Australia is eyeing a world-first ‘fair and reasonable’ test for data collection and privacy

On Monday, the Australian government released draft legislation for the next big overhaul of the Privacy Act.

The Privacy Amendment (Personal Data Protection) Bill 2026 is now out for public comment, together with a consultation paper.

It is the second instalment (or “tranche”) of privacy reform , and it is the one that matters most.

The bill contains dozens of new measures, such as stronger consent requirements and a “right to be forgotten”, but at its heart is a world-first test that could bypass many loopholes companies use to justify what they do with personal data.

How we got here The Privacy Act was introduced in 1988, before the web, smartphones, and social media.

The Attorney-General’s Department spent three years reviewing it and reported in 2023 with more than 100 proposals for change.

The government agreed with most of them , at least in principle.

The first tranche of reforms became law in late 2024 .

These created a new right to sue for serious invasions of privacy.

This “statutory tort” (a wrong you can take to court), tackled doxxing, and promised a children’s online privacy code .

Tranche one also included a requirement for privacy policies to disclose whether they use automated decision-making systems to make decisions that could reasonably be expected to significantly affect an individual’s rights or interests.

This will come into effect in December.

This new bill is the main course of the reforms.

It contains around 40 measures that, if enacted, will change how every business and government agency covered by the act handles our personal information.