DSPANZ provided a submission to the Attorney-General's Department consultation on proposed amendments to the Privacy Act 1988 on 18 September 2026.
What we said
In this submission, we supported contemporary privacy protections that build trust in digital services and highlighted that reforms must preserve the ability for businesses to use data and modern technology responsbly to improve security, productivity, compliance and service delivery.
DSPANZ recommended that the government:
- ensure the controller and processor framework clearly allocates responsibility according to actual function and control, including where a processor is dealign with a non-APP entity;
- provide OAIC guidance outlining how proportionality, lawful bases and repeatable assessments apply to businsess as well as AI and analytics tools or processes;
- ensure data minimisation, retention and destruction requirements work together and recognise statutory record keeping obligations;
- clarify that generated or derived personal information is confined to outputs actually created, retained or used about an individual;
- coordinate controller and processor notification duties and harmonise core information requirements across Commonwealth data breach reporting; and
- allow sufficient time after regulatory requirements are finalised for DSPs to design, build, test and support the customer transition.
Access the full copy of the submission.
What happens next
The Bill will remain subject to further consideration by government. DSPANZ will be monitoring updates from the Attorney-General's Department on consultation outcomes and whether the Bill is introduced to Parliament.