Australia's proposed Privacy Act reforms: Is your business ready?

Privacy Reform: What the proposed changes mean for your business

On 31 August 2026, the Federal Government released an exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026 for consultation, which closed on 18 September 2026. The proposed reforms are intended to update Australia's privacy laws in response to increasing data collection practices, and growing concerns around data breaches and AI.

While the reforms are still under consultation, they provide useful insight into the areas currently attracting regulatory attention.

What areas are being considered?

The proposed reforms address a range of issues, including:

• a requirement that personal information be collected, used and disclosed only where it is fair and reasonable to do so;
• a broader definition of personal information, expanding the scope to include information that can identify, distinguish or single out an individual, such as pseudonyms, unique identifiers, location data and behavioural patterns;
• stronger consent requirements;
• increased scrutiny of data sharing and data trading practices;
• the use of artificial intelligence and emerging technologies; and
• enhanced expectations around privacy governance and compliance.

What does this mean for businesses?

Many businesses collect and hold personal information relating to customers, employees and suppliers as part of their day-to-day operations.

The proposed reforms indicate an ongoing focus on how personal information is collected, used, stored and managed. For some businesses, this will prompt a review of existing privacy policies, collection practices and internal procedures. For others, particularly those using emerging technologies or handling significant volumes of data, there could be broader considerations.

Notably, the draft does not propose removing the small business exemption (for businesses with annual turnover of $3 million or less) or the employee records exemption. However, some small businesses are already covered by the Privacy Act, and those that are should take note of the proposed changes.

Could your business respond to a data breach within 72 hours?

The draft would introduce a 72-hour deadline for notifying the OAIC of an eligible data breach, replacing the current requirement to notify as soon as practicable.

Many organisations have cyber security measures in place, but fewer have a clear plan for who is responsible for assessing, escalating and notifying a potential data breach. Businesses may wish to consider whether their current incident response procedures would allow them to act quickly if required.

Are you collecting more personal information than you actually need?

Customer onboarding forms, website enquiries, recruitment processes and marketing activities often involve collecting personal information. The proposed reforms prompt businesses to review whether the information they collect is genuinely necessary and whether its collection would be considered fair and reasonable.

How much personal information are you retaining?

Many businesses retain information relating to former employees, historical customers, unsuccessful applicants and dormant prospects for extended periods. The reforms place greater emphasis on whether personal information is retained for longer than necessary and whether current retention practices remain appropriate.

Looking ahead

The consultation period closed on 18 September 2026, and feedback is now being considered before any legislation is introduced.

How can we help?

Our team can advise on your obligations under the Privacy Act and assist with reviewing and preparing privacy policies, collection notices and internal procedures, including identifying areas that may need attention if the reforms proceed.

Current as at October 2026.

‍

‍