December Deadlines, Draft Reforms and Lessons from Qantas
December 2026 closes out the first tranche of Privacy Act reform, and the second is already on the table. If your organisation uses automated tools to make decisions about people, collects children's data or relies on bundled consents, now is the time to act.
Two December Milestones
Automated decision-making (ADM) transparency. From 10 December 2026, privacy policies must explain when a computer program makes, or does something substantially and directly related to making, decisions that could significantly affect individuals' rights or interests. The OAIC released its guidance on 30 September. Two points stand out: human sign-off won't take a decision out of scope, and the OAIC expects vendors to give customers what they need to make the disclosure.
Children's Online Privacy Code. The OAIC must register the Code by 10 December 2026, but the commencement date and any transition period are still to be confirmed. It will apply to social media, electronic and designated internet services likely to be accessed by children, or primarily concerned with their activities. That catches more businesses than you might think, including many online retailers and child-focused banking apps. Based on the draft, expect privacy impact assessments for high-risk activities and child-friendly notices.
Tranche 2: The Draft is Out
The Government released an exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026 on 31 August. Consultation closed on 18 September, and the Government intends to introduce the Bill before the end of 2026. No commencement dates have been set.
A 'fair and reasonable' test. APPs 3, 4 and 6 would be replaced by a single requirement that all collection, use and disclosure be fair and reasonable, and lawful. Consent alone won't be a shield. A business could hold every consent it needs and still breach the Act. The test echoes the GDPR's legitimate interests balancing.
Tighter consent. The draft codifies consent standards. Broad or bundled consents, such as consent by reference to a privacy policy, will come under pressure.
A wider definition of personal information. Behavioural, inferred and device-generated data would be captured.
Tougher breach obligations. A 72-hour notification window, plus a positive duty to contain breaches and mitigate harm.
Controllers and processors. A European-style distinction that will flow into supplier contracts.
Right to erasure. Limited to large digital platforms.
What's missing matters too. The small business and employee records exemptions stay, and there is no direct right of action or mandatory privacy impact assessment.
The OAIC isn’t Waiting
The regulator is already enforcing the direction of travel. In May, the APP Guidelines gained new examples of soliciting personal information, including via AI, tracking pixels, facial recognition, data broking, scraping and web crawling. In June, the Privacy Commissioner found that Medmate and Monash IVF interfered with privacy by collecting sensitive information through third-party tracking pixels.
On 7 October, the OAIC opened an investigation into the maker of the HeyCyan smart glasses app after it ignored preliminary inquiries. The Commissioner urged retailers to reconsider stocking the devices, and Kmart has pulled its Anko camera glasses from online sale. Privacy risk in a third-party app can quickly become your problem.
Lessons from Qantas
If you've ever had a 'vishing' call, you'll know how convincing they can be. That's how the 2025 Qantas breach began: an attacker posing as 'Qantas IT help' called the airline's offshore contact centre. Around 5.12 million Australians were affected.
Yet in July, after almost a year of preliminary inquiries, the OAIC decided not to open a formal investigation. Before the breach, Qantas had:
Audited its third-party providers' security, data governance and privacy controls
Run mandatory, recurring cyber and privacy training for its offshore contact centre staff
Built service levels, audit rights, certification requirements and privacy obligations into its offshore supplier contract
Documented why it holds personal information, and run annual data removal on its CRM
Kept a specialist privacy team.
When the attack came, Qantas detected it within two days, cut off access and activated its incident response framework, which limited the damage.
The lesson? Reasonable steps may not prevent a breach, and a breach isn't proof of non-compliance. What counts is being able to show your work. The OAIC was also clear that its decision isn't an endorsement, and it has received a representative complaint about the breach. As the Commissioner warned, agentic and advanced AI will only increase cyber-security risk, so keep reviewing and pressure testing your controls.
Meanwhile in Europe
In August, the Dutch regulator fined Uber €825 million for automatically deactivating drivers' accounts without meaningful human review or adequate transparency. Uber has said it will appeal. For anyone preparing ADM disclosures, it's a sharp reminder of what regulators expect.
In September, Ireland's Data Protection Commission fined Google €403 million over location data. And on 13 October, the European Data Protection Board said in non-binding guidance that smart glasses makers can't leave it to wearers to warn bystanders they are being recorded, a week after the OAIC acted on the same issue. The EU's proposed GDPR simplifications under the Digital Omnibus remain under negotiation.
What To Do Now
Map your data. Know what you collect, how, why, where it's stored and who can access it.
Update your privacy policy for ADM before 10 December, and ask key vendors for their ADM information.
Check whether the Children's Code applies to your online services.
Fix your consents. Don't bury them in bundled terms or rely on default opt-ins.
Review supplier contracts through a controller/processor lens, with audit rights and privacy obligations built in.
Pressure test your breach response against a 72-hour clock.
Train your people, and keep records of your audits, training and retention schedules.
How We Can Help
Our Commercial team works with in-house legal teams, executives and boards on privacy, from ADM and privacy policy reviews to supplier contracts, data breach response and Tranche 2 readiness. We work on fixed fees, as an extension of your team.
To talk through what these changes mean for your organisation, get in touch.
Annika Childs, Head of Commercial
