If your team collects public web data, real-estate listings, business directories, agent profiles or tender notices, and feeds it into a pipeline that scores or ranks people, the rules you rely on are shifting. On 31 August 2026 the Attorney-General's Department released the exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026. Submissions close on 18 September 2026. The instinct that public means fair game is now the thing under review. Here is what the draft does, and a practical checklist to keep your collection and your decisions defensible.
The change in one paragraph
The exposure draft is the second tranche of Australia's privacy reform. It contains about 40 proposals that modernise how personal information is defined and handled. Three parts matter most if you scrape and pipe data. First, a new overarching fair and reasonable test is proposed to replace Australian Privacy Principles 3, 4 and 6. It weighs factors such as reasonable expectations, transparency, data minimisation and genuine choice. Second, the definition of personal information gets wider. Third, from 10 December 2026, entities must disclose the personal information used in substantially automated decisions. Submissions on the draft close on 18 September 2026, so the window to respond is short.
Why public is no longer the test
For years the working assumption was simple. If data sat on a public page, collecting it was safe. The draft reframes that. Scraping publicly accessible data that can be linked to an individual is still personal information, and it carries the same obligations as any other. The question is no longer whether the data was visible. The question is whether your collection is fair and reasonable.
That test weighs what a person would reasonably expect. Someone who lists a property or posts a professional profile expects it to be seen by buyers or clients. They may not expect it to be harvested, stored for years and fed into a model that ranks them. The gap between those two expectations is where risk now sits.
For your pipeline, this means the defence changes. That it was public is not enough on its own. You need to show why you collected the data, that you took only what you needed, and that a person could reasonably expect that use.
The numbers that show why regulators care
Regulators are not looking at this in the abstract. The volume of data incidents is rising, and the pipelines that move personal information are part of the picture.
