Australia is considering significant reforms to the Australian Privacy Act 1988 (Cth) (Australian Privacy Act). If introduced in the form currently proposed, the reforms would place considerably greater responsibility on organisations for their collection, use and disclosure of personal information and will apply to New Zealand businesses doing business in Australia.

They may also form a platform for a push for similar changes to the New Zealand Privacy Act 2020 (New Zealand Privacy Act).

What are the key reforms proposed, and what will they mean for New Zealand businesses

Some of the key differences between Australian and New Zealand privacy law that could arise if the reforms are adopted are outlined below.

Fair and reasonable test

Under the proposed Australian reforms, the collection, use and disclosure of personal information would be required to be “fair and reasonable in the circumstances”. This would involve specific consideration of matters such as individuals’ reasonable expectations, data minimisation, genuine choice, privacy impacts, risks of harm and proportionality.

This is not to say that there is no requirement under the New Zealand Privacy Act that organisations act in a fair and reasonable manner when collecting and handling personal information. For example, an agency should generally collect personal information only for a lawful purpose connected with its functions or activities and where collection is necessary for that purpose. Personal information should also be collected by means that are lawful and fair and do not intrude to an unreasonable extent on an individual’s personal affairs.

However, New Zealand does not currently have an equivalent overarching test requiring the collection, use and disclosure of personal information to be fair and reasonable in the circumstances.

Definition of personal information

The Australian Privacy Act, like the New Zealand Privacy Act, currently defines personal information by reference to information “about” an individual. The reforms would expand the Australian definition to include information that “relates” to an identified individual or an individual who is reasonably identifiable.

The revised definition would make it clear that information can be personal information even where the individual is not named. It could also expressly capture identifiers, location and geolocation information, characteristics, behaviours, preferences and patterns of activity as information that may identify an individual.

From a practical perspective, this may not produce a significantly different result from the position under New Zealand law. However, it would modernise the definition by expressly accommodating contemporary forms of data processing, including behavioural analytics and inferencing.

Consent

The Australian reforms would specify that consent must be voluntary, informed, current, specific and unambiguous. They would also require consent for the collection of sensitive information and for trading in personal information, subject to specified exceptions.

There is no equivalent general requirement under the New Zealand Privacy Act to obtain consent before collecting or processing personal information. Instead, the Privacy Act generally focuses on ensuring transparency about the fact that information is being collected and how it may be used and disclosed, by giving reasonable notice.

Right to erasure and direct marketing

The Australian reforms would introduce a right for individuals to request the erasure of their personal information. As currently proposed, that right would apply only against “large digital platforms” meeting prescribed revenue or user-number thresholds and would be subject to exceptions.

The reforms would also require a simple opt-out mechanism in every direct marketing communication and establish specific rules for ad-supported services.

New Zealand’s Privacy Act does not currently provide a general right to erasure and its direct marketing obligations largely sit within the general information privacy principles rather than a dedicated code of this kind.

Impact on New Zealand businesses

The Australian Privacy Act does apply to New Zealand businesses carrying on business in Australia. If subject to the Australian regime, those businesses may therefore need to comply with the additional requirements introduced by the reforms, even where their practices comply with New Zealand law.

The practical impact is likely to be greatest for larger or data-intensive businesses that use substantial amounts of personal or behavioural information for profiling, personalisation or targeted advertising. Businesses collecting only conventional information necessary to provide goods or services are less likely to require significant changes.

For more data-intensive businesses, the reforms would require consideration not only of whether information is collected, used or disclosed for a permitted purpose, but whether the practice itself is fair and reasonable, including whether it is necessary and proportionate, its potential impact on individuals and risks of harm, and whether it is consistent with individuals’ reasonable expectations.

Should New Zealand adopt similar reforms?

New Zealand has not yet enacted a comparable package of broader privacy reforms. The most recent being the introduction of Information Privacy Principle 3A (relating to the indirect collection of personal information), which took effect on 1 May 2026.

There has, however, been continuing debate about whether the New Zealand Privacy Act requires further modernisation. When the current New Zealand Privacy Act was enacted in 2020, it was based on recommendations contained in a Law Commission report completed in 2011. The current Privacy Commissioner, Michael Webster, has since advocated for further reform, including a right to erasure, a significantly stronger penalty regime, stronger protections for automated decision-making and greater organisational accountability (see Office of the Privacy Commissioner | New Zealand needs Privacy Act modernisation).

There is a good policy rationale for shifting more responsibility onto organisations. As data practices become increasingly complex, and the occurrence and threat of data breaches and cyber-attacks continue to grow, there is a legitimate question about how much more responsibility and accountability individuals can realistically expect of those who collect and hold their personal information. That does not necessarily mean New Zealand should adopt the Australian model wholesale. New Zealand already has a principles-based Privacy Act, and concepts underpinning the Australian proposal, including necessity and constraints on collection, are reflected in our existing framework.

The Australian reforms should nevertheless provide a useful comparator as New Zealand considers whether those protections remain sufficient as technology and data practices continue to evolve. It will also be useful to see how an overarching fair-and-reasonable test operates in practice. Principles-based regulation provides flexibility as technology and data practices develop, but that flexibility can also create uncertainty for businesses about exactly where the regulatory line sits.

Get in touch with one of our experts

If you would like to discuss any aspect of these reforms, or what they may mean for your business, please contact one of our experts.

Special thanks to James Burnett for his assistance with his article.