TLDR
Australia's draft Privacy Amendment (Personal Data Protection) Bill 2026 replaces specific collection rules with a single 'fair and reasonable' test, requiring organisations to justify every data practice. Device identifiers, location data and behavioural patterns now count as personal information, and consent is required before sharing data for money or direct marketing. Submissions close 18 September 2026.
KEY TAKEAWAYS
The test that changes everything
Australia's existing privacy rules work like a checklist. Collect data lawfully, store it safely, disclose it only in listed circumstances, tick the boxes and you are compliant. The draft Privacy Amendment (Personal Data Protection) Bill 2026 scraps that logic entirely.[1]
Attorney-General Michelle Rowland released the exposure draft on 31 August 2026, with a consultation window closing 18 September 2026.[2] Three weeks is unusually tight for legislation of this scope, and the industry has almost no runway to respond before the window shuts.
Michelle Rowland said Australians expect their personal information to be protected, and that almost four in five Australians report having very little or no control over how their personal information is collected or used.[2]
One test, seven factors, no more boxes to tick
The draft bill consolidates existing collection, use and disclosure obligations under APPs 3, 4 and 6 into a single "fair and reasonable" standard, guided by seven legislated factors.[1] A&O Shearman's legal analysis, published 4 September 2026, describes this shift as requiring organisations to make a principles-based judgement call on every data practice, rather than satisfying a defined list of permitted purposes.
That distinction matters for marketers. A rule-based system lets you design a campaign, confirm it hits the permitted-purpose criteria and move on. A principles-based system asks whether a reasonable person would consider your practice fair in the full circumstances. Those are very different questions, and the second one is harder to answer in advance.
Michelle Rowland said that if an organisation wants to use your data, it must do so fairly, transparently and responsibly.[3] The seven legislated factors guide that assessment, but the burden of proof sits with the organisation holding the data.
Your ad-tech stack probably qualifies now
The draft bill expands the definition of "personal information" to cover any information "that relates to" an identified or reasonably identifiable individual, pulling pseudonyms, device identifiers, location data and behavioural patterns inside the definition.[1]
The standard cookie-based targeting stack, cookie IDs, hashed emails, IP addresses, browsing sequences, has long occupied a grey zone under the Privacy Act 1988. Under this draft, that grey zone largely disappears. If the data relates to a person who can be identified, it is personal information and the full framework applies.
Tranche 1 reforms, passed in December 2024, introduced a statutory tort for serious invasions of privacy and strengthened enforcement powers. Tranche 2 goes directly for the data-driven marketing stack, arriving as AI-driven targeting and wearable devices have made the old Australian Privacy Principles look increasingly thin.
Consent to trade data: no narrow read available
The draft introduces explicit rules requiring consent before disclosing personal information for money, consideration or direct marketing, with narrow carve-outs only for necessary business operations, processors acting on instructions, business transfers and serious fraud prevention.[1]
Data broking, third-party audience sharing, programmatic data passes and retargeting partnerships all sit inside "disclosure for consideration" as a practical matter. A data broker cannot route its way around consent by describing the arrangement as a service contract if the underlying purpose is trading profiles.
Agencies and brands that rely on purchased audience segments or sell first-party data to partners will need to audit those arrangements before any version of this bill becomes law. The consent requirement is the single biggest structural change for the marketing industry in this draft.
Erasure rights, breach deadlines and what is missing
Large digital platforms meeting revenue or user thresholds will face a right to erasure, allowing individuals to request deletion of their personal information.[1] The thresholds are not finalised in the draft, so whether a mid-sized Australian platform falls inside the definition remains open for consultation.
On breach notification, the draft imposes a 72-hour deadline to notify the Office of the Australian Information Commissioner of eligible breaches, and requires entities to build breach response systems and harm mitigation measures.[1] Seventy-two hours is aggressive. Many organisations currently operate on multi-day triage processes before notifying regulators.
The draft stops short of a direct right of action for Privacy Act breaches. The statutory tort for serious invasions of privacy, introduced in December 2024, remains the only private cause of action.[1] Class actions built on routine data-handling breaches are not what this draft creates, at least not yet.
What to do before 18 September
This is an exposure draft. The final bill may differ materially from what the Attorney-General's Department released on 31 August 2026.[2] Industry associations, large advertisers, data brokers and platforms all have standing to submit, and the three-week window means those submissions need to be drafted now.
The practical audit starts with two questions. First, does your organisation share personal information with any third party in exchange for money, services or access to audiences? Under this draft, that exchange requires consent. Second, does your data collection touch device identifiers, location data or behavioural patterns? Under the expanded definition, it almost certainly does, and the fair-and-reasonable test applies from collection onwards.
Submissions on the Privacy Amendment (Personal Data Protection) Bill 2026 exposure draft close on 18 September 2026.
SOURCES & CITATIONS
FREQUENTLY ASKED QUESTIONS
What is the 'fair and reasonable' test in the draft privacy bill?
Does the draft bill cover cookie IDs and behavioural tracking data?
When does consent become required for data sharing?
Is this bill already law?
What is the new breach notification deadline?
James Dore is founder and editor of Prompt the Market and Strategy Director at Bushnote, a Sydney strategy, SEO and AI search agency. He has a background in strategy, media and financial services, and led consumer product marketing at MONEYME. He writes on AI search, answer engines, technology policy and media economics.
