Seventy-Two Hours: The Privacy Change That Starts a Clock You Can’t See

Right now, the Privacy Act asks organisations to notify a data breach “as soon as practicable”. That phrasing has quietly given a lot of businesses room to move. Under draft legislation released on 31 August, that room disappears.

The Privacy Amendment (Personal Data Protection) Bill 2026, released by the Attorney-General’s Department for consultation, is the second tranche of Australia’s privacy reforms. It runs to roughly forty proposals and is being described by legal commentators as the most significant overhaul of Australian privacy law in more than a decade. The headline change is a fixed deadline: once you become aware there are reasonable grounds to believe an eligible data breach has occurred, you have 72 hours to give the Information Commissioner a statement.

“Seventy-two hours is not very long when the breach surfaces at 4pm on a Friday” stated Robert Buck, Managing Director, Diamond IT.

The detail that matters

The mechanic sits in a new section 26WK. Where a complete statement cannot be assembled in time, an organisation can file an incomplete one, accompanied by written notice identifying what is missing and explaining why it was impossible or impracticable to supply. Individuals must be notified at the same time where practicable. Filing nothing at all within the deadline could attract an infringement notice or a compliance notice.

Here is the part most coverage is skipping. The existing 30-day window to assess a suspected breach survives unchanged. The two-stage structure stays intact, and the hard limit attaches to the second stage only.

That sounds like relief. It is not, quite. It means the question your organisation needs to answer is not “can we report in time”. It is “how quickly do we reach reasonable grounds to believe, and who exactly decides that”. The clock does not start when the regulator says so. It starts inside your own business, at a moment most organisations currently have no way of identifying or evidencing.

“This is not a legal problem. It is a detection and decision problem” added Robert Buck, Managing Director, Diamond IT.

Why 72 hours, and why now

The deadline is not arbitrary. It brings the notifiable data breaches scheme into line with 72-hour reporting periods already used elsewhere in Australian cyber regulation, including certain incidents under the Security of Critical Infrastructure Act 2018 and ransomware payment reporting under the Cyber Security Act 2024.

Read that as convergence rather than a one-off. Regulators are settling on a common tempo, and organisations that build their response capability around it once will be in far better shape than those treating each obligation separately.

“Seventy-two hours sounds generous until you realise the clock starts the moment someone forms a reasonable belief. Most organisations can’t tell you when that moment was, let alone who owned it. That’s the gap to close, and it’s a process gap, not a legal one.” Gavin Hall, Business Technology Consultant Team Lead, Diamond IT

What else is in the Bill

The deadline is getting the attention, but several other proposals will have a broader operational effect.

The definition of personal information widens to expressly cover information that allows an individual to be recognised or singled out, including pseudonyms, identifiers, location data and behavioural patterns. More incidents become notifiable as a result, and data maps drawn up a few years ago will need revisiting.

New categories of sensitive information are added, including genomic information, biometric templates and precise geolocation tracking data. Wearables, workforce tracking and access-control biometrics move into the consent-required category.

APP 11 becomes security and destruction. Organisations must consider destroying information they no longer need, be able to identify that information, and regularly evaluate whether their compliance is actually working. Retention stops being a policy aspiration and becomes an audited obligation.

A controller and processor split is introduced, where a processor acting on documented written instructions does not breach the APPs. Cloud and outsourcing arrangements will need written processing instructions to get the benefit of it.

There is also a new fair and reasonable requirement under APP 3, which means consent alone stops being a complete answer. Organisations will need to justify the handling itself against factors including reasonable expectations, minimisation, genuine choice and proportionality of harm.

What to do in the next 90 days

This is an exposure draft, not law. Submissions close on 18 September 2026, and the final shape may shift. That is a reason to prepare rather than a reason to wait, because none of the following is wasted work regardless of how the Bill lands.

• Get your detection and logging to a standard where you can evidence when you first knew something. If you cannot reconstruct a timeline, you cannot defend one.
• Define who declares a breach. Name the role, not the person, and make sure that decision does not queue behind an executive who is on a plane.
• Pre-draft your notification statement. The 72 hours is not the time to be writing from scratch, and an incomplete statement filed on time beats a complete one filed late.
• Build an escalation path that works outside business hours. Breaches are not considerate about timing.
• Exercise the plan. A plan that has never been run is a document, not a capability.
• Revisit your data map against the wider definitions, and review what you are holding that you no longer need.

How Diamond IT can help

If you are not sure where to start, a Business Resilience Discovery Workshop will help you understand your requirements and right size a solution. From there, we can support you with:

• Cyber Incident Response Plans and Data Breach Response Plans, so the decision to notify has an owner and a process behind it.
• Business Continuity and Disaster Recovery Plans, so the business keeps running while you deal with the incident.
• Cyber Risk Discovery, to find the gaps before someone else does.
• Privacy Impact Assessments, to identify where personal and sensitive information lives and how best to protect it through a combination of people, process and technology controls.

If you would like to talk through what this would mean for your business in practice, get in touch with our team on 1300 307 907, send an email to enquiries@diamondit.com.au or fill out the form below.

This article is general commentary and is not legal advice. Organisations should seek their own advice on how the proposed reforms apply to them.