Privacy Act reforms 2026: what the draft Personal Data Protection Bill means for your IT
Privacy Act reforms 2026 explained: the draft Bill's 72-hour breach reporting, processor rules and data destruction duties, plus five IT steps to take now.
The Privacy Act reforms 2026 package centres on the exposure draft Privacy Amendment (Personal Data Protection) Bill 2026, which the Attorney-General's Department put out for consultation on 31 August 2026. It is not law yet. As drafted, it would make businesses report eligible data breaches to the regulator within 72 hours, contain breaches, give processors written instructions and consider destroying data they no longer need.
This is an IT provider's reading of the draft: the parts that turn into logging, contracts, data inventories and runbooks. It is general information, not legal advice, so check the department's consultation page and talk to your lawyer.
What is the Personal Data Protection Bill 2026?
It is the next round of Privacy Act 1988 changes after the Privacy and Other Legislation Amendment Act 2024, which created the statutory privacy tort and the automated-decision disclosure rules and left other proposals to a second tranche (hence "Privacy Act tranche 2"). The department's consultation paper covers roughly 40 proposals. The ones most businesses would feel:
A single "fair and reasonable" test for collecting, using and disclosing personal information.
Tighter consent, needed before you trade personal information.
Stricter breach rules, including a 72-hour statement to the regulator.
A controller and processor split for suppliers that handle data for you.
Stronger APP 11 security duties around knowing, protecting and destroying data.
A new right to erasure would only bind large digital platforms, not ordinary businesses.
Is the Personal Data Protection Bill law yet?
No. Consultation ran from 31 August to 18 September 2026, and the department says the Bill "remains subject to further consideration by government". Parliament must still pass it, and the commencement table in the exposure draft Bill is blank, so there are no start dates. One detail to note now: the new APP 11 duties would apply to information held on or after commencement "whether the information was acquired or created before, on or after that commencement". A file share set up in 2014 would count.
What would change for data breaches?
Today, once you have reasonable grounds to believe an eligible data breach has happened, you must promptly notify the Commissioner and the people at risk of serious harm, with up to 30 days to assess a suspected breach (see the OAIC's guide to the Notifiable Data Breaches scheme). There is no fixed hour count. The draft adds one: 72-hour data breach notification to the regulator.
| What the draft proposes | What it means for your IT |
|---|---|
| A statement to the Information Commissioner within 72 hours of becoming aware of reasonable grounds to believe an eligible breach occurred | Working out what was accessed, fast, depends on logs being switched on and kept. |
| An incomplete statement if a full one is impossible or impracticable, with written reasons and the gaps filled later | Incident notes become evidence: record times, decisions and what you didn't know yet. |
| Reasonable steps, as soon as practicable, to prevent or reduce harm from actual or suspected breaches | Containment, such as disabling compromised accounts and cutting off unauthorised access, must be ready to run. |
| Practices, procedures and systems to respond effectively | The consultation paper points to maintaining, reviewing and testing a data breach response plan. |
The consultation paper says the 72-hour window aligns with other Australian laws, including the Cyber Security Act 2024, which already gives businesses with turnover above $3 million 72 hours to report a ransomware or cyber extortion payment.
The practical problem is the weekend: a breach found late on a Friday puts most of the 72 hours outside business hours, so decide beforehand who declares it, pulls the logs, calls the insurer and drafts the statement. That is the core of an incident response plan. Key IT's helpdesk keeps business hours, weekdays from 8am to 5pm. Managed clients with an urgent problem after hours reach a rostered on-call engineer, and 24/7 SOC monitoring looks out for intrusions through nights and weekends.
Controller vs processor: what does it mean for your IT provider and cloud apps?
A controller decides why personal information is handled; a processor handles it on the controller's behalf. Under the draft, a processor acting on instructions "documented in writing", for the purposes those instructions name, would be exempt from most Australian Privacy Principles, with its acts treated as the controller's. It would still answer directly for APP 1 (transparent management, including a privacy policy) and APP 11 (security), and it loses the exemption if it steps outside its instructions.
Your likely processors: your IT provider, cloud backup, CRM or practice software, payroll and email marketing tools. Three things follow:
Instructions must be in writing.
No set format, but they must state the purposes the processor handles your information for. Check whether your IT agreement does.
Both sides must be covered by the Act.
The model only applies between APP entities. If a supplier sits outside the Act, ask your lawyer how that works.
Your IT provider keeps a security duty.
With APP 11 staying with processors, a provider holding admin access carries its own obligation. Ask how it would show compliance.
Under the draft, merely storing or transmitting information, including overseas, would not be a disclosure unless it is made accessible to someone else. That helps with cloud hosting but puts the weight on access controls, and a supplier's breach is still your problem.
Destroy, not just de-identify: do you know what data you hold?
The draft rewrites APP 11 in three ways. When you no longer need personal information, you would first have to consider whether to destroy it, then destroy or de-identify it; the consultation paper notes that keeping de-identified data still carries a re-identification risk. You would need to be able to identify the personal information you hold, and to regularly evaluate whether your security, destruction and de-identification measures still work. Records you must keep by law or court order would be exempt from the destruction step.
Personal information hides in old file shares, departed staff mailboxes, exported spreadsheets, scanned licences and unreviewed backups. A data inventory lists each system, what it holds, who can reach it and for how long. Then set retention inside the tools, such as retention policies in Microsoft 365, so deletion happens by rule rather than memory.
Do AI inferences count as collecting personal information?
Under the draft, yes. The consultation paper says personal information may be "generated or derived through means such as data analysis, artificial intelligence or other technological processes", and it is collected once it goes into a record. A sales tool's lead score or a meeting assistant's note recording a client's health condition would carry the same duties as details a customer hands you. That makes a written AI policy worth having now; our free AI policy template sets which tools staff may use and what data can go into them.
Does the small business exemption survive?
In the draft, yes. As Aitken Partners' summary puts it, businesses under the $3 million turnover threshold "are not brought into the Act by this Bill", and the employee records exemption stays. One wrinkle: a small business that trades in personal information loses the exemption, and the consultation paper says the draft's new definition of "trade" can cover disclosing cookies or pixels in programmatic advertising. If your website runs ad pixels, ask your lawyer.
Many small businesses are covered anyway. The OAIC's small business guidance lists, among others, health service providers (see our healthcare and medical page and cybersecurity for healthcare), businesses that trade in personal information, Commonwealth contractors, and AML/CTF reporting entities. Since 1 July 2026 that last group includes lawyers, conveyancers, accountants and real estate professionals providing designated services, and the OAIC confirms the Act applies to them below $3 million. Our AML/CTF tranche 2 guide covers the IT side.
What privacy rules already apply?
The Notifiable Data Breaches scheme, covering breaches since 22 February 2018. The OAIC received 1,205 notifications in the 2025 calendar year, an all-time high, with 716 attributed to malicious or criminal activity.
The statutory privacy tort, in force since 10 June 2025, which the OAIC says extends to entities that may not be APP entities. See how the privacy tort affects your business.
Automated-decision disclosures from 10 December 2026, with OAIC guidance released on 30 September 2026. Here's what your privacy policy needs to say.
What should you do now? Five IT steps
Map your personal information
every system, file share, mailbox and cloud app, and who can reach each.
Switch on the logs and keep them
sign-in, mailbox, file-access and admin activity, long enough to answer "what did they see?"
Write a breach runbook and rehearse it against a 72-hour clock.
List your processors
what each holds, its access, whether instructions are in writing, and MFA on every vendor account.
Set retention and destruction rules, including backups, old mailboxes and AI tool outputs.
None of these depend on the Bill's final wording.
Frequently asked questions
When will the Privacy Act reforms 2026 start?
There is no start date. The Bill is an exposure draft, consultation closed on 18 September 2026, and the Attorney-General's Department says it remains subject to further consideration by government. Parliament must still pass it, and the draft's commencement table is blank.
Would we have to tell customers about a breach within 72 hours?
Not as drafted. The 72-hour deadline applies to the statement given to the Information Commissioner. Affected people are notified through separate pathways, and the consultation paper accepts you may not have enough information to tell them at the same moment. You would also need to pass on later updates.
When would the 72-hour clock start?
When you become aware of reasonable grounds to believe an eligible data breach has occurred, not when the breach happened. If you only suspect a breach, the existing duty to take all reasonable steps to finish your assessment within 30 days continues. Good logs make that assessment much easier.
Is our IT provider a processor under the draft?
Probably, if it handles personal information for you under written instructions and you are both covered by the Privacy Act. It would still answer directly for APP 1 and APP 11, and would lose the exemption for anything done outside your instructions. Ask what written instructions cover your data today.
We turn over less than $3 million. Does any of this apply to us?
Mostly not, unless you fall into a covered group such as health service providers, AML/CTF reporting entities or businesses that trade in personal information. The statutory privacy tort already reaches people and entities outside the Act, and larger clients may push privacy obligations onto you through their contracts.
Can we keep de-identified data instead of deleting it?
Under the draft you could, for example for research or statistics, but only after considering whether destruction is more appropriate. De-identification would no longer be treated as permanent, so you would need to check regularly that the data stays de-identified and that keeping it is still justified.
Related services & guides
More insights
Australia's new privacy tort
Australia's statutory privacy tort lets people sue any business, however small, over a serious…
Read article →PrivacyAML/CTF tranche 2: the IT side
AML/CTF tranche 2 IT security for accountants, agents and lawyers: where KYC ID copies hide, the…
Read article →Microsoft 365Secure Boot certificate expiry
Secure Boot certificate expiry 2026: Windows Production PCA 2011 lapses on 19 October. What it…
Read article →Book your free IT & Cyber Security Review
See exactly where your IT and security stand, and what to fix first. No jargon, no obligation.