By Bianca Lopez, Senior Associate

4 September 2026 

After a long wait, Tranche 2 of Australia’s privacy law reforms is finally on the table, with the Australian Government releasing new proposals that could reshape how businesses handle customer data. On 31 August, the Australian Government released the exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026 (Exposure Draft), together with a consultation paper. The Exposure Draft is the proposed second tranche of reforms that follow the more limited privacy changes introduced in 2024 and 2025 and more than 3 years of review. For a timely reminder on what has occurred to date, please see our earlier articles here and here.

From a review of the Exposure Draft, it is evident that the next wave of privacy reform will not just be another privacy policy tidy-up. The Exposure Draft contains a significant number of measures designed to modernise the Privacy Act 1988 (Privacy Act) and Australian Privacy Principles (APPs) for the digital age and address risks from fast-evolving technology and AI, and not unexpectedly looks to be shifting Australia’s privacy landscape closer to Europe’s General Data Protection Regulation (GDPR).

The final legislation may still change, with consultation on the Exposure Draft open until 18 September 2026, however even at this stage, it is clear that major changes to how businesses collect, personalise and activate individual data are to come.

So what exactly might be on the way?

Fair play for customer data

One of the key proposed reforms is a new requirement that the collection, use and disclosure of personal information must be “fair and reasonable” in the circumstances, which is proposed to replace most of the existing requirements under the current APPs 3, 4 and 6. That is, instead of businesses only having to check whether they have a legal basis, such as relevant consents / opt ins, to use individual data, they also need to consider whether a reasonable individual would think the proposed use of their personal information is “fair”.

The test would consider factors such as what an individual would reasonably expect, whether the handling of personal information is transparent, whether less information could be used, whether the individual has genuine choice, the potential impact on the individual and whether the handling is proportionate. Where children are involved, their best interests would also form part of the consideration.

For businesses and advertisers, this is where internal processes and clear data management will be of upmost importance. An individual may have technically accepted broad terms, but that does not necessarily mean every later use of their personal information will pass this fairness test. For example, using purchase history to recommend similar products may be one thing, however using behavioural information to infer sensitive characteristics, build unexpected profiles or share that consumer data with third parties will be quite another. Additionally, a privacy policy or collection statement would not satisfy the test on its own and consent would also not resolve the issue, given the test would apply even where an individual has agreed to the handling of their personal information.

Consent cannot be ticked and forgotten

The Exposure Draft is looking to introduce a statutory definition of consent, which will require it to be “voluntary, informed, current, specific and unambiguous”. The practical implication of this reform is that bundled consents, pre-ticked boxes and broad permissions are unlikely to satisfy the new standard, and the Exposure Draft indicates concern about design practices that make it unreasonably difficult for an individual to avoid giving consent. Collection notices would also need to be updated to meet these new requirements.

Said another way, the Exposure Draft is focusing on consent becoming an active consumer choice, not a broad permission that follows the individual indefinitely.

Consumer data is getting personal

The Exposure Draft would also broaden the concept of personal information from information “about” an individual to information that “relates to” them and would clarify that an individual may be reasonably identifiable even if their name is not known. Why this matters is because consumer information is no longer limited to email addresses and phone numbers. It may include online identifiers, location information, behavioural patterns and generated or derived information. This has significant implications as it now more clearly broadens what is considered personal information in the digital context. It makes it clearer that these sorts of information used for tracking and targeting online, previously in more of a grey area, will be regulated as personal.

For brands and agencies, this also means AI-generated insights used for segmentation, propensity modelling, recommendations and personalisation may also need to be assessed under the Privacy Act. For brands using AI to decide which consumers receive which offer, the question will increasingly be not only what raw data entered the system, but what the system inferred from it and how that inference is used.

Direct marketing also in the firing line

For commercial marketing teams, the proposed direct marketing rules may be among the most consequential changes. The Exposure Draft introduces a statutory definition of direct marketing and a new prohibition on disclosing personal information for direct marketing without consent, subject to limited exceptions. Organisations will need to provide an opt out to direct marketing communications. Direct marketing is defined broadly enough to cover programmatic advertising, targeted social media advertising, online behavioural advertising and audience segmentation. This triggers many practical considerations as to how an opt out mechanism would actually work in practice, an issue that was hotly debated in the media industry during the review and consultation to date. Where targeted advertising is served through a third party platform, the platform and not the advertiser will generally be responsible for the opt out.

Notably there is no requirement for a specific opt out right for any targeted advertising. This was considered during the Government review process and resisted by the media industry as it would have been problematic to implement.

Where an organisation uses personal information for its own direct marketing, the fair and reasonable test would also apply.

This is broader than the sending of eDMs. The proposed framework may affect the disclosures that sit behind campaigns, including some uses of cookies and tracking pixels, which we flagged previously was likely to be focus point for these reforms.

What this means is that direct marketing campaigns which were compliant in the past will require a fresh Privacy Act analysis. The key questions would turn to what data is being used, who receives it, is it being disclosed, and did the individual meaningfully consent to this activity.

Data deals may need a second look

Another important change is the proposed prohibition on trading in personal information without consent, subject to limited exceptions, which as a concept goes broader than simply selling a database. It may capture disclosures involving consideration or direct marketing purposes, including data broker arrangements, list sharing, advertising partnerships and partner-led campaign activations. As such, should these reforms come into effect, brands and agencies that pass customer data to partners, platforms or other third parties for campaigns should assess whether those arrangements amount to trading in personal information and whether consent is required.

Although the Exposure Draft includes exceptions, such as certain controller-to-processor arrangements (discussed further below) and some services requested by individuals, brands should clearly document what partners are permitted to do with customer information. In particular, they should distinguish between a provider that processes data only on the brand’s instructions and a provider that uses, combines or repurposes that data for its own objectives.

When agencies are processors, instructions matter

As noted above, the Exposure Draft proposes a formal controller/processor distinction, seemingly modelled on comparable sections of the GDPR. The Exposure Draft would give processors limited exceptions from most APPs where they handle personal information only on a controller’s documented instructions. For example, a CRM, email platform or agency may have reduced APP obligations when it stores, segments or sends campaign data solely as directed by the business. However, if that provider uses the data for its own analytics, product development or cross-client profiling, it may step outside the processor role and become directly responsible for APP compliance. Clear data-processing terms and practical oversight will therefore be important for any outsourced or partner-led data handling should this reform come into effect.

Old campaign data may not age well

The Exposure Draft is also proposing to strengthen APP 11 (Security of personal information) in three ways, which will have practical implications for customer databases.

Businesses would need to be able to identify the personal information to which their security obligations apply, and regularly evaluate the effectiveness of their compliance with those obligations. They also need to consider whether personal information that is no longer needed should be destroyed rather than simply de-identified, which we understand is currently common practice.

For our clients, this may raise a familiar but often unresolved issue in relation to historical data from an old campaign being held somewhere, noting that it is not uncommon for old campaign lists, dormant loyalty accounts, legacy CRM records and historical audience datasets to accumulate over years. The proposed reforms point towards a more disciplined approach to retention and will require organisations to more actively review and tidy their databases.

A ticking clock on breach responses

The proposed data breach reforms would also introduce a 72-hour notification requirement once an entity has reasonable grounds to believe that an eligible data breach has occurred for notifying the Office of the Australian Information Commissioner (OAIC), significantly shortening the current 30 calendar days timeframe.

The proposed framework, which is a similar take to the data breach requirements under the GDPR, retains an assessment process for suspected breaches. Accordingly, once there are reasonable grounds to believe an eligible data breach has occurred, the OAIC must be notified within 72 hours. Where the necessary information cannot practicably be provided within that timeframe, an interim notification can be made, with further information supplied as soon as practicable. Affected individuals would also need to be notified at the relevant time.

Erasure rights on the table, but not for everyone

In another similarity to the GDPR, in particular the right to be forgotten, the Exposure Draft proposes a right to erasure but only to certain large digital platforms, broadly defined by reference to either at least $500 million in gross revenue or at least 2.5 million Australian end users. Subject to certain exceptions, an individual could request that a platform destroys any personal information held by the large organisation.

Based on the Exposure Draft, this is not a general Australian “right to be forgotten” applying across the board and to every business or brand, at this stage and in the way that the GDPR right extends. Nevertheless, the proposed reform reinforces a broader sentiment that individuals have more control over the information that organisations hold on them.

What hasn’t been included in this round?

Interestingly, not every reform that has been discussed to date has made it into Tranche 2 as yet. In fact, several previously contemplated reforms are not currently addressed in the Exposure Draft, including the removal of the small business and employee records exemptions, a standalone direct right of action for Privacy Act breaches and mandatory privacy impact assessments for high-risk activities.

At this stage, it is unclear whether any further reforms may be considered as part of Tranche 2. In any case, our consistent recommendation is that businesses should be reviewing their privacy and data management practices, given these reforms are well underway. Now more than ever, businesses need to be well placed to respond to these major shifts.

Where to from here?

While the Exposure Draft is not yet finalised and may change following consultation, it clearly indicates the direction of travel for Australia’s privacy framework. If enacted, the Tranche 2 reforms will require businesses to take a more disciplined and proactive approach to customer data across the full lifecycle, from collection and consent through to segmentation, personalisation, advertising, sharing, security and deletion.

For businesses, the practical message is that privacy compliance is moving beyond policy wording, compliant collection statements and consent mechanics. The proposed fair and reasonable test, expanded concept of personal information and new direct marketing and data-sharing rules indicate that customer data practices will need to be transparent, proportionate and be able to be justified from the customer’s perspective.

Where your marketing activities depend on customer data, behavioural targeting, personalisation or third-party advertising funnels, our recommendation is that you should use this transitionary period to review your data practices, strengthen internal governance and ensure that privacy considerations are built into campaign planning and customer database processes from the outset.

Get in touch

We will of course keep you updated as these reforms continue to take shape. However, given the ongoing interest in this area and now that there is again movement in this space, it is important now more than ever to ensure your organisation’s privacy and data management practices are up to scratch.

If you would like support or additional advice or if you would like to undergo a privacy audit for your organisation, please get in touch with one of our experts below.