On 31 August 2026 the Attorney-General released the exposure draft Privacy Amendment (Personal Data Protection) Bill 2026, the long-awaited second tranche of Privacy Act reform, with a consultation paper. Submissions close on 18 September.12
What is in the draft
The draft builds on the first tranche, the Privacy and Other Legislation Amendment Act 2024, and covers core definitions, how personal information is handled, notifiable data breaches and data security.1 One example of the direction: the consultation paper proposes treating precise geolocation tracking data, location accurate to within about 500 metres, as sensitive information.3
It is a draft. Details will change before a bill reaches Parliament, and the Government has not yet said when that will be.
Why it matters to the board
The first tranche already changed the risk. It gave the regulator new penalty and enforcement options and created a statutory tort for serious invasions of privacy, which lets individuals take action directly. The second tranche reaches into everyday data practices: what you collect, why, how long you keep it and how well you protect it.
The practical message is that privacy will be judged by how data is actually handled, not by the wording of a privacy policy. Organisations that know what personal information they hold, where it flows and why they need it will find compliance a documentation exercise. Those that do not will find it a transformation program.
Three questions for your next board meeting
- Do we have a current map of the personal information we collect, where it goes and who can access it?
- Do we collect anything the draft would treat as sensitive, such as precise location, that we do not genuinely need?
- Who will own our response to the reforms, and are we making a submission?
How we help
Our privacy-by-design data-flow mapping shows what you hold and why, and our GRC work turns the reforms into a prioritised plan. See Governance, Risk & Compliance on the Practice, or brief a CISO.
References
- Attorney-General’s Department, “Privacy Reform” consultation, opened 31 August 2026. consultations.ag.gov.au
- Attorney-General, “Modernising Australia’s privacy laws for the digital age”, media release, 31 August 2026. ministers.ag.gov.au
- Attorney-General’s Department, Privacy Reform consultation paper, August 2026. consultations.ag.gov.au (PDF)
- Exposure draft, Privacy Amendment (Personal Data Protection) Bill 2026. consultations.ag.gov.au (PDF)