Privacy Act tranche 2 exposure draft: a fair and reasonable test and 72-hour breach notice
Submissions closed on 18 September and the bill is still with government, so nothing in it is law yet.
On this page
Where the bill stands
The department opened consultation on 31 August 2026 with the exposure draft and a consultation paper. The department states the bill remains subject to further consideration by government. No commencement date has been announced.
What the draft proposes
MinterEllison's reading of the exposure draft identifies six main measures. Any of them can change before a bill is introduced.
- Collection, use and disclosure must be fair and reasonable in the circumstances, as well as lawful
- Controller and processor roles, with a processor acting on the controller's documented instructions
- Notice to the OAIC within 72 hours of reasonable grounds to believe an eligible data breach occurred
- Statutory consent criteria: voluntary, informed, current, specific and unambiguous
- No trading in personal information without the individual's consent, subject to exceptions
- A limited right to erasure that applies to large digital platforms
What to do while the draft is under consideration
The 72-hour notice is the change that reaches incident response plans. The current scheme allows up to 30 days to assess a suspected breach. A plan written for the draft rule names who decides, what evidence they need and who drafts the notice, inside three days.
- Map which suppliers process personal information on your instructions
- List where the business relies on consent, and check it against the draft criteria
- Rehearse a breach assessment against a 72-hour clock
Sources
- PrimaryAttorney-General's Department, Privacy Reform: consultation on exposure draft legislationRetrieved 25 Oct 2026
- SecondaryMinterEllison, Draft tranche 2 privacy reforms: what they mean for businesses (4 September 2026)Retrieved 25 Oct 2026
