Lexora Regulatory Intelligence
Privacy Act tranche 2: what the exposure draft proposes, and what it does not
The Government has released draft legislation for the second, larger round of Privacy Act reforms. It is a proposal, not law, but it signals where Australian privacy regulation is heading.
- Published
- Jurisdiction
- Australia
- Subject
- Privacy Amendment (Personal Data Protection) Bill 2026 (exposure draft)
- Status
- Status: Exposure draft
Summary of the development
On 31 August 2026 the Attorney-General released an exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026, together with a consultation paper. It is the second tranche of reforms arising from the Privacy Act Review Report published in 2022.
An exposure draft is a draft released for comment before a Bill is introduced to Parliament. Consultation closed in mid-September 2026. The Government may change the draft, delay it or decide not to proceed with parts of it.
The draft is still useful. It shows the direction of travel: a stronger fairness test, tighter security and destruction rules, and changes to how organisations tell people about collection. It also shows what is not yet on the table, including the small business exemption.
Lexora labels this development Exposure draft. We will update this briefing when the Bill is introduced to Parliament.
This article is general information, not legal advice.
Key dates
- 31 August 2026Exposure draft and consultation paper released by the Attorney-General
- Mid-September 2026Public consultation closed
Practical implications
- Nothing in the exposure draft is law yet. It has not been introduced to Parliament, may change, and has no commencement date.
- The draft contains 41 proposed reforms, 30 drawn from the 2022 Privacy Act Review Report and 11 that are new.
- Proposals include an updated "fair and reasonable" test for collection, a broader definition of disclosure, changes to the content of collection notices and stronger data security and destruction requirements.
- Several earlier proposals are not included, notably removal of the small business exemption for businesses with turnover of $3 million or less.
Recommended actions
- Do not rewrite policies to match the draft yet. Focus on obligations already in force and on the 10 December 2026 automated decision-making disclosures.
- Use the draft to test your direction. Practices that would fail a "fair and reasonable" test are worth reviewing now.
- Track the Bill's introduction to Parliament and any changes made after consultation.
- Brief your board that the reforms are proposed, not enacted, and set a trigger to revisit when the Bill is introduced.
Sources
- Corrs Chambers Westgarth, Australia's Privacy Act reforms, fundamental changes proposed in new exposure draft (2 September 2026)
- HSF Kramer, The draft Tranche 2 Privacy Act reforms, what's there, what's new and what's missing (September 2026)
- Spruson & Ferguson, Proposed tranche 2 Privacy Act reforms (3 September 2026)