#
Core access/correction/portability rights exist and are enforceable, but erasure and objection/restriction rights are narrower or not yet legislated compared to GDPR.
Sub-modules (5)
Access RightGreen
General right to access and be informed about held personal information.
Claims (1):
- The Privacy Act and APPs provide individuals a general right to access and be informed about personal information held about them by APP entities.
Rectification And ErasureAmber
Correction right exists; general erasure right not yet enacted (flagged for future tranche).
Claims (1):
- Commentators noted the 2024 reform bill 'doesn't touch most of the substantive principles' and that a general right to erasure and improved consent models were expected only in a later legislative tranche not materialising before mid-2025 at the earliest.
Restriction And ObjectionAmber
Objection right limited mainly to direct-marketing opt-out under APP 7.
Claims (1):
- APP 7 requires organisations to provide individuals an easy means to opt out of direct marketing communications.
Data PortabilityGreen
Portability delivered via the sectoral Consumer Data Right rather than a general Privacy Act right.
Claims (1):
- The Consumer Data Right, introduced via the Treasury Laws Amendment (Consumer Data Right) Bill/Act 2019, provides consumers with the right to data portability to switch between products and services.
Deadlines And Response WindowsGreen
NDB scheme imposes a 30-day reasonable assessment window plus 'as soon as practicable' notification.
Claims (1):
- The Privacy Act requires organisations to take reasonable steps to conduct a data breach assessment within 30 days of becoming aware of grounds to suspect an eligible data breach, and to notify affected individuals and the OAIC as soon as practicable thereafter.
Key findings (3)
- — source on file
- — source on file
- — source on file
Data Subject Rights
The Tranche 2 exposure draft would create a proposed APP 14 erasure right, but one deliberately scoped to the largest market participants rather than applying universally. 'Large digital platforms' are defined, under the proposal, as those with at least AU$500 million in gross group revenue or at least 2.5 million average monthly Australian end-users. Entities meeting either threshold would be required to destroy personal information on request, subject to exceptions that have not been individually itemised in the sources reviewed this cycle.
This scoping choice is itself notable: rather than a general erasure right applying to all APP entities, the draft targets a defined population of large platforms, leaving smaller organisations outside the proposed erasure obligation entirely. As with the fair-and-reasonable test, this right exists only in exposure-draft form; the Bill had not been introduced to Parliament as at 9 October 2026, and no legal-effective date has been established.
Outlook
The exceptions to the proposed APP 14 erasure right, and whether the AU$500 million revenue or 2.5 million monthly-user thresholds are adjusted before introduction, are the details to watch as the Bill moves, if it does, toward parliamentary introduction.
1 earlier distinct update(s)
Data Subject Rights
The second-tranche exposure draft proposes a new right of erasure applicable to "large digital platforms," a broadly defined category under the draft. This would be a genuinely new right: the current Privacy Act 1988 contains no general equivalent to a right of erasure, meaning Australian individuals currently have no statutory mechanism comparable to the erasure rights available under frameworks such as the EU's General Data Protection Regulation, except insofar as they may negotiate deletion informally or rely on narrower existing mechanisms within the Australian Privacy Principles.
The scope limitation to "large digital platforms" is a notable design choice. Rather than creating a universal erasure right applicable to all APP entities regardless of size or sector, the proposal targets a specific category of entity, understood to be defined broadly enough to capture major platform operators. This suggests the drafters are seeking to address a particular perceived problem, concentration of personal information within a small number of very large platform operators, rather than imposing an erasure obligation uniformly across the entire regulated population, which would include many small businesses otherwise exempt from parts of the Privacy Act.
The erasure right sits within the broader package of reforms discussed under regulator and framework, including the proposed controller/processor framework, and would be one of several mechanisms bringing the Australian regime into closer structural alignment with GDPR-style frameworks, while the proposal remains at the exposure-draft stage and has not been legislated.
Outlook
If introduced and enacted as proposed, the erasure right's practical reach will depend substantially on how "large digital platforms" is ultimately defined in the Bill's final text, a definitional question not yet settled as at this cycle. Entities uncertain about whether they would fall within that category will need to await further detail as the Bill, if introduced before the end of 2026 as the Government has signalled, proceeds through Parliament.
Sources and claims (5)
- ProbableOneTrust DataGuidance — The Privacy Act and APPs provide individuals a general right to access and be informed about personal information held about them by APP entities.observed
- ProbableInternational Association of Privacy Professionals — Commentators noted the 2024 reform bill 'doesn't touch most of the substantive principles' and that a general right to erasure and improved consent models were expected only in a later legislative tranche not materialising before mid-2025 at the earliest.observed
- ProbableInternational Association of Privacy Professionals — APP 7 requires organisations to provide individuals an easy means to opt out of direct marketing communications.observed
- ProbableOneTrust DataGuidance — The Consumer Data Right, introduced via the Treasury Laws Amendment (Consumer Data Right) Bill/Act 2019, provides consumers with the right to data portability to switch between products and services.observed
- ProbableOffice of the Australian Information Commissioner — The Privacy Act requires organisations to take reasonable steps to conduct a data breach assessment within 30 days of becoming aware of grounds to suspect an eligible data breach, and to notify affected individuals and the OAIC as soon as practicable thereafter.observed