Australia’s Privacy Act Is Being Rebuilt: What Tranche 2 Changes for Your Business

Key Takeaway

• 📜 The two-track rebuild: Australia’s privacy act reform moved in two waves, the 2024 amendment act already law since December 2024, and the second-wave draft Bill released August 31, 2026, with consultation closing September 18.
• ⚖️ The biggest change on the table: a single fair and reasonable test would replace the collection, use and disclosure rules, judged against seven legislated factors, and consent alone stops being a defense.
• 🧑‍⚖️ Already live: the statutory tort for serious invasions of privacy has been in effect since June 10, 2025, letting individuals sue for intrusion into seclusion or misuse of their information without proving financial damage.
• 🗓️ The nearest clock: transparency provisions for automated decisions carry a grace period ending December 10, 2026, the nearest hard deadline in the reform program.
• 🧰 The five moves: map your data holdings, re-test every secondary use against the seven factors, upgrade vendor contracts for the controller-processor split, build an erasure workflow, and fix your automated-decision disclosures now.

Australia’s privacy act reform is running on two parallel tracks, and businesses need to read both. The first wave is law: the 2024 amendment act rewrote enforcement, added a statutory tort and started a children’s privacy code, with most provisions live since December 2024. The second wave is a draft Bill proposing the deepest rewrite of collection rules in the act’s history, and its consultation phase has already closed. Behind both sits a regulator with a full docket: the Information Commissioner handled 5,268 privacy complaints and 1,327 breach notifications in 2025-26, and breaches touching more than a million Australians rose from four to eleven in the first half of 2026 alone. The five moves at the end of this guide are what a business should schedule this quarter.

What Changed Already: the First Tranche of Privacy Act Reform Is Law

The Privacy and Other Legislation Amendment Act 2024 took effect for most provisions on December 10, 2024, and its centerpiece arrived on schedule: the statutory tort for serious invasions of privacy commenced on June 10, 2025. Australians can now sue an organization directly for intentionally or recklessly invading their privacy, the most visible result of privacy act reform so far, by intruding on their seclusion or misusing information about them, where the conduct was serious and breached a reasonable expectation of privacy, with no requirement to prove financial loss. Practitioner summaries put the capped compensation for a successful claim at up to $478,550, alongside injunctions and other remedies, and a journalism exemption keeps news reporting outside the tort’s reach.

The first tranche also rebuilt the regulator and the rulebook: stronger information-commissioner powers, a statutory children’s online privacy code in development, and transparency duties for entities that use personal information to make significant automated decisions, a class of obligations with a two-year grace period that ends on December 10, 2026. That December deadline is the nearest hard date in the program and the one with no excuse attached: the transparency work is knowable now, and it lands regardless of what the second-wave Bill finally passes.

The enforcement context is not hypothetical. The Information Commissioner’s 2025-26 reporting year counted 5,268 complaints, 1,327 eligible-breach notifications and 10,477 inquiries, with malicious or criminal attacks behind 59% of breaches and the health sector topping both complaint and notification tables. The same statistics dashboard shows breaches affecting more than a million individuals climbing from four to eleven in a single half-year, which is the operational backdrop to every amendment on this page.

What the Second Wave Proposes: the Fair and Reasonable Test

What the Second Wave Proposes: the Fair and Reasonable Test

The center of the 2026 draft Bill, released August 31, 2026, is one sentence with enormous reach: personal information must not be collected, used or disclosed unless doing so is fair and reasonable in the circumstances, and lawful. The draft consolidates the collection, use and disclosure rules into a single obligation and attaches seven legislated factors to the test: the individual’s reasonable expectations, the connection to the entity’s functions or activities, transparency, data minimisation, genuine choice, the proportionality of impacts, and the best interests of the child.

The practical reversal matters more than the wording. Today a business can often satisfy the rules by disclosing its practices in a notice and collecting consent where required. Under the draft, consent and transparency are necessary but not sufficient: even a fully consented use must independently clear the fairness test, and secondary uses, the quiet repurposing of data collected for something else, are exactly where the test bites. Every data practice becomes a documented judgment, not a checkbox.

The Other Tranche 2 Changes the Privacy Act Reform Puts on the Table

Around the central test, the draft Bill carries a set of structural reforms that each rewrite a workflow:

• Broader definitions: personal information and sensitive information both widen, pulling in more of what a modern business holds, including identifiers and technical data that the current definition can miss.
• A controller-processor distinction: the act would finally separate organizations that decide how data is used from organizations that process it on instructions, with allocation duties on both sides, which lands hardest on vendor contracts.
• A right of erasure: individuals would gain a documented path to have their information deleted, and firms need a workflow, not a policy sentence, to answer those requests
• Trading and direct-marketing rules: new limits on selling or licensing personal information and stricter direct-marketing duties, with consent requirements for sensitive information collection.
• Tightened breach obligations: the notification framework sharpens, connecting this regime to the reporting discipline described in Australia’s ransomware reporting guide.
• An expanded permitted general situation: the exceptions for safety and lawful-threat scenarios widen, giving defined breathing room but also demanding judgment records.

What the Privacy Act Reform Means for a Small Business

The small-business exemption has historically kept the majority of Australian firms outside the act entirely, and its predicted wind-back has been part of reform discussion since the government announced the tranche structure. The draft’s widening definitions and new duties are the reason the question matters now: if the exemption narrows or dies in the final Bill, tens of thousands of firms enter the regime for the first time, and they enter it into a fair-and-reasonable world, not the notice-and-consent world the current act offers.

The safe reading of the whole program for a small operator is preparation by order of cost. Map what customer data you hold and why. Re-read your privacy policy against automated-decision and children’s obligations already in force. Check the vendor contracts that move customer data. Erasure requests currently arrive through goodwill or complaints; build the response path before the law requires one. None of that work is wasted in either legislative outcome: if the exemption survives, you run a tighter shop; if it falls, your privacy act reform workstream finishes while competitors start from zero.

The Five Moves to Make Before the Privacy Act Reform Passes

1. Map your data holdings and their purposes. The fair and reasonable test is judged per use, so the inventory of what you hold, why you hold it and where it flows is the foundation of every later judgment, and the personal-data protection basics cover the consumer-side mirror of the same duties.
2. Re-test your secondary uses against the seven factors. Marketing reuse, analytics on service data, training pipelines on customer content: each one needs a written judgment against reasonable expectations, minimisation and proportionality, because that is what the draft asks.
3. Rewrite vendor contracts for the controller-processor split. Allocation of duties, breach notice windows and erasure cooperation all need to appear in the contracts that carry customer data, and the clause work takes months, not days.
4. Build the erasure workflow. A right to deletion answered by a form letter is a complaint waiting to happen. Decide the identity-check steps, the retention exceptions, and the evidence you keep of each erasure.
5. Fix automated-decision and children’s transparency now. The December 10, 2026 deadline belongs to the law already enacted, and the children’s code is coming regardless: privacy policies that disclose significant automated decisions, and age-appropriate defaults, are the two items with live dates attached.

The Compliance Calendar the Program Already Set

Reading the reform as one date would be the mistake, because the program runs on a calendar with three different kinds of deadlines. The passed dates are behind everyone: most of the 2024 amendment act from December 10, 2024, and the statutory tort from June 10, 2025. The nearest live date is the automated-decision transparency grace period ending December 10, 2026, a duty that no second-wave outcome can move. The undated dates are the draft ones: fair-and-reasonable handling, erasure rights and the controller-processor framework all commence on dates the final Bill will set, with the draft stating the obligations apply to handling on or after commencement.

That calendar shapes budgeting logic. Work tied to the December date is mandatory this quarter. Work tied to the draft is an investment in the version of compliance that Australia is visibly choosing, and the firms that complete it early run the same workflows under either legislative outcome. The reporting regimes arriving across the region follow the same pattern: obligations that read as future paperwork until the first clock starts, at which point only prepared organizations meet them.

One more layer of privacy act reform deserves a line in every planning document: the enforcement side is already funded by case volume. The regulator’s complaint and notification statistics are not abstractions for a legal textbook; they are the workload that decides how fast the OAIC moves when a business appears on its radar, and the trend lines in the 2025-26 reporting year point toward more of everything, more complaints, more breaches, more million-person incidents. A rebuilt act lands on a regulator with demonstrated capacity to use it, and the businesses that internalize this early make quieter subjects for it later.

What Happens Next in the Reform Program

The consultation window on the draft Bill closed on September 18, 2026, which means the next movement is parliamentary: a final Bill lands, with commencement dates that typically allow transition quarters rather than overnight switches. Businesses should expect the fair-and-reasonable obligation to apply to handling on or after commencement, as the draft states, and should expect regulators to spend the transition quarter asking for evidence rather than warnings. The reporting playbook culture spreading across the region, from the Philippines’ breach guidance to Australia’s ransomware reporting, is one program: regulators now want documented judgment, registered processes and fast clocks.

The reform’s direction is not subtle. Australia is moving from a notice-based privacy act to an accountability-based one, with a personal right of action already live, a regulator with a full docket, and a draft rewrite that assumes every data use deserves a justification. The businesses that treat the rebuild as an operating upgrade, not a compliance tax, will be the ones whose paperwork survives contact with the new test.

Frequently Asked Questions

Is the tranche 2 privacy act reform law yet?

No. The second wave of privacy act reform is the draft Privacy Amendment (Personal Data Protection) Bill 2026, released August 31, 2026 with consultation closing September 18, 2026. The changes it proposes become law only when a final Bill passes, while the first tranche’s changes are already in force.

What is the fair and reasonable test?

A proposed single obligation that personal information must not be collected, used or disclosed unless fair and reasonable in the circumstances, assessed against seven legislated factors including reasonable expectations, transparency, data minimisation, genuine choice and the best interests of the child.

When did the privacy tort from the reform start in Australia?

June 10, 2025. Individuals can now sue for serious, intentional or reckless invasions of privacy, including intrusion into seclusion or misuse of their information, without proving financial loss, with capped compensation in the hundreds of thousands of dollars.

What is the automated decision deadline?

The first tranche’s transparency duties for significant automated decisions carry a grace period ending December 10, 2026. Entities relying on personal information for such decisions have until then to align their disclosures, a date that stands regardless of the second wave’s timeline.

Does the privacy act reform affect small businesses?

The small-business exemption historically excluded most small firms, and its narrowing is under discussion in the reform program. Widened definitions and new duties mean the boundary is moving, and preparation by order of cost is the recommended posture either way.

What should my business fix first?

The order that pays off in every scenario: map your data holdings, re-test secondary uses against the seven factors, upgrade vendor contracts for the controller-processor split, build an erasure workflow, and complete the automated-decision transparency work ahead of the December 10, 2026 deadline.

If this intelligence helps you, you can add WorldNgayon as a preferred source on Google — free, one click, and it helps other Filipinos find the answers faster.

Financial Disclaimer

This article is published for general informational and educational purposes and does not constitute legal, financial or professional advice. Legislative proposals and deadlines current at publication may change; verify obligations against the act, the draft Bill and qualified counsel before acting. WorldNgayon and its author accept no liability for losses arising from the use or misuse of this information. No compensation was received for this article unless explicitly disclosed.

@online{agron2026privacyact,
  author       = {Agron, Edmon},
  title        = {{Australia’s Privacy Act Is Being Rebuilt: What Tranche 2 Changes for Your Business}},
  year         = {2026},
  date         = {2026-11-11},
  organization = {WorldNgayon},
  url          = {https://worldngayon.com/privacy-act-reform-australia/},
  urldate      = {}
}

TY  - ELEC
AU  - Agron, Edmon
TI  - Australia’s Privacy Act Is Being Rebuilt: What Tranche 2 Changes for Your Business
T2  - WorldNgayon
PY  - 2026
DA  - 2026/11/11/
UR  - https://worldngayon.com/privacy-act-reform-australia/
Y2  - 
ER  -