Digital Rights Watch welcomes the opportunity to provide feedback on the Privacy Amendment (Personal Data Protection) Bill 2026.

The exposure draft of the Bill is an extremely welcome development. It represents an important step forward for Australia’s privacy landscape, which otherwise lags behind many comparable jurisdictions.

We would be grateful for a positive statement from the Attorney General in the Explanatory Memorandum which confirms that the intent of the reforms is to elevate privacy protections for all Australians, and that they should be interpreted accordingly.

DRW is broadly supportive of the contents of this bill, and is keen to see it progress swiftly through parliament. We do also have some comments on where we perceive gaps between intent and execution, and some areas where the Bill may fall short.

Our main concerns with the exposure draft are:

The application of the right to erasure is too narrow - it needs to apply to all APP entities rather than just large digital platforms.
Depending on regulators as the sole course of redress is slow and restrictive, to the point of being insufficient motivation for corporations to be compliant. Individuals need the ability to bring private legal action against APP entities they believe are non-compliant.
Regulators need to be granted investigatory powers to ensure APP entities’ compliance before they receive complaints from individuals.
There are remaining gaps in implementation that will necessitate future legislation. eg: Exemptions for political parties and small businesses are unusual in similar jurisdictions; the growth of high-risk technologies such as wearables, AI, and facial recognition.