Further to our article published on 8 September here, the Australian Government has now released the Exposure Draft Privacy Amendment (Personal Data Protection) Bill 2026 and an accompanying consultation paper outlining the long-awaited next tranche of Privacy Act reforms. These are proposed reforms only at this stage and are not yet law.
For Australian businesses, including those undertaking digital marketing, AI initiatives, customer analytics and data-driven services, the proposed reforms would represent the most significant overhaul of privacy law in many years.
Key proposed changes
1. New “Fair and Reasonable” Test
This is arguably the most significant proposed reform and would represent a fundamental shift in how organisations assess the handling of personal information. Organisations would no longer be able to rely solely on obtaining consent to collect personal information. Instead, the collection, use and disclosure of personal information must also be fair and reasonable in the circumstances. Relevant factors would include:
- what a reasonable person would expect;
- whether the use is transparent;
- whether the purpose could be achieved with less data;
- whether individuals had a genuine choice; and
- the balance between benefits and privacy risks.
This would significantly affect online tracking, customer analytics, profiling and AI-related data uses.
2. Stronger Consent Requirements
The draft legislation proposes a more robust definition of consent. Consent would need to be:
- voluntary;
- informed;
- current;
- specific; and
- unambiguous.
The reforms are aimed at reducing reliance on buried terms, bundled consents and “take it or leave it” arrangements. Pre-ticked boxes and dark-pattern design practices would be targeted.
3. Expanded Definition of Personal Information
The concept of personal information would be broadened. Potentially included within the definition:
- device identifiers;
- behavioural information;
- online tracking information;
- AI-generated inferences about individuals; and
- information that “relates to” a person, even if it does not directly identify them by name.
This could materially increase the amount of information subject to the Privacy Act.
4. Regulation of Personal Information Trading
The reforms propose restrictions on the buying and selling of personal information. Businesses would generally require clearer permission before trading personal information, including activities commonly associated with data brokerage.
5. Right to Erasure (“Right to be Forgotten”)
Large digital platforms would be required, in certain circumstances, to delete personal information upon request. This proposal is primarily directed at major social media and search platforms, although its broader operation would need to be assessed once legislation is finalised.
6. Changes Affecting Direct Marketing
The exposure draft contains amendments dealing with direct marketing and targeted advertising. The reforms are intended to bring activities such as:
- audience targeting;
- segment targeting;
- behavioural advertising; and
- use of online behavioural data
more squarely within the privacy regulatory framework, increasing compliance obligations for organisations that rely on targeted advertising, customer profiling and digital marketing strategies.
7. Data Breach and Security Reforms
The draft bill includes amendments relating to:
- notifiable data breaches; and
- security obligations relating to personal information.
These provisions aim to strengthen organisations’ responsibilities in relation to data protection and incident management.
8. New Rules Relevant to AI and Emerging Technologies
The consultation paper expressly identifies emerging privacy risks arising from:
- artificial intelligence;
- wearable devices;
- smart glasses; and
- connected technologies.
The reforms are intended in part to modernise privacy regulation to address these developments.
9. Expansion of Sensitive Information
The draft proposes expanding the categories of sensitive information. One example specifically highlighted is precise location data, which would receive greater protection and generally require consent for collection.
Practical implications for Australian businesses
If enacted substantially in their current form, organisations will likely need to:
- Review privacy policies and APP 5 notices.
- Reassess website consent mechanisms and cookie practices.
- Review direct marketing and lead-generation processes.
- Audit AI systems that use personal information.
- Review customer analytics, profiling and behavioural tracking.
- Reconsider any sharing or sale of customer data.
- Strengthen privacy impact assessment and governance frameworks.
For many businesses, the proposed fair and reasonable test may be more significant than any individual amendment. Rather than focusing solely on “obtaining consent”, organisations may need to demonstrate that their handling of personal information is objectively justified in the circumstances. This proposed second tranche is likely to require substantial updates to many existing Australian privacy documents if enacted in its current form.
We will continue to monitor the changes in this area and provide you with updates as they arise. In the meantime, if you have any queries about your business’ privacy obligations, please contact our Commercial team.
