Australia Floats Major Privacy Law Overhaul
A new consultation draft outlines significant reforms to Australia's privacy framework, including a 72-hour data breach notification deadline, new "fair and reasonable" processing standards, and formal controller/processor roles.
Australia's government has released a consultation draft of the Privacy Amendment (Personal Data Protection) Bill 2026, signaling a significant overhaul of the nation's privacy framework. The proposed reforms would create substantial new compliance obligations for businesses subject to the Privacy Act, aligning Australian law more closely with global standards like the GDPR. Key proposals include a broad new requirement for data processing to be "fair and reasonable," the formal distinction between data controllers and processors, and a strict 72-hour deadline for notifying the regulator of eligible data breaches. The draft also introduces specific consent requirements for "trading" in personal information, which could impact data brokers and ad-tech companies, and expands the definition of sensitive data to include precise geolocation information. Additionally, it would grant individuals a right to have their data deleted by large digital platforms. The proposals are open for consultation until September 18, 2026. Businesses should begin assessing how the changes would affect their data governance, vendor contracts, marketing, and incident response plans.