Privacy Act overhaul to tighten 72-hour breach reporting deadline

Australian organisations would have 72 hours to notify the Information Commissioner of an eligible data breach under draft legislation released for consultation by the Attorney-General's department.

The Privacy Amendment (Personal Data Protection) Bill 2026 proposes to replace the current requirement to notify a data breach "as soon as practicable" with a fixed deadline.

This would bring the notifiable data breaches (NDB) scheme into line with 72-hour reporting periods used elsewhere in Australian cyber regulation, including for certain incidents under the Security of Critical Infrastructure Act 2018 and ransomware-payment reporting under the Cyber Security Act 2024.

As proposed, the 72-hour clock starts when an entity becomes aware that there are reasonable grounds to believe an eligible data breach has occurred.

However, the existing 30-day window to assess a suspected breach survives unchanged, leaving the two-stage current structure intact while adding a hard limit to the second stage.

Where a complete statement cannot be assembled in time, entities could file an incomplete one, accompanied by written notice identifying what is missing and explaining why it was impossible or impracticable to supply.

Failing to file anything at all within the 72 hours could attract an infringement notice or a compliance notice.

Deletion right, but a narrow one

The package also introduces the erasure right that the 2023 Privacy Act Review recommended, though in substantially reduced form.

Rather than applying across the economy, it binds only "large digital platforms".

These are defined as services covered by the Online Safety Act 2021 that clear either a $500m gross revenue test or an average of 2.5 million monthly Australian end users.

Qualifying platforms would have to destroy personal information on request unless an exception applies, and give written notice identifying what was destroyed, which exceptions were relied on and how to complain.

The exceptions are broad, covering law enforcement, retention required by law or court order, technical impossibility, requests that are frivolous or vexatious, and information strictly necessary to deliver an ongoing service to the individual.

Data brokers, credit reporting bodies, banks, telcos and retailers fall outside it entirely.

Controversial smartglasses not covered?

Although the consultation paper acknowledges community concern about emerging technologies such as smart glasses, which it says can record discreetly in public and private spaces and collect personal information without those nearby being aware, it stays clear of proposing the devices should be outlawed.

The paper points out that the Privacy Act does not apply to individuals acting in a personal capacity, meaning a person wearing the device would remain outside its scope.

Where an entity regulated by the Act collects and uses personal information through wearable technology, including photos, video, audio recordings and AI-generated inferences, it must comply with privacy law as it would for any other collection, the paper states.

That includes obtaining consent to collect sensitive information such as biometric templates.

The bill's broader reforms would apply to wearables specifically through several mechanisms such as modernised definitions clarifying that personal information extends to behavioural data generated by wearable devices.