Privacy Act Reform — information controllers regime (proposed Tranche 2)
Tranche 2 reforms in scoping — information controllers + processors regime.
highupcomingongoing
Who must comply
TBC.
What triggers it
Pending.
When due
TBC.
Evidence required
Pending.
Max penalty
—
Who must comply with this? The applicability test by industry, business structure and size.
Summary
Tranche 2 Privacy Act reforms under government consideration — controller/processor regime modelled on GDPR. Currently exposure-draft pending; in-force date TBC.
Enforced by
Source legislation
Topics
privacydata-governance
Related
- CWLTHData Availability and Transparency Act 2022Commonwealth data sharing regime — accredited users + entities.
- CWLTHNotifiable Data Breach (NDB) schemeUnder the NDB scheme, APP entities must notify the OAIC and affected individuals of an eligible data breach likely to cause serious harm — assessed within 30 days.
- CWLTHAPP 3 collection of sensitive informationAPP 3 bars collecting sensitive information — health, race, religion, sexual orientation and more — without consent. What counts as sensitive, the exceptions and penalties.
- CWLTHAutomated decision-making transparency in your privacy policy (APP 1.7–1.9)From 10 December 2026, APP entities that use computer programs to make or substantially assist decisions that significantly affect individuals must say so in their APP privacy policy.
- CWLTHPrepare for the proposed removal of the small business exemptionRemoving the Privacy Act small business exemption (<$3M turnover) is proposed for a future reform tranche — agreed in principle, not yet law.
- CWLTHComply with credit reporting obligations (Part IIIA Privacy Act)Credit providers and CRBs must adhere to the CR Code on collection, use, disclosure, hardship and dispute resolution.
Reading
Frequently asked questions
- Who must comply with Privacy Act Reform — information controllers regime (proposed Tranche 2)?
- TBC.
- What triggers Privacy Act Reform — information controllers regime (proposed Tranche 2)?
- Pending.
- When is Privacy Act Reform — information controllers regime (proposed Tranche 2) due?
- TBC.
- What evidence is required for Privacy Act Reform — information controllers regime (proposed Tranche 2)?
- Pending.
Source: https://www.ag.gov.au/rights-and-protections/privacy. Rules Mate is not a law firm. Always verify against the live regulator source before acting.