Australia: Controller/Processor Duties

Controller/Processor Duties

Two distinct proposals under the second-tranche exposure draft affect controller and processor duties. First, the draft introduces a formal, GDPR-like recognition of controller and processor roles, a structural concept not currently present in the Privacy Act 1988. The current Act applies its obligations to "APP entities" without distinguishing between an entity that determines the purposes and means of processing and an entity that processes personal information on another's behalf or instruction; the proposed framework would introduce that distinction formally, which would bring role-based clarity but also potentially shift where specific statutory obligations attach within a data-handling chain involving outsourced processors or service providers.

Second, the draft proposes shortening the breach-notification timeline substantially: entities would be required to notify the OAIC within 72 hours of becoming aware of reasonable grounds to believe an eligible data breach has occurred. This proposed timeline is understood to align with equivalent notification windows already in place under the Security of Critical Infrastructure Act 2018 and the Cyber Security Act 2024, suggesting a deliberate effort to harmonise breach-notification timing across Australia's several overlapping breach-reporting regimes rather than operate the privacy regime's timeline in isolation. Importantly, the existing 30-day window for assessing whether a suspected breach is in fact an eligible data breach would remain unaffected; the 72-hour clock would apply only once that assessment concludes with reasonable grounds to believe an eligible breach occurred. The content required within the notification statement itself would also expand under the proposal.

Together, the controller/processor framework and the accelerated notification timeline would represent a meaningful tightening of entities' obligations once a breach, or a service-provider relationship involving personal information, is identified. Neither proposal has yet taken legal effect.

Outlook

The harmonisation rationale behind the proposed 72-hour notification window, aligning with the Security of Critical Infrastructure Act and Cyber Security Act timeframes, suggests this element of the reform may face less resistance during the Bill's passage than more novel elements such as the controller/processor framework, since entities subject to multiple overlapping breach regimes already operate to comparable timeframes under those other Acts. The exact clause numbering and final drafting of the 72-hour requirement had not been retrieved as at this cycle and will become clearer once the Bill, if introduced as the Government has signalled before the end of 2026, is formally tabled.