The Attorney-General's Department released the exposure draft Privacy Amendment (Personal Data Protection) Bill 2026 on 31 August 2026. It proposes that entities notify the Information Commissioner within 72 hours of believing an eligible data breach occurred. Consultation closed on 18 September 2026, and the bill is not yet law.
Key takeaways
- The bill is an exposure draft, not law.
- Consultation closed on 18 September 2026.
- Breach notices to the Commissioner would be due within 72 hours.
- A fair and reasonable test would replace APPs 3, 4 and 6.
- Processors acting on instructions would carry fewer obligations.
Where the bill stands
The department's consultation page says the bill "remains subject to further consideration by government". The draft commencement provisions carry no start dates. Nothing in it applies to your business today.
The 72-hour breach notice
Under the current Privacy Act an entity notifies the Commissioner as soon as practicable. The consultation paper says the draft would require a statement within 72 hours of becoming aware of reasonable grounds to believe an eligible data breach has occurred.
Three details from the consultation paper matter for planning:
- The 30-day assessment period for suspected breaches stays.
- An incomplete statement is allowed if a full one is impracticable.
- Missing the 72 hours could bring an infringement or compliance notice.
The paper says the period aligns with the Security of Critical Infrastructure Act 2018 and the Cyber Security Act 2024.
The fair and reasonable test
Russell Kennedy's summary of the draft says a single test would replace Australian Privacy Principles 3, 4 and 6. Collection, use and disclosure would need to be fair and reasonable in the circumstances, and lawful. The firm lists seven factors, including reasonable expectations, data minimisation and the best interests of the child.
Controllers and processors
The draft introduces a processor exception. A processor handles personal information on behalf of a controller under documented instructions. Russell Kennedy notes that processors would still answer directly for APP 1 and APP 11, which covers security of personal information.
For a SaaS business this turns on your contracts. Without documented instructions from customers, the exception would not help you.
Sorami’s view
This section is opinion. It is our planning advice, not legal advice. Talk to a lawyer about how the final bill applies to you.
The 72-hour clock is the part to test now, even before the bill passes. The hard question in the first 72 hours is which customer records a compromised account could read. The answer comes from access logs and a current data map, and both take weeks to build.
Wait for the final bill before rewriting privacy policies. Changing notices against a draft risks doing the work twice.
What to do now
- Run a breach exercise and time how long assessment takes.
- Confirm your logs show who accessed which personal information.
- Name the person who decides whether a breach is eligible.
- Check customer contracts for documented processing instructions.
- Hold privacy policy rewrites until the bill is final.
To test breach readiness before the bill is final, see our Privacy Act readiness service, or contact us to discuss scope.
Related guides
- Ransomware payment reporting in Australia: the 72-hour rule
- Stake and DriveWealth data breach: what was exposed
- Every Sorami article is in the guides index.
Sources
- Attorney-General’s Department, Privacy Reform: Consultation on Exposure Draft legislation (31 August 2026)
- Exposure Draft, Privacy Amendment (Personal Data Protection) Bill 2026 (PDF)
- Privacy Reform Consultation Paper (PDF)
- Russell Kennedy, Privacy Reform Tranche 2 Arrives (2 September 2026)
Facts on this page were checked against these sources on 12 October 2026. We update the page when the source changes.