Privacy Act Tranche 2: what the 2026 exposure draft means for business

By the ITLAW Team · General information, not legal advice

Australia’s privacy reform has moved in two stages. Tranche 1, the Privacy and Other Legislation Amendment Act 2024, introduced higher penalties, a statutory tort for serious invasions of privacy and automated decision-making transparency. Tranche 2 is the larger overhaul that businesses have been waiting for since the Privacy Act Review Report was published in February 2023. Commentators have described it as the most significant change to the framework since the Australian Privacy Principles began in 2014.

The key proposals

The exposure draft is long and detailed. These are the proposals most likely to affect day-to-day business operations:

• Broader definitions. The definition of personal information would be updated and expanded, bringing more technical and inferred data, such as online identifiers, within the Act and moving Australia closer to the GDPR concept of personal data.
• A “fair and reasonable” test. Collection, use and disclosure of personal information would need to be fair and reasonable in the circumstances, regardless of consent. This reduces reliance on consent as a catch-all, although consent remains important in specific contexts, including trading in personal information.
• Controllers and processors. A controller and processor model would allocate primary compliance responsibility to the business that decides how data is used, with different duties for service providers.
• New individual rights. Proposals include stronger rights for individuals over their information, including erasure rights in some contexts.
• A direct right of action. Individuals would be able to take court action for interferences with privacy under the Act, separately from the existing statutory tort.
• Exemptions under review. The draft addresses the employee records, small business and journalism exemptions.
• Security and breaches. Stronger obligations around data security, data minimisation and breach response.

What happens next

The Government has indicated it intends to introduce the legislation to Parliament before the end of 2026. Even once passed, many obligations are likely to have a transition period. However, several proposals reflect principles that already apply under the current Act, so work done now is unlikely to be wasted.

How to prepare

• Map what personal information you hold, where it came from and why you keep it.
• Identify inferred and technical data, such as device IDs and profiles, that may become clearly regulated.
• Test key uses of data against a “would a reasonable person expect this?” standard.
• Review contracts with service providers to clarify who decides how data is used.
• Delete data you no longer need: less data means less risk under any regime.
• Revisit whether you rely on the small business or employee records exemptions.

For the current rules, see our privacy law guide.

Frequently asked questions

What is Tranche 2 of the Privacy Act reforms?

It is the second and larger stage of reform to the Privacy Act 1988, released as an exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026 on 31 August 2026.

When will Tranche 2 start?

No commencement date has been announced. The Government has said it intends to introduce the Bill to Parliament before the end of 2026, and the content may change.

Will the small business exemption be removed?

The exemption is one of the issues addressed in the draft. Small businesses should watch the final Bill closely rather than assume the exemption will continue.