Australia: Data Protection

The Australian government has released an exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026, introducing sweeping changes to privacy law including broader definitions of personal information, codified consent standards, and a new 72-hour data breach notification requirement. With reforms touching everything from geolocation data to erasure rights, organisations face a compressed timeline to uplift their privacy frameworks before these provisions become law.

Almost two years after a relatively modest set of Privacy Act reforms were passed in late 2024 (Tranche 1 Reforms) (more on these here), the Australian Government has released an exposure draft...

The Australian Government has released an exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026, proposing the most substantial reforms to the Privacy Act 1988 in recent times. These changes introduce a fair and reasonable test for data handling, enhanced consent requirements, expanded breach notification obligations, and new rights including data erasure for large digital platforms.

The Office of the Australian Information Commissioner (OAIC) received 1,205 data breach notifications in 2025, the highest number since Australia's Notifiable Data Breaches (NDB) scheme commenced in 2018. The figures highlight an environment increasingly shaped by persistent cyber threats and AI-enabled risks.

Australia's privacy law is undergoing significant reform, with new amendments requiring APP entities to provide greater transparency about automated decision-making systems that use personal information. From December 2026, businesses must disclose in their privacy policies how computer programs make decisions that could significantly affect individuals' rights or interests.

The Australian privacy regulator has fundamentally reframed how tracking pixels must be assessed under privacy law, particularly in sensitive contexts like healthcare. Recent enforcement actions reveal that common digital marketing tools can constitute the collection and disclosure of sensitive personal information, requiring explicit consent and robust governance frameworks that many organisations currently lack.

Poor decision-making, whether failing to share or over-sharing, can lead to regulatory action, reputational damage and safeguarding failures.

NDIS providers in Australia are subject to strict privacy obligations under both the Privacy Act 1988 (Cth) and the NDIS Practice Standards, requiring robust handling of participants’ sensitive personal information.

AI service agreements in Australia should clearly define the scope of AI services, ownership of outputs, and liability for errors or unexpected results.