Privacy reforms: what they mean for ADIA members

In brief

On 31 August 2026, the Australian Government released draft legislation – the Privacy Amendment (Personal Data Protection) Bill 2026 – that will change how organisations collect, use and protect personal information.

This is a significant update to Australia’s privacy laws. ADIA is already working with our Privacy Compliance Committee and independent reviewer of the Privacy Code to make sure members are fully supported. We will incorporate the changes into the updated Privacy Code and provide clear guidance and protection as the reforms progress.

This notice explains what’s changing, what it means for you, and how ADIA plans to support our members.

What’s changing

• A new ‘fair and reasonable’ test (replaces APP 3, 4 & 6)

All handling of personal information will need to meet a single, overarching standard: it must be fair and reasonable in the circumstances. This replaces a patchwork of separate rules with one clear test.

• A broader definition of personal information.

The law will now cover information that ‘relates to’ a person, not just information ‘about’ them. In practice, this brings things like behavioural data, device identifiers and inferred profiles into scope — not just names and contact details.

• No more bundled consent.

Businesses won’t be able to bury multiple uses of personal data behind a single tick-box. Consent will need to be clear, specific and separated out for each distinct use.

• A 72-hour breach notification window.

Organisations will have to report an eligible data breach to the Office of the Australian Information Commissioner (OAIC) within 72 hours of becoming aware of it – a firm deadline, which replaces the current ‘as soon as practicable’ standard.

• A limited right to erasure.

People will be able to ask large digital platforms and data aggregators (those with more than $500 million in local revenue or 2.5 million+ active users) to delete their data. This right is targeted at the large operators, not the broader industry.

• A clearer split between ‘controllers’ and ‘processors’.

The Bill sets out, in law, the difference between organisations that decide how data is used (controllers) and those who process it on their behalf (processors) – giving more certainty for outsourcing arrangements.

• Small businesses stay exempt, for now.

The Government has decided not to remove the existing $3 million turnover exemption in this Bill. Instead, small business coverage will be considered separately, through its own consultation process.

What this means for the research, data and insights industry

Many of these changes go directly to how our sector operates – particularly panel research, data collection and analytics.

A few examples:

• Panel sign-ups will potentially need to change.

Combining project profiling, future re-contact and multi-client data matching into one sign-up step won’t be allowed. Panels will need separate, clear opt-ins for each purpose.

• Tracking and device data will need extra care.

Because ‘relates to’ is broader than ‘about’, things like tracking data, AI-based panel indexing and device identifiers will need to be handled with the same care as names and contact details.

• Location data needs a closer look.

Precise geolocation data (accurate to 500 metres or better) will be treated as sensitive information. If the methodology uses continuous location tracking or footfall/geofencing data, organisations will need explicit, opt-in consent rather than a standard notice.

• Notifiable Data Breach (NDB) response needs to be faster.

With a 72-hour deadline to notify the OAIC, any field vendors or subcontractors you work with should be able to flag a possible issue to you well within that window – ADIA recommends 12–24 hours as a working benchmark.

• Ethically approved research may get more flexibility.

The OAIC plans to simplify the exemption for ethically approved human research. If your project is reviewed, approved and monitored under the National Statement on Ethical Conduct in Human Research, this could give you more room on some of the harder privacy questions – like consent for minors, long-term data retention or re-identification risk. You’ll still need to meet new guidelines the Privacy Commissioner is developing for this exemption.

• Consent involving children needs a closer look.

The reforms give more weight to the best interests of the child, balanced against other interests including those of parents, guardians and the wider community. If your research involves minors, expect the approach to parental consent to shift – watch for ADIA guidance as this develops.

• Newer research methods will need documented consent.

Using smart glasses, AI-based recording of interviews, or vehicle-based tracking (such as studying driver routes through connected car data) will require documented proof that participants gave informed consent. Insights drawn from behavioural or biometric data collected this way will also be treated as sensitive information.

• Panel recruitment tied to marketing needs a fresh look.

The definition of direct marketing is being simplified – it won’t need consent on its own, but using or on-selling personal information (a “trade”) will. Any panel recruitment or ad-supported data activity will also need a simple way for people to opt out, so it’s worth checking how ad-driven sign-up processes stack up.

How ADIA is supporting members

• Working with the Privacy Compliance Committee and our independent reviewer to assess the reforms in detail and ensure the industry’s voice is heard.

• Updating the Privacy (Market and Social Research) Code 2021
  With the privacy code review already underway, we will incorporate these reforms directly, so members inherit an updated, industry-specific framework (or roadmap) rather than having to interpret the general law and the changes themselves.

• Providing ongoing guidance and protection
  • A free and unlimited Privacy Hotline
  • Training and practical resources via the ADIA Academy
  • Expert guidance and access to Andrew Maher (legal) and Norine Cruse (Quality Consultant) and Sarah Campbell (Privacy Officer) so members have somewhere to turn with questions as the reforms take shape.

As the ADIA Code is the only registered APP Code in Australia, members are already operating under a co-regulatory framework that’s tailored to research and insights work and recognised by the Office of the Australian Information Commissioner (OAIC).

What you need to do right now

Nothing urgent – this is a draft Bill, and ADIA is managing the Privacy Code update on your behalf. In the meantime:

• Watch for further updates from ADIA as the Bill progresses and the Code is updated.

• Get in touch if you have questions about how this may affect your organisation – contact the ADIA Privacy Hotline.

• Start a quick internal review of where your business collects location data, runs panels, or handles ongoing consent — these are the area’s most likely to need attention. Check out the current privacy and data protection resources available via the Academy.