11 SEP 2026 — Australia's draft privacy bill would replace consent with an objective test: collection and use of personal information must be fair and reasonable in the circumstances, judged against seven legislated factors. It also creates a right to erasure — for organisations above roughly A$500 million in group revenue or 2.5 million Australian users, and nobody else. Consultation closes on 18 September.
What the bill proposes
The existing collection, use and disclosure obligations go, replaced by a framework built on whether a use is objectively fair, reasonable and lawful. The seven factors run to reasonable expectations, transparency, minimisation, genuine choice and the proportionality of harm.
Alongside it: a 72-hour data breach notification deadline, and a right of erasure limited to large digital platforms above the revenue or user thresholds.
This is a draft in public consultation, not law. Submissions close on 18 September 2026, which is a week away.
The erasure right reaches almost nobody
"Australians get a right to erasure" is the line travelling, and the threshold is the whole story. The right applies to large digital platforms above about A$500 million in group revenue or 2.5 million average Australian end users.
That is a handful of companies. The insurer holding your claims history, the retailer holding your purchase record, the clinic holding your file, the recruitment agency holding your CV — none of them is covered by this right unless they happen to clear those thresholds, and almost none will.
There is a coherent argument for starting there: the platforms hold the most data about the most people, and a narrow right that works is better than a broad one nobody can administer. It is still a much smaller thing than the phrase suggests, and the phrase is what most people will read.
The fair and reasonable test
This is the provision worth paying attention to, and it is a real departure. Under the current model, consent does a great deal of work: a user agrees, and agreement largely settles whether a use is permitted.
An objective test moves the question. It stops mattering only whether someone clicked, and starts mattering whether the use was reasonable — assessed by a regulator against listed factors, regardless of what the user agreed to.
That is a direct answer to the failure everyone has observed for twenty years: consent at internet scale is a formality, obtained through interfaces designed to obtain it, for uses nobody reads. A test that survives the click is the first serious structural response any jurisdiction has drafted.
Why this matters in Southeast Asia
Australia is not a large market, and it is the closest large common-law jurisdiction to this region with a privacy regime under active rewrite. Singapore's PDPA, Malaysia's PDPA and Indonesia's PDP Law all sit in the same neighbourhood of consent-based drafting.
A world-first objective test next door will be read closely by regulators here, because the drafting problem is identical and Australia will have done the expensive part. Whether it is copied depends on whether it survives contact with Australian business, which is what the consultation is for.
For companies operating regionally, the practical question arrives sooner. An organisation with Australian customers has to build to the test, and once built, the cheaper path is usually to apply it everywhere rather than maintain one compliance posture per market.
Objective tests are hard to run
The obvious difficulty is that "fair and reasonable" means what a regulator later decides it means. Seven factors narrow the discretion and do not eliminate it, and a business planning a product two years out needs to predict a judgement nobody has made yet.
The usual answer is guidance and precedent, both of which take years to accumulate. In the interim the safe course is conservatism, which is a cost that falls hardest on smaller organisations without legal departments.
That is not an argument against the test. It is the reason the transition period and the guidance schedule matter as much as the drafting, and neither is settled.
What to watch
Whether the erasure thresholds survive consultation, since they are the provision most likely to be argued over and the easiest to move. Whether the seven factors are amended, because each one is a lever.
And whether any regional regulator says anything publicly. A privacy authority in this region citing the Australian draft would be the first sign that the test is travelling, and that would matter more to readers here than the bill itself.
View author profile → · Editorial policy
