AustraliaPrivacy Amendment (Personal Data Protection) Bill 2026 (exposure draft)
Exposure Draft Privacy Amendment (Personal Data Protection) Bill 2026 (Cth), amending the Privacy Act 1988, released for consultation by the Attorney-General's Department on
A published draft that has not reached a legislature, dated , as of .
A comprehensive regime rule binding public and private bodies.
As of .
Where it has got to
The text described here is Exposure Draft Privacy Amendment (Personal Data Protection) Bill 2026, as published for consultation, published .
Locally, this stage is exposure draft (consultation draft).
The stage above is recorded at consultations.ag.gov.au.
Submissions closed on . The commencement table in the exposure draft carries no dates, and the Bill has not been introduced in Parliament.
What it requires
- Collect, use or disclose personal information only where doing so is fair and reasonable in the circumstances and lawful (draft Australian Privacy Principle 3).NIST Privacy FrameworkCT.PO-P1
- If you become aware of reasonable grounds to believe that an eligible data breach of your entity has occurred, give the Commissioner a statement within 72 hours (draft section 26WK).NIST Privacy FrameworkCM.AW-P7
- Provide a simple means of requesting not to receive direct marketing communications before making one, and give effect to such a request (draft Australian Privacy Principle 7).NIST Privacy FrameworkCT.PO-P3
- If you are an organisation that is a large digital platform, destroy an individual's personal information on request, subject to listed exceptions (draft Australian Privacy Principle 14).NIST Privacy FrameworkCT.DM-P4
These lines are LexLint's reading of the law's text, as of .
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CT.DM-P4Data elements can be accessed for deletion.
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What this law does
The Attorney-General's Department opened a consultation on the exposure draft on . The consultation page states that the Bill remains subject to further consideration by government. The draft's Australian Privacy Principle 3 provides that an APP entity must not collect personal information, or use or disclose personal information it holds, unless the conditions in the principle are met.
The collection, use or disclosure would have to be fair and reasonable in the circumstances, and lawful. The notification section applies if an entity becomes aware that there are reasonable grounds to believe that there has been an eligible data breach of the entity. The entity must, within 72 hours, give the Commissioner a statement. The draft adds precise geolocation tracking data to the list of sensitive information.
It defines precise geolocation tracking data as personal information generated by or derived from a device or other technology. The draft would replace Australian Privacy Principle 7 so that an organisation must not make a direct marketing communication to an individual unless it provides a simple means of requesting not to receive them.
It would add Australian Privacy Principle 14, under which an organisation that is a large digital platform must, on request by the individual, destroy the personal information it holds about the individual, subject to listed exceptions.
When LexLint raises it
When your app profile says your app crawls the web, trains models, sends automated outreach, generates content with AI, processes biometric data or makes high-risk automated decisions.