The next round of Privacy Act reform changes the question every business has to ask about its customer data. Today the question is mostly whether a privacy policy discloses the practice and whether the customer ticked the box. Under the Exposure Draft released on 31 August 2026, the question becomes whether the collection, use or disclosure is “fair and reasonable in the circumstances”. Consent will not get a practice over that line on its own, and neither will a well drafted privacy policy.

What the fair and reasonable test actually changes

The Exposure Draft replaces the current collection, use and disclosure rules in Australian Privacy Principles 3, 4 and 6 with a single overarching requirement. An APP entity must not collect, use or disclose personal information unless doing so is “(a) fair and reasonable in the circumstances; and (b) lawful.” The test applies to how information is handled, and consent is not an exception to it.

The draft Privacy Amendment (Personal Data Protection) Bill 2026 sets out the factors an entity must have regard to:

• whether a reasonable person would expect the collection, use or disclosure;
• whether it relates to the entity’s functions or activities;
• transparency about the means and purposes;
• whether the purpose could be met with less personal information, or with information that is not personal information;
• whether the individual was given genuine choice;
• the impact on privacy and the risk of harm, including whether it is proportionate to the benefits; and
• where a child is involved, the best interests of the child as a primary consideration.

Two consequences matter most for a founder-led business. First, the privacy policy stops doing the heavy lifting as simply detailing the process in the policy would not, in of itself, necessarily satisfy the transparency requirement. Second, “take it or leave it” terms and interface designs that steer people away from refusing count against genuine consumer choice.

Simply put, consent will no longer save a practice that fails the test!

Who is caught, and why small businesses should still read on

Businesses with annual turnover of $3 million or less remain outside the Privacy Act in most cases, and the Exposure Draft does not remove the exemption or the employee records exemption. It is not the whole answer however, because the exemption has always had exceptions and the draft changes how at least one of them works.

The exemption does not apply to a small business that is, among other things, a health service provider, a contractor under a Commonwealth contract, or a business that trades in personal information. A business can also opt in.

Then there is the supply chain. The Exposure Draft introduces, for the first time in Australian privacy law, a distinction between a controller, which decides why information is handled, and a processor, which acts on the controller’s documented instructions.

The practical effect is contractual. If you supply software, marketing, fulfilment or data services to a larger business that is covered, expect its contracts to start asking you to act strictly on “documented instructions”, and to warrant that you do.

The definition of personal information also widens, from information “about” an individual to information that “relates to” one. Identifiers, behavioural data, location data and online tracking are more likely to be caught.

What changes for consent

Consent now gets a statutory definition. Under the Exposure Draft, consent “may be express or implied, but must be all of the following: (a) voluntary; (b) informed; (c) current; (d) specific; (e) unambiguous.”

Consent becomes a requirement, not just a safe harbour, in two places. Collecting sensitive information would need express consent, subject to limited exceptions. Trading in personal information, as newly defined, would generally need consent unless a carve out applies, such as a disclosure needed to provide a product the individual asked for, or a disclosure to a processor.

Data breaches: a 72 hour clock

Once an entity becomes aware of reasonable grounds to believe an eligible data breach has occurred, it would have to give the Privacy Commissioner a statement “within 72 hours”. An incomplete statement is permitted where completing it within that time is impracticable, with the rest to follow as soon as practicable.

Entities would also have to take reasonable steps to put practices, procedures and systems in place to respond to breaches, and to take reasonable steps to prevent or reduce harm when one happens. A response plan that exists only in someone’s head will not meet a 72 hour deadline!

What to decide now

The consultation closed on 18 September 2026 and the Bill remains subject to further consideration by government.

The steps worth taking now:

• Confirm your status: Covered in your own right, covered through the trading exception, a processor for a covered customer, or genuinely outside the Act.
• Map what you hold: What personal information the business collects, where it sits, and who it goes to, including through website tracking and advertising tools.
• Test each use against the factors: Would a reasonable customer expect it? Could you achieve the same thing with less data?
• Rebuild consent flows: Remove pre ticked boxes and bundled consents. Separate marketing consent from acceptance of your terms.
• Review your contracts: Customer and supplier agreements should say who is controller and who is processor, and what instructions apply.
• Write the breach plan down: Name who decides, who notifies, and how you will meet 72 hours.

Privacy policies, website terms and online compliance documents are part of the commercial work Camber Law & Advisory does for founder-led businesses. The reform does not make those documents less important. It means they have to describe practices that can stand up on their own.

The takeaway

The Exposure Draft moves Australian privacy law away from checking whether a practice was disclosed and towards asking whether it is fair. Small businesses under the $3 million threshold remain largely exempt, but trading, tracking and supplying covered customers can each bring a business inside the regime. The Bill is not law yet, and its commencement date is unknown. The businesses that review their data handling, consent flows and contracts now will have the least to fix later.

If you’re working out where your business sits under the proposed Privacy Act reform, Camber Law & Advisory can help you think it through. Get in touch for a 30 minute consultation. See our commercial services.

Frequently asked questions

Does the fair and reasonable test apply to my business now?

No. It is in an Exposure Draft Bill released for consultation on 31 August 2026, which closed on 18 September 2026. The Bill has not been introduced or passed, and its commencement date is blank. The current Australian Privacy Principles continue to apply until the reform passes and commences.

If my turnover is under $3 million, am I exempt from the new rules?

Usually, but not always. The small business exemption is retained, but it does not apply to businesses that trade in personal information, health service providers or Commonwealth contractors, among others. The Exposure Draft redefines “trade” to include disclosures for direct marketing, so a business using advertising pixels should check its position against the final Bill.

Will customer consent still protect my business?

Not on its own. Under the Exposure Draft, consent is not an exception to the fair and reasonable requirement. It must also be voluntary, informed, current, specific and unambiguous. A practice that a reasonable customer would not expect, or that collects more data than needed, can fail the test even with consent.

How long will businesses have to comply?

Unknown. The Exposure Draft does not set a commencement date. Some commentators anticipate a grace period of six to 12 months after passage, but that is a prediction, not a provision in the draft. Once the rules commence, they would apply to personal information already held.