Australia’s Privacy Overhaul Puts Enterprises on 72-Hour Data Breach Reporting Clock

Draft privacy reforms seek to strengthen breach response, consent requirements and personal data protections as cyber and AI-related risks rise. The Australian Government has proposed a fixed 72-hour deadline for organisations to report eligible data breaches to the Office of the Australian Information Commissioner (OAIC) as part of the next phase of reforms to the country’s Privacy Act. The proposal forms part of the exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026 ,