ADIA responds to proposed privacy reforms

On 31 August 2026, the Australian Government released the draft Privacy Amendment (Personal Data Protection) Bill 2026, a major update to how organisations collect, use and protect personal information.

Working with our Privacy Compliance Committee and the independent reviewer of the ADIA Privacy Code, ADIA submitted to the Attorney-General's Department on 18 September.

The Government is proposing to replace three of the Australian Privacy Principles (APPs 3, 4 and 6) with a single test: that personal information must be handled in a way that is 'fair and reasonable'. We support this change, as the ADIA Code's existing research-specific rules fit comfortably alongside it. We also support stronger data security obligations, which are consistent with what members already work towards under the Code, ISO 20252 and ISO 27001.

We have also asked the Government to:

• Allow at least 12 months for the ADIA Privacy Code to be aligned with the new law
• Recognise the ADIA Privacy Code as an alternative to ethics committee approval for sensitive-topic research
• Confirm that commissioned research (and participant re-contact) are not caught by new rules on “trading” and consent
• Clarify that Research Organisations are not simply “processors” acting on client instructions
• Support small and medium businesses in meeting the new 72-hour data breach notification period.

We will keep members updated as the Bill progresses. Read ADIA's full submission below.

For further information, please don't hesitate to contact me.