If you’re doing business in Australia, read on… If you’re interested in how privacy laws can impact on your marketing …read on.

The Australian Government has released an Exposure Draft Bill (Privacy Amendment (Personal Data Protection) Bill 2026) ‘to modernise and strengthen Australia’s privacy laws for the digital age.’ The proposed reforms are designed to ‘improve privacy protections for Australians and help tackle emerging risks from new technologies, including artificial intelligence and wearable devices such as smart glasses’.

Why should you be interested if you’re not doing business in Australia? Well, bureaucrats are much like us. In just the same way that you have international contacts and information sources about marketing trends, they have relationships with other lawmakers about legislative change. So, what happens in the UK or Australia can often eventually find its way to New Zealand.

As you’d expect, the Bill is written in complex legal language so I’ll do my best to interpret it and explain how it may affect marketers.

Key Proposed Reforms

  • Fair and Reasonable Test: Organisations must prove their data collection and handling is fair, reasonable, and lawful, even if they already have consent from the individual concerned. This may mean whether a reasonable person would expect the collection, use or disclosure of the information or whether it is relevant to the organisation’s business. It could also include whether there is any risk of harm. The activities most likely to attract regulatory attention are targeted advertising, profiling, data enrichment, and secondary uses of information collected for another purpose.
  • Right to Erasure: Allows individuals to request large digital platforms and search engines such as Google, Facebook, Instagram and in NZ perhaps even TradeMe, to delete their personal information. Similar to the GDPR right to be forgotten regulations.
  • Stricter Consent Rules: Requires explicit consent for collecting sensitive information and the commercial trading of personal data. Consent must be "voluntary, informed, current, specific and unambiguous," giving individuals genuine choice and control over the handling of their personal information. This probably means that methods like pre-ticked boxes and bundled consent won't survive.
  • Data Breach Updates: Requires businesses to maintain data breach response plans and report eligible breaches to the Office of the Australian Information Commissioner.
  • Direct Marketing Overhaul: Replaces older rules with a simplified direct marketing framework. It forces companies to give users simple, clear ways to opt out of marketing communications and behavioral advertising. Group level targeting is caught, so this covers programmatic and behavioural advertising, targeted social media campaigns and audience segmentation, as well as personalised email, SMS and telemarketing. Organisations sending direct marketing will need a simple opt-out mechanism, clear opt-out information in each communication, and a process to act on requests.

The new Bill was released on Aug 30th, and public consultations only remain open until September 18th, so the Aussie government is really pushing this along.

So, what does this 54-page bill do that NZ Privacy regulations don’t cover?

Firstly, it gives individuals the right to ‘opt-out’. But whilst the NZ Privacy act doesn’t have an opt-out clause, the Marketing Association’s Digital Marketing Code of Practice has required marketers to provide opt-out facilities for over 25 years!

The bill’s consent requirements are more general than in NZ, but our Unsolicited Electronic Messages Act has required consent for digital communications since 2007. And how do you get consent from an individual to hold their contact details if you haven’t already got their contact details?

The rights to erasure of personal information are similar to the GDPR regulations but this rule has always seemed to be self-defeating to me….if you totally remove someone’s details from your database, what’s to stop them being included in future prospect marketing?

What the bill doesn’t do!

Businesses with an annual turnover of AUD$3 million or less are generally exempt from Australian privacy legislation. This exemption was expected to be removed under the bill but, surprisingly, it is not part of the proposed changes; the small business exemption stays in place. If NZ had a similar clause in its privacy legislation, around 500,000 businesses would be exempt from compliance!

No doubt legislators on this side of the Tasman and our own Privacy Commission will be following the course of all these changes. Will they be a portend of things to come in New Zealand?

Author: Keith Norris, Marketing Compliance Consultant, Marketing Association, 16th September 2026