intention to introduce the Bill before the end of 2026, but no introduction to Parliament was confirmed this cycle.

Outlook

Whether the Privacy Amendment (Personal Data Protection) Bill 2026 is introduced to Parliament before the end of 2026, as the government has signalled, is the key marker to watch. If introduced, the Bill's roughly forty proposed reforms, including the fair-and-reasonable test and the large-platform erasure right, would represent the next material escalation in Australia's enforcement and redress architecture beyond the existing tiered civil-penalty regime and statutory tort.