CU LAB: Privacy laws: what can organisations do better?

The Australian Government has released the Exposure Draft Privacy Amendment (Personal Data Protection) Bill 2026, proposing the most significant overhaul of privacy law in years. These reforms would fundamentally change how Australian businesses handle personal information, introducing a new "fair and reasonable" test, stronger consent requirements, expanded definitions of personal information, and new rules for AI and emerging technologies.

The new data breach scheme creates an obligation to report eligible data breaches relating to personal information.

Australia's Privacy Act reform has reached a critical milestone with the release of exposure draft legislation proposing fundamental changes to how organisations handle personal information. The reforms introduce a new 'fair and reasonable' test for data collection and use, a right of erasure for large digital platforms, strengthened consent standards, a statutory controller/processor framework, restrictions on trading personal data, and enhanced data breach obligations. These changes come at a time when em

Australia's privacy laws are undergoing significant reform, with new automated decision-making transparency requirements commencing in December 2026 and further substantial changes under consideration. Businesses must prepare for enhanced regulatory scrutiny, increased litigation risk through the new statutory tort for serious privacy invasions, and potential expansion of obligations to small businesses and employee records.

The Australian Government's exposure draft proposes a proactive, systems-based digital duty of care for online service providers, requiring them to ensure a 'safe online environment' so far as reasonably practicable.

Australia's digital regulatory landscape is undergoing a fundamental transformation, with the proposed digital duty of care joining a complex web of reforms including Privacy Act amendments...

Almost two years after a relatively modest set of Privacy Act reforms were passed in late 2024 (Tranche 1 Reforms) (more on these here), the Australian Government has released an exposure draft...

Australia's new statutory tort for serious invasions of privacy, which commenced in June 2025, is being tested against emerging AI-powered smart glasses technology that can record audio and video discreetly. As these devices become more sophisticated and less detectable, questions arise about whether current privacy laws adequately protect individuals from covert surveillance and data collection in both public and private settings.

New guidance to help organisations and developers comply with their privacy obligations when using AI.

The Australian Government's proposed digital duty of care reforms would extend online safety obligations far beyond social media platforms to encompass any business operating websites, digital platforms, or AI-enabled tools. Rather than simply responding to complaints, businesses would need to proactively identify foreseeable risks and implement safeguards, with substantial penalties for non-compliance reaching up to $109.2 million for companies. The exposure draft introduces a fundamental shift from reacti