Australia: Regulator & Framework

Regulator & Framework

The Office of the Australian Information Commissioner continues to administer the Privacy Act 1988 (Cth) as Australia's federal supervisory authority. No statutory restructuring of the OAIC's mandate was identified this cycle. The more significant development sits at the guidance layer: the OAIC issued version 2.0 of Chapter 1 of its Australian Privacy Principles Guidelines, effective 29 September 2026, which requires privacy policies to include information about the use of computer programs and automated decision-making. This guidance update precedes, and prepares entities for, the statutory automated-decision-making transparency obligation under the Privacy and Other Legislation Amendment Act 2024, which commences 10 December 2026. On registration, no general APP-entity registration or filing-fee duty to the OAIC was located this cycle; coverage under the Privacy Act continues to be determined by the Act's threshold coverage test rather than by any registration requirement, a negative finding carried forward from prior research.

Outlook

The guidance-to-statute sequencing here is a marker rather than a conclusion: the OAIC's Chapter 1 v2.0 update effective 29 September 2026 is best read as preparation for the 10 December 2026 commencement of the ADM transparency obligation, and entities should expect the regulator's guidance posture to continue firming as that date approaches.

Regulator & Framework

The Office of the Australian Information Commissioner continues to administer the Privacy Act 1988 and the Australian Privacy Principles as the sole federal privacy regulator, a standing role unchanged this cycle. The material development is the advancement of the second-tranche Privacy Amendment (Personal Data Protection) Bill 2026, whose exposure draft was published in late August 2026. The draft proposes approximately 40 reforms spanning eight distinct themes: core definitions, OAIC powers, consent, data breach and security, data trading and marketing and sensitive information, a processor framework, and an erasure right targeted at large digital platforms.

Public submissions on the exposure draft closed on 18 September 2026, placing the reform at a consultation-closed stage. The Government is understood to have signalled an intention to introduce the legislation to Parliament before the end of 2026, though formal introduction had not been confirmed as at the close of this cycle. Taken as a package, the reform is understood to represent the most substantial change proposed to the Privacy Act's lawful-processing and breach-notification architecture since the Act's original enactment. It would move the Australian regime structurally closer to the European Union's General Data Protection Regulation through mechanisms such as formal controller and processor role recognition and an erasure right, while nonetheless retaining a distinctly Australian architecture: the draft proposes a single fair-and-reasonable data-handling test rather than adopting the GDPR's lawful-basis structure outright.

The scale of the proposed reform, covering eight separate thematic areas in a single package, signals an intent to modernise the framework comprehensively rather than through piecemeal amendment. This is consistent with the sustained international and domestic pressure for Australia's privacy framework to converge more closely with international standards, while preserving the Act's own doctrinal foundations rather than wholesale importing a foreign framework.

Outlook

The principal milestone to watch is whether the Bill is formally introduced to Parliament before the end of 2026, as the Government has signalled. Given that consultation closed only on 18 September 2026, the timeline from exposure draft to introduction is compressed, and any slippage into 2027 would not be surprising given the scale of the proposed changes across eight thematic areas. Once introduced, the Bill would then need to proceed through the ordinary parliamentary process, meaning enactment and commencement dates remain considerably further out than the introduction milestone itself.