Australia's Privacy Act Tranche 2 Reforms Would Change How Every Enterprise Handles Personal Data

Australia is moving toward the most significant overhaul of its privacy law in a generation, and the latest step should be on every enterprise’s radar. In August 2026 the Government released the Tranche 2 exposure draft of its Privacy Act reforms, proposing around forty measures that would substantially change how organisations collect, use, secure and share personal information (McCullough Robertson). It is not law yet, and the detail may shift, but the direction is unmistakable, and organisations that wait for the final text will be preparing under pressure rather than on their own terms.

What the draft would change

The proposals are wide ranging, but a few stand out as genuinely consequential for how enterprises operate (Corrs Chambers Westgarth).

A fair and reasonable test. Perhaps the most far reaching proposal is a requirement that the handling of personal information be fair and reasonable in the circumstances, as an objective standard that applies regardless of whether the individual consented. This matters enormously, because it shifts the ground from consent to reasonableness. An organisation could no longer rely on dense terms and a tick box to justify data practices that a reasonable person would not expect. Consent stops being a shield for whatever the fine print allowed.

A controller and processor framework. The draft introduces a GDPR style distinction between the entity that decides how data is handled and the entity that processes it on their behalf, with obligations flowing to both. For the many Australian enterprises that handle personal data for others, or rely on third parties to handle theirs, this reshapes where responsibility sits and what has to be in contracts.

A broader duty on data breaches. The proposals include a duty to take reasonable steps to mitigate harm flowing from all data breaches, not only those that cross the existing notifiable threshold. That widens the response obligation considerably, bringing lower level incidents into scope.

Alongside these, consent rules for direct marketing and data trading would tighten, and accountability across the whole data lifecycle would increase.

Why this is a governance shift, not just a compliance update

Taken together, these changes move privacy from a matter of obtaining consent to a matter of demonstrable, ongoing responsibility. That is a different discipline. Under a consent model, an organisation could in principle collect a signature and move on. Under a fair and reasonable standard with lifecycle accountability, the organisation has to be able to show, continuously, that its data handling is justifiable and that it knows what it holds and why.

The shift is from “did the individual agree” to “would a reasonable person consider this fair, and can you prove you are handling their data responsibly”. That is a far higher bar, and consent no longer clears it on its own.

This echoes a pattern visible across regulation generally, from financial services to critical infrastructure: the expectation is moving from having a policy to proving, on an ongoing basis, that controls actually work. Privacy is now following the same path.

The data you cannot see is the risk

The uncomfortable truth for most large organisations is that they do not have a complete picture of the personal data they hold. It accumulates across systems, business units, spreadsheets, third party tools and ageing databases, often without a clear record of what is where or why it is kept. A fair and reasonable standard and a lifecycle accountability duty are very hard to meet when you cannot actually see the data you are accountable for.

This is why preparation starts not with legal interpretation but with visibility. You cannot handle data fairly, secure it properly, or respond to a breach quickly if you do not know it exists.

What enterprises should do now

1. Inventory your personal data. Establish what personal information you hold, where it lives, why you have it, and who it is shared with. This is the foundation for everything else.
2. Test your practices against a fair and reasonable standard, not just against consent. Identify any data handling that relies on fine print a reasonable person would not expect, and reconsider it.
3. Map your processor relationships. Know where you handle data for others and where others handle it for you, and review the contracts that govern those arrangements.
4. Strengthen breach response for all incidents, not only notifiable ones, so you can demonstrate you took reasonable steps to mitigate harm.
5. Treat privacy as continuous governance. Give it an owner, build it into how systems and processes are designed, and keep it current rather than revisiting it only when the law forces you to.

Organisations that start now will shape their data practices deliberately. Those that wait will be retrofitting under a deadline, which is slower, costlier and riskier.

Where Jaykan fits

Jaykan helps enterprises and government organisations build the data governance that reforms like this demand, as part of our IT consulting and data practice: establishing visibility of personal data, aligning handling to a fair and reasonable standard, and strengthening the security and breach response that underpin it. We help clients prepare for the direction of the law rather than scramble when it lands.

If you are not confident you could show exactly what personal data you hold and that you handle it responsibly, a complimentary, senior led assessment will map your exposure and give you a practical plan to get ready.

Frequently asked questions

What are the Tranche 2 Privacy Act reforms?

They are the second stage of Australia's Privacy Act reform, released as an exposure draft in August 2026. The draft contains around forty proposals that would significantly strengthen obligations on how organisations collect, use, secure and share personal information, drawing on the earlier Privacy Act Review and adding measures aimed at emerging technology.

What is the fair and reasonable test?

It is a proposed requirement that the collection, use and disclosure of personal information be fair and reasonable in the circumstances, as an objective standard that applies regardless of consent. In practice it would mean organisations can no longer rely on buried consent to justify data handling a reasonable person would not expect.

Is Tranche 2 law yet?

No. As of late 2026 it is an exposure draft open for consultation, not enacted law. The Government has indicated it intends to introduce legislation before the end of 2026, but the detail may change. Organisations should prepare for the direction of travel rather than wait for the final text.

What should enterprises do to prepare?

Start with a clear inventory of the personal data you hold, where it is, and why. Then review your data handling against a fair and reasonable standard, strengthen data security and breach response, map any processor relationships, and treat privacy as a continuous governance responsibility rather than a one-off compliance project.