The fair and reasonable test: what Australia's new privacy bill means for data you collect

The test is the headline, but the draft carries more. Two changes stand out for teams that hold personal data. A right to erasure is proposed under a new APP 14, limited to large digital platforms. Allens defines these as entities with 500 million dollars or more in annual revenue, 2.5 million or more average monthly users, or those providing social media and relevant electronic services. Exceptions include technical infeasibility and legal retention requirements. Most small and mid-size organisations sit outside this, but it signals where the law is heading.

Precise geolocation becomes sensitive data. Under a new section 6FE, geolocation tracking that identifies a location within a 500-metre radius over time is treated as sensitive information. That means consent is required before you collect it. If your app, fleet or field team captures location trails, this one applies to you.

500 million dollars or more a year

Large-platform revenue threshold for the right to erasure

2.5 million or more

Monthly users that also meet the large-platform test

within a 500-metre radius over time

Precise geolocation now treated as sensitive data

18 September 2026

Consultation on the exposure draft closes

On timing, the consultation closes on Friday 18 September 2026. The government intends to introduce legislation to Parliament before the end of 2026. DLA Piper describes the exposure draft as the second major tranche of Privacy Act reform, with around 40 proposals across stronger protections, clearer obligations and a more efficient regulator.

If you run a community survey, build a contact and preference dataset, or gather resident and family feedback, this lands on your desk, not just the legal team's. You own the forms and the systems that take the data in. A council asking for more detail than a survey needs, a property or recruitment team holding fields it never uses, or an aged-care operator keeping feedback long past its purpose: each is the kind of habit the test is built to catch.

You do not need the final Act to start. Work through your intake now, one field at a time:

1. Map what you collect: list every field, why you hold it, and where it flows.
2. Cut what you do not need: remove fields the purpose does not require.
3. Fix transparency: say plainly what you collect and why, in words people read.
4. Give genuine choice: make optional data optional, and mean it.
5. Tighten retention: delete data once the purpose has been met.

You have until 18 September 2026 to read the draft while it is still open. Waiting for the final Act is the costly option, because collection habits are hard to change once they are baked into forms and pipelines. A short review now tells you which parts of your intake would pass the fair and reasonable test and which need work. If you collect community or customer data, that review is the practical next step.

1. A new era for privacy: what the proposed Privacy Act reforms mean in practice (Allens) (accessed 2026-09-08)
2. Australia is eyeing a world-first fair and reasonable test for data collection and privacy (The Conversation) (accessed 2026-09-08)
3. Australia privacy reform consultation draft outlines proposed next steps (DLA Piper Privacy Matters) (accessed 2026-09-08)