Australia is proposing a major reset of privacy law that would require organisations to show that their collection, use and disclosure of personal information is “fair and reasonable in the circumstances”—even when they have obtained consumer consent. For creditors, collection agencies, debt buyers, fintechs and data vendors, the proposal would make a long privacy notice or a checked consent box a far less reliable defense for expansive data practices.

The Albanese government released exposure-draft legislation, the Privacy Amendment (Personal Data Protection) Bill 2026, and an accompanying consultation paper on August 31. Public submissions are due September 18.

A shift beyond consent

Australia’s current privacy framework already requires covered organisations to collect information by lawful and fair means and only where it is reasonably necessary for their functions or activities. But the draft proposal goes further by applying an affirmative “fair and reasonable” standard to the collection, use and disclosure of personal information.

The practical question would no longer be only whether a business disclosed a practice in its privacy policy or obtained nominal consent. Regulators and businesses would need to consider whether the practice itself was objectively appropriate.

Factors identified in the consultation framework include:

• What a reasonable person would expect an organisation to do with the information.

• Whether the organisation has been transparent.

• Whether the intended purpose could be achieved with less information or through a less intrusive method.

• Whether an individual has a genuine choice.

• The sensitivity of the information and the likely risk of harm.

• The balance between the benefits of the handling and its potential privacy impact.

• For children’s data, the child’s best interests as a primary consideration.theconversation+1

The proposed approach is unusual internationally. Europe’s General Data Protection Regulation is structured around legal bases for processing, while U.S. privacy rules often center on notice and consent. Australia’s proposed test would ask a more substantive question: even if someone agreed, was the underlying data practice fair and reasonable?

Why collections firms should pay attention

Debt collectors and creditors often handle data whose sensitivity rises sharply once a consumer enters delinquency, hardship, default, bankruptcy or recovery workflows. The data ecosystem can involve original creditors, servicers, collection agencies, law firms, skip-tracing vendors, credit reporting bodies, payment processors and analytics providers.

Under the proposed test, firms may need to revisit whether each collection, use or disclosure can be justified in context—not merely whether it is technically permitted by a contract, privacy statement or legacy consent clause.

Areas likely to attract scrutiny include:

A collector may have a lawful reason to pursue a valid account, but that does not automatically make every form of data enrichment, profiling, retention or onward sharing fair and reasonable. The draft framework would encourage organisations to document why a particular data practice is needed, what less intrusive alternatives were considered, and how foreseeable consumer harm has been mitigated.

Broader reforms add pressure

The fair-and-reasonable proposal is part of a broader second wave of Privacy Act reform. Other proposed changes would strengthen consent standards, restrict trading in personal information without clear permission, expand the concept of personal information and create a limited right to erasure for large digital platforms.

The expanded definition is particularly relevant to data-driven financial services. Personal information would encompass information that “relates to” an identifiable person, not simply traditional identifiers such as a legal name. Device identifiers, behavioral patterns and AI-generated inferences could therefore fall within the law’s scope. Precise location data would also be treated as sensitive information in the proposed framework.

That matters for collection operations that increasingly rely on data matching, predictive models, digital engagement tools and external enrichment services. A firm that generates an inference about a consumer’s likely financial circumstances or behavior may face privacy obligations even if the information was not entered directly by the consumer.

The government also proposes stronger consent standards. Consent would need to be voluntary, informed, current, specific and unambiguous, according to the draft package. Pre-selected choices, unclear disclosures and “take-it-or-leave-it” terms are unlikely to provide a strong compliance foundation.

Compliance implications

For collection agencies and creditors, the central compliance challenge is likely to be demonstrating—not simply asserting—that a data practice is proportionate.

A sensible preparation plan would include:

1. Map the data lifecycle. Identify what personal data enters collections operations, where it comes from, why it is used, who receives it and how long it is retained.

2. Separate necessity from convenience. A data field may be convenient for targeting, segmentation or recovery optimization without being necessary for the stated purpose.

3. Review vendor arrangements. Contracts with skip-trace providers, cloud vendors, analytics firms, contact platforms and debt buyers should clearly define permitted purposes, permitted data elements, retention requirements and downstream sharing limits.

4. Assess AI and profiling systems. Firms should identify models that infer consumer characteristics, rank accounts, recommend contact channels or tailor settlement offers—and determine whether the inputs, outputs and resulting treatment can be justified as fair and reasonable.

5. Upgrade decision records. The test is likely to reward evidence: documented assessments of consumer expectations, alternatives considered, risk controls and the business purpose for each material processing activity.

6. Align privacy and conduct controls. Privacy governance should not sit apart from hardship, vulnerability, complaints, unfair-practices and customer-treatment programs. A collection practice that appears overly intrusive may present both privacy and conduct risk.

A new accountability model

The reform proposal signals a move away from a consumer-beware model in which individuals are expected to read complex privacy policies and make informed choices every time their data is used. Instead, the organisation collecting or exploiting the information would bear more responsibility for determining whether the practice is appropriate before it occurs.

For the credit and collections sector, that could be consequential. The industry’s legitimate need to verify identities, communicate about accounts, prevent fraud, locate consumers and recover debt will remain. But companies may need to establish that each data-intensive step is aligned with consumer expectations, narrowly tailored to its purpose and supported by meaningful safeguards.

The legislation is still in consultation, not yet law. But the direction is clear: Australian organisations may soon need to prove not only that they obtained data legally, but that using it in a particular way was fair and reasonable in the first place.