The draft Tranche 2 Privacy Act reforms: what's there, what's new and what's missing?

Almost two years after a relatively modest set of Privacy Act reforms were passed in late 2024 (Tranche 1 Reforms) (more on these here), the Australian Government has released an exposure draft of the more substantial Tranche 2 reforms, in the form of the Privacy Amendment (Personal Data Protection) Bill 2026 (Cth) (Draft Bill). The Draft Bill is accompanied by a consultation paper which seeks feedback on the practical operation and implementation of the Draft Bill, as well as other proposed measures under development (Paper). We have summarised key highlights from the Draft Bill and Paper below.

New reforms in the Draft Bill

The Draft Bill includes 41 proposed reforms, 30 of which were recommended reforms in the Attorney-General’s Department’s Privacy Act Review Report 2022 (Review Report) and 11 of which are new.

The new reforms cover the following:

• a new definition of ‘disclosure’, which deems personal information as disclosed where it is accessible to a third party, regardless of whether the discloser retains a level of control over it.
• direct marketing, to include exceptions in the context of ‘ad-supported services’.
• privacy collection notices, to reduce the content required under Australian Privacy Principle (APP) 5.
• data security and destruction, to require entities to:
  • regularly assess the effectiveness of their compliance with APP 11;
  • consider whether personal information which is no longer needed should be destroyed rather than de-identified;
  • determine what personal information they hold, in order to apply security and destruction controls.
• an expanded exception for dealing with serious wrongdoing, a broader concept than the previous serious misconduct.
• new exceptions permitting collection of sensitive information where strictly necessary to provide requested goods and services or collected from a ‘publicly available document’.

Expected reforms in the Draft Bill

The following reforms are broadly consistent with expectations based on the Government’s 2023 response to the Review Report (2023 Government Response), although some of the detail is new:

• the controller / processor distinction, to allocate responsibility between entities which determine the purposes for which personal information is handled (controllers) and entities which handle information on behalf of controllers (processors).
• data breach, including:
  • a 72 hour timeframe for notifying the Office of the Australian Information Commissioner (OAIC);
  • expanded content requirements for those notifications to the OAIC;
  • staged notification to the OAIC, allowing for incomplete initial notifications where justified and requiring material updates to be provided;
  • a new OAIC power to direct an entity to notify a data breach;
  • requiring entities to implement practices, procedures and systems to respond to data breaches and prevent or reduce harm to affected individuals.
• a fair and reasonable test for the collection, use and disclosure of personal information, which replaces most of the existing requirements in APPs 3 (collection), 4 (unsolicited personal information) and 6 (use and disclosure), and requires entities to consider factors such as reasonable expectations, choice for the individual, relationship to an entity’s functions or activities, data minimisation, impact to the individual, proportionality, and best interests of children. Various existing tests such as those based on the primary purpose of collection will be repealed.
• notification requirements, to expressly require notification of collection to be clear, understandable, up to date and concise.
• the definition of ‘sensitive information’ to include ‘genomic information’ and ‘precise geolocation tracking data’.
• direct marketing, to define ‘direct marketing’ and require entities to include opt-outs in each communication and action opt-outs.
• the definition of ‘personal information’, to extend it from information ‘about’ an individual to information that ‘relates to’ an individual, to include a list of examples, to insert a new definition of ‘reasonably identifiable’, and to add a note to the effect that an individual may be identified or reasonably identifiable even if their name or legal identity is not known where information enables them to be recognised, singled out or treated as distinct.
• ‘trading’ in personal information, to define ‘trading’ and require entities to obtain an individual’s consent unless an exception applies.
• individual rights, to insert an exception for access requests where access is technically impossible or infeasible and to include a right to the erasure of personal information, although the Draft Bill now proposes to limit this erasure right to only ‘large digital platforms’.
• research, to replace the existing health and medical research exceptions with a single exception for ‘human research’ requiring compliance with a single set of guidelines issued by the OAIC.
• the definition of ‘consent’, to provide that it must be voluntary, informed, current, specific and unambiguous.
• the definition of ‘collect’ to extend to information obtained from any sources and by any means, including generated or derived information, with additional timing rules as to when sensitive information is considered to have been derived from other personal information collected.
• the definition of ‘de-identified’, to clarify that de-identification is a process, not a fixed state.

Other proposals in the Paper

The Paper raises some additional reform proposals that are not covered in the Draft Bill which were partially raised in the Review Report. These relate to:

• the OAIC’s enforcement powers, including to require individuals to generally first engage with the relevant APP entity about their privacy concern and to tell the OAIC about such engagement when making their complaint, and to give the OAIC a broad power to require any persons to provide reasonable assistance in investigations.
• emerging technologies such as AI, wearable surveillance technologies and connected vehicles. The OAIC seeks feedback on whether additional specific reforms are needed for these technologies.

What’s missing?

A number of the previously proposed (significant) reforms which had been ‘agreed in-principle’ in the 2023 Government Response are now not addressed in either the Draft Bill or the Paper:

• exemptions for employee records, small business and journalism.
• a direct right of action to sue for Privacy Act breaches, separate from the statutory tort for serious invasions of privacy which was introduced as part of the Tranche 1 Reforms.
• privacy impact assessments for high privacy risk activities.
• individual rights, except as identified above.

It remains unclear the extent to which (if at all) the Attorney General’s Department is considering further reforms other than those set out in the Draft Bill and Paper.

The Draft Bill and Paper unfortunately include limited information on transitional provisions or commencement periods, but we would expect most obligations will be subject to some form of deferred commencement.

Where to from here?

We will share a more detailed update on the Draft Bill and Paper shortly.

In the meantime, with submissions to the Paper closing 18 September 2026, entities should consider whether there are any practical issues they wish to raise or interpretations they wish to influence, particularly in the context of their industry or sector.