Australian Government Unveils Tranche 2 of its Privacy Law Reforms
What has happened?
On 31 August 2026, the Attorney-General released the highly anticipated Exposure Draft Bill for tranche 2 of the privacy law reforms.
The release of the Exposure Draft of the Privacy Amendment (Personal Data Protection) Bill 2026 (Bill) is a significant development for privacy law reform in Australia.
The Bill is accompanied by a consultation paper, which provides useful information to help readers understand key changes and provisions of the Bill. The Australian Government is seeking feedback on the Bill and stakeholders have until 18 September 2026 to provide a concise submission to the Attorney-General’s Department. If all goes to plan, we may see the Bill pass both houses of Federal Parliament by the end of this year.
For more information, please visit the Attorney-General’s Department website.
Key takeaways
If the Bill passes as currently drafted, at a minimum APP entities will need to:
review current privacy practices to identify information it collects that falls within the expanded definitions of personal information and sensitive information.
review collection notices and collection practices to align with the new definition of “collects” and simplified collection notice obligations.
review consent mechanisms, privacy policies, collection notices and terms and conditions to ensure individuals are provided genuine choice and opportunity to provide valid consent.
embed “fair and reasonable” considerations into personal information collection and handling practices.
review and strengthen data breach response planning, data security protections and de-identification and destruction processes.
consider the implications of the proposed “controller” and “processor” concepts.
If you need help with understanding what the Bill may mean for your business, O’Dowd Legal is here to help! Please reach out for a complimentary and confidential chat.
What is changing?
In summary, the Bill:
modernises or introduces core definitions for key terms including “personal information'“, “sensitive information”, “de-identified”, “collects”, “consents” and “disclosure”.
simplifies and strengthens requirements for the handing of personal information including by introducing a “fair and reasonable” test for the collection, use and handling of personal information, strengthening consent requirements and simplifying collection notice requirements.
strengthens and clarifies data security and minimisation requirements including ongoing and proactive evaluation and monitoring of data security and data destruction measures.
clarifies obligations in relation to responding to data breaches including introducing positive obligations to contain a “data breach” and notifying the Office of the Australian Information Commissioner within 72 hours of having reasonable grounds to believe that an “eligible data breach” has occurred.
introduces a right to erasure obligation for large digital platforms.
introduces the processor and controller distinction into Australian privacy law to reduce unnecessary and confusing obligations for processors of personal information.
Why these changes matter
The Bill introduces significant changes to the Privacy Act 1988 (Cth). If the Bill is passed as currently drafted and works as intended, APP entities must fundamentally uplift their privacy practices, data governance frameworks and investment in ongoing privacy compliance.
The introduction of the “fair and reasonable” test alone will require APP entities to fundamental rethink the way they collect and handle personal information.
The Bill recognises privacy and the collection and handling of personal information is a dynamic exercise, requiring regular evaluation and consideration throughout the information lifecycle. APP entities that understand this shift in expectations will be well placed to uplift their privacy practices to the new standard required by the Bill.