Australia's privacy law is in the middle of its biggest overhaul in decades. The first set of changes passed in 2024, including the automated decision-making transparency rules that start on 10 December 2026. Now the second, larger set has arrived in draft. On 31 August 2026, the Attorney-General's Department released an exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026, often called "tranche 2", for consultation.
The draft isn't law yet. But it signals where privacy rules are heading, and some proposals would change how health businesses, including dental practices and the AI tools they use, can collect and use personal information.
This article is general information based on the exposure draft and published legal commentary. The draft may change before any bill is introduced. Get advice for your practice.
Key takeaways
- The tranche 2 exposure draft was released on 31 August 2026, with consultation closing on 18 September 2026. It's not yet law, and no introduction date has been confirmed.
- The centrepiece is a proposed fair and reasonable test: collecting, using or disclosing personal information would need to be fair and reasonable in the circumstances, not just consented to or permitted.
- Commentators describe around 40 proposals, including a controller/processor framework, restrictions on trading personal data, a right to erasure aimed at large platforms, and stronger breach duties.
- Dental practices are already covered by the Privacy Act because they provide health services, regardless of turnover.
- The 10 December 2026 automated decision-making changes from the first tranche are already law and still need attention now.
How tranche 2 fits with the earlier changes
Tranche 1 (passed in 2024) included a statutory tort for serious invasions of privacy, stronger OAIC enforcement powers and new transparency requirements for automated decisions that take effect on 10 December 2026. See the December 2026 privacy change for dental practices.
Tranche 2 is the larger package, covering many recommendations from the government's Privacy Act Review that weren't in the first tranche.
The main proposals
A fair and reasonable test
The draft would require that collection, use and disclosure of personal information be fair and reasonable as well as lawful. Factors include whether a reasonable person would expect the handling, and whether the organisation is transparent about its purposes. Legal commentators note that consent alone wouldn't be enough if the handling isn't objectively fair and reasonable.
For practices, that means asking not just "did the patient agree?" but "would a reasonable patient expect us to use their information this way?" That applies, for example, to using patient data in new AI tools or for marketing.
Controllers and processors
The draft proposes a framework distinguishing organisations that control personal information from those that process it on their behalf. That's relevant to the relationship between a practice and its software, cloud and AI vendors. See patient data and AI vendors.
Restrictions on trading personal data
The draft includes limits on trading in personal information.
Stronger breach and security duties
Commentary describes stronger obligations around security and data breaches, building on the existing Notifiable Data Breaches scheme. See our cyber security checklist.
Right to erasure
A right to erasure is proposed, which commentators describe as aimed mainly at large platforms. How it would interact with health record retention requirements is something practices should watch.
What it could mean for AI in practices
AI tools often use personal information in new ways: transcribing calls, summarising appointments, analysing images and personalising messages. A fair and reasonable test would push practices and vendors to:
- Be clear with patients about how AI uses their information
- Avoid uses patients wouldn't reasonably expect, such as training AI models on patient data without clear disclosure
- Clarify contractual roles and responsibilities with AI vendors
IntelliDent doesn't use your patient data to train AI models, and lists its subprocessors publicly.
What practices should do now
You don't need to comply with a draft. But these steps make sense under current law and prepare you for change:
- Meet the 10 December 2026 deadline for automated decision-making disclosures in your privacy policy.
- Map your data flows: what patient information you collect, where it goes and which vendors process it.
- Apply a reasonableness check to new uses of patient data, especially AI and marketing.
- Review vendor contracts for privacy, security and breach notification terms.
- Watch for the bill's introduction and any changes from the exposure draft.
Frequently asked questions
Is tranche 2 law yet?
No. It's an exposure draft. A bill still needs to be introduced and passed by Parliament.
Does the small business exemption matter for dental practices?
No. Health service providers, including dental practices, are already covered by the Privacy Act regardless of turnover.
When will tranche 2 start?
No date has been confirmed. Any commencement would follow passage of a bill, possibly with transition periods.
Next steps
Focus first on the 10 December 2026 changes, then map how patient data flows through your systems and AI tools. For a broader look at AI governance, read our guide to AI in dentistry, or book a demo to see how IntelliDent handles patient data.