Privacy Act Tranche 2: What It Means for You

Tranche 2 is the next stage of Privacy Act reform. The government says it intends to introduce the bill before the end of 2026. Based on Tranche 1, penalty and regulator powers may start on Royal Assent, with a transition period, length not yet set, for substantive obligations ^[1]. Preparing now means checking your current APP compliance.

Most mid-market organisations do not need to wait for the final bill to act. The practical question for a board or privacy lead is how far current practice sits from the Australian Privacy Principles (APPs), because that gap is what any new obligation will land on.

Where Tranche 2 sits in the reform timeline

The Privacy Act reform program has been staged. Tranche 1 is the Privacy and Other Legislation Amendment Act 2024 (Cth). It passed both houses on 29 November 2024 and received Royal Assent on 10 December 2024. Tranche 2 is the next bill, and the government says it intends to introduce it before the end of 2026 ^[1]. As of 25 October 2026 it has not been introduced, so the final content, and the dates that apply, can still change.

An exposure draft of the Tranche 2 reforms, the Privacy Amendment (Personal Data Protection) Bill 2026, was released in August 2026. It is a useful guide to direction, but it is proposed legislation and not yet law. Anything in it may be amended, dropped or delayed before a bill passes.

The two milestones are easy to confuse, so it helps to separate them. The Tranche 1 changes are enacted law with fixed dates. Tranche 2 is still a proposal. Automated decision-making transparency is a Tranche 1 obligation and applies from 10 December 2026, so it will arrive before Tranche 2 does. Under it, entities need to disclose details of automated decisions in their privacy policies.

The other Tranche 1 changes include a statutory tort, a tiered penalty regime, a doxxing offence, groundwork for a Children's Online Privacy Code, and expanded OAIC powers to run public inquiries, issue infringement notices and gather information. Together they show how this reform program tends to work: new rights and enforcement tools arrive first, and detailed obligations follow.

What may start on Royal Assent, and what may come later

Tranche 1 gives us the best available signal on how Tranche 2 may be phased. Based on Tranche 1, penalty and regulator powers may start on Royal Assent, with a transition period for substantive obligations. The length of that transition has not been set ^[1].

That pattern matters for planning. The regulator's powers could be live before your obligations are fully in force. An organisation that treats the transition period as a grace period for everything may find the OAIC already has stronger tools to examine its practices.

The sensible reading is to treat the transition as time to build, not time to wait. Controls, records and procedures take months to put in place, and the length of the transition is not yet known. Organisations that start with an honest view of current practice can sequence the work, put effort where exposure is highest, and avoid a rush once dates are confirmed.

It also helps to be clear about what is not known. Until a bill is introduced, nobody can say exactly which obligations will apply, to whom, or from when. That is a reason to focus on the foundations that any version of the reforms would rely on: knowing what personal information you hold, why you hold it, who you share it with, and whether your practice matches your published policies.

The exposure already in place today

Tranche 2 is not the only source of risk. Several things apply now.

The statutory tort for serious invasions of privacy commenced on 10 June 2025. It lets individuals sue directly for serious invasions of privacy, including against small businesses outside the APPs ^[2]. That creates litigation exposure on top of OAIC enforcement ^[2]. It is not limited by the small business turnover exemption that still applies to the general APP rules, and it can reach the handling of employee records.

The courts have also shown how penalties work in practice. In the Australian Clinical Labs matter, the Federal Court ordered $5.8m in penalties: $4.2m for failing to protect data, $800k for inadequate breach assessment and $800k for failing to notify promptly ^[5]. Slow assessment and slow notification were each penalised separately ^[5].

The OAIC has also said where it will focus. Its 2025-26 priorities target power and information imbalances, including excessive collection, ad tech, data brokers and AI practices. It will also look at privacy in emerging technology such as biometrics and location tracking, and at APS information governance ^[4].

For organisations using AI, privacy law carries extra weight. The government abandoned its planned mandatory guardrails for high-risk AI and will rely on existing laws, so privacy law is the main binding AI control ^[6]. Any use of personal information in AI tools, or in automated decisions, therefore deserves a close look now, not after Tranche 2 passes.

What it means by role

For a CEO, COO, General Counsel or Company Secretary, the question is board exposure. Can you tell the board, with evidence, how your organisation performs against the APPs today? Penalties and a direct right of action both sit behind that answer. Boards are also likely to ask what the organisation is doing about the reforms already scheduled, and a short, evidence-based readiness summary answers that better than a general assurance.

For risk and compliance leads, the question is control and assurance. Do you have tested evidence for each APP, or only policies that say what should happen? Regulators and courts look at what the organisation did, not what its documents describe. A useful test is whether you could show an independent reviewer the evidence behind each rating, such as notices, consent records, access request logs and supplier contract clauses.

For a CIO, IT manager or information governance lead, the question is workload. Do you know where personal information is held, who it is shared with, and which systems make or support automated decisions? Without an information inventory, every new obligation becomes a manual hunt across systems and teams. Knowing which decisions are automated is also the starting point for the 10 December 2026 transparency requirement.

In many mid-market organisations, privacy is handled by an accidental privacy officer doing it on the side. If that describes you, a fixed-scope review is a way to get a clear picture without adding a permanent role.

Questions worth asking before the bill arrives

These are questions organisations often find hard to answer. They are prompts, not criticisms.

Are there manual policy and process gaps between what your privacy policy says and what staff actually do? Do you have an information inventory that shows what personal information you hold and where? Is there a data governance framework that assigns owners and decisions? Is your technology and security stack fragmented, so no one team sees the whole picture? Do you have enough people and skills to run privacy day to day?

If several answers are unclear, that is useful information. It tells you where to start and where the Tranche 2 exposure draft is most likely to bite.

If you operate in Queensland, state law matters too. The Queensland Privacy Principles replaced the earlier IPPs and NPPs, and a mandatory notification of data breach scheme started for Queensland government agencies ^[3]. Other states have their own regimes, so applicable state legislation should be part of any assessment.

A fixed-scope first step: the APP compliance gap assessment

The APP compliance gap assessment gives you a clear view of where you stand and how ready you are for the reforms. It takes 3 to 4 weeks.

The work starts by confirming scope with your Privacy Officer and collecting policies, notices, registers, contracts and training records. TFIQ then interviews up to 8 business owners across IT, HR, marketing, customer service and operations about how personal information is actually handled. Practice is rated against APPs 1 to 13 and applicable state law, with the evidence behind each rating recorded.

A reform readiness check tests readiness for automated decision-making transparency from 10 December 2026, the statutory tort and the Tranche 2 exposure draft. Gaps are then ranked by risk, so the roadmap starts where exposure is highest.

You receive an APP compliance gap assessment report, a gap and remediation register in Excel, a Privacy Act reform readiness summary, a remediation roadmap with owners and timeframes, and a findings presentation.

It does not include legal advice, drafting of remediated policies and notices, or technical security testing. If you want to know how mature the whole privacy program is, a privacy maturity assessment tier takes 6 to 8 weeks and adds a maturity rating, a benchmark and an agreed target state.

This article is general information, not legal advice. Get advice on how the reforms apply to your organisation.

Frequently asked questions

When will the Tranche 2 privacy bill be introduced?

The government says it intends to introduce the bill before the end of 2026 ^[1]. As of 25 October 2026 it has not been introduced, so timing and content can still change.

Will Tranche 2 obligations apply straight away?

Not necessarily. Based on Tranche 1, penalty and regulator powers may start on Royal Assent, with a transition period for substantive obligations. The length of that period has not been set ^[1].

Does Tranche 2 matter if we are a small business?

Possibly. The statutory tort already lets individuals sue directly, including against small businesses outside the APPs ^[2]. Whether Tranche 2 changes small business coverage depends on the final bill, so get advice.

Should we wait for the final bill before acting?

Waiting leaves less time to build controls. Penalties already apply to slow breach assessment and notification ^[5]. Checking current APP compliance now is useful whatever Tranche 2 finally contains.

Is the exposure draft the same as the final law?

No. The August 2026 exposure draft shows direction only. It can be amended, dropped or delayed before the bill passes, so use it to plan, not to treat as settled law.

What if we only want a quick read first?

A privacy health check takes 1 to 2 weeks. It gives a one-page scorecard against the 13 APPs and the five things to fix first, and shows whether a full gap assessment is worth doing now.

Start with the APP compliance gap assessment, a 3 to 4 week review that rates you against the 13 APPs and the reforms and gives you a prioritised roadmap.

Reviewed by Broderick Smith, Managing Director, Transform LogiQ (IAPP AIGP), on 25 October 2026.