Privacy Act tranche 2: what changes for your database?

Nothing has changed yet. Tranche 2 of the Privacy Act reforms is an exposure draft, the Privacy Amendment (Personal Data Protection) Bill 2026, released by the Attorney-General's Department on 31 August 2026. Consultation closed on 18 September. As at 16 October 2026 the bill has not been introduced to Parliament, it has no commencement date, and the department says it "remains subject to further consideration by government". Any of it could change.

If it passes in its draft form, four things hit a marketing database. Every direct marketing message would need to say how to opt out. Sharing personal information for direct marketing, including handing a list to someone else, would count as "trading" it and need the person's consent. Every collection, use and disclosure would have to be "fair and reasonable in the circumstances". And consent would have to be voluntary, informed, current, specific and unambiguous. The draft says the fair and reasonable rules apply to information you already hold, whenever you collected it.

That last point is why a big, half-dormant HubSpot database matters. Contacts you cannot explain today become harder to justify tomorrow. The good news is that the work worth doing now is the same work the Spam Act already asks for: record where each contact came from and what they agreed to, clear out what you cannot explain, and put an unsubscribe link in every commercial email. This is general information about a draft bill, not legal advice.

What is actually in the tranche 2 draft?

The draft runs to six schedules and law firms count about 40 proposals. These are the ones that touch marketing, quoted from the exposure draft itself:

The small business exemption stays in the draft for businesses turning over $3 million or less, but a small business that trades personal information would fall outside it, as one that sells or buys it does today. Most 50 to 250 person businesses turn over more than that and are covered already.

One detail is easy to miss. The new APP 7 does not apply to the extent the Spam Act 2003 or the Do Not Call Register Act 2006 applies, the same as today. Your marketing email stays under the Spam Act. The new rules bite hardest on everything else: letters, targeted ad audiences built from your contact list, and data you pass to other businesses.

What already applies today?

A lot of the draft restates obligations you already have, so none of the work below is wasted if the bill changes.

1. 10 June 2025Statutory tort for serious invasions of privacy in effect. Already law.
2. 31 August 2026Attorney-General's Department releases the tranche 2 exposure draft, the Privacy Amendment (Personal Data Protection) Bill 2026.
3. 18 September 2026Consultation on the exposure draft closes.
4. 10 December 2026Privacy policies must explain automated decisions from this date. Separate from tranche 2.
5. No date yetTranche 2 bill introduced to Parliament. Not introduced as at 16 October 2026, and the wording could still change.
6. No date yetTranche 2 commences. The draft has no commencement date.

Source: Attorney-General's Department, Privacy Reform consultation page and exposure draft. Filled dots have happened, the coloured dot is a fixed date still to come, dashed dots have no date.

• The Spam Act 2003. ACMA's rules: you need consent before you send a commercial email or SMS, express or inferred, and "it's up to you to prove" it. ACMA tells you to keep a record of who gave consent, when and how. Every message must identify you, and its unsubscribe must work for at least 30 days and be honoured within 5 working days. Buying a list does not move that responsibility to the seller.
• APP 7 as it stands. The OAIC's guidelines: you can use personal information for direct marketing if the person would reasonably expect it and you give a simple way to opt out. If you got the information from a third party, you generally need consent. People can ask where you got their details, and you must tell them unless that is impracticable or unreasonable.
• The statutory tort for serious invasions of privacy. In effect since 10 June 2025, it lets individuals take court action for serious invasions of privacy. It is aimed at serious conduct, but it is already law.
• Automated decision transparency from 10 December 2026. Privacy policies will need to explain computer programs that use personal information to make decisions that could significantly affect people. We cover it in our guide to the 10 December 2026 change.

Why does a dormant database carry the most risk?

On discovery calls we hear the same picture. One buyer told us their 31,000 contact database "sits dormant". Another had 162,000 contacts sitting at the Lead lifecycle stage. Those databases were built from years of imports, trade show scans, purchased lists and old forms, and nobody wrote down where most of it came from.

Under the draft, the fair and reasonable test applies to holding and using those records from the day it commences, whatever year they arrived. The questions are simple. Would this person expect to hear from you? Can you show where you got their details and what they agreed to? Do you still need them? For a contact last active in 2019 who came from a bought list, the honest answer to all three is usually no.

There is a cost side too. HubSpot charges for marketing contacts, and a database that big is usually paying to hold people it should not be emailing. Before you try to win any of them back, read how to wake up dead HubSpot contacts without breaking the Spam Act, and score them first so you know which ones are worth the effort.

What should you do in HubSpot now?

Each step below is right under the Spam Act and APP 7 today, and holds up whichever way the final bill goes.

1. Turn on data privacy settings, knowing what it changes. In Settings, Privacy & Consent, the Data privacy settings switch is account wide and needs Super Admin or Edit account defaults permission. It turns on the cookie consent banner, adds a privacy section to new forms and scheduling pages (existing forms need it added by hand), adds unsubscribe links to sales one-to-one and sequence emails for users without them, and shows banners on contacts with no legal basis. HubSpot also offers a "Limit emails to contacts with a subscription" switch. Its legal basis options are GDPR terms, such as legitimate interest, but they still give you a field to record why you hold each contact. Test it on a copy of a busy form before you switch it on.

2. Record consent source and date on every contact. Subscription types hold whether a contact is opted in, opted out or unspecified for each kind of email, and the contact record's History tab shows their subscription activity. When you subscribe someone by hand you pick a legal basis and write an explanation. Add two custom properties of your own, consent source and consent date, so you can answer ACMA's "who, when and how" without digging.

3. Audit every imported and purchased list. HubSpot's Record source property is set to Import for imported records, and Record source detail 1 holds the import file's name. Build a segment on it, then group by file. Any list you bought, scraped or cannot trace gets marked as non-marketing until you can show consent. Record source was created in February 2024 and backfilled four years, so older records may be blank. Treat blank as untraced.

4. Suppress or delete contacts you cannot justify. Set non-marketing first, delete second. A standard delete sits in the recycle bin for 90 days. A permanent delete is one record at a time, cannot be restored, and is meant for privacy requests. HubSpot also has a "Delete inactive contacts automatically" setting under Privacy & Consent, available on all plans, which defaults to 365 days with no session, email open or engagement. Run the segment first and read who would go before you turn it on.

5. Check the opt-out in every email, sales emails included. In Settings, Objects, Activities, the Unsubscribe links section can apply one setting to all users. Accounts created after 4 September 2024 have it on by default. Older accounts often do not, and with data privacy settings off, HubSpot does not add unsubscribe links to one-to-one and sequence emails by default. Emails sent straight from Gmail or Outlook never get one, even with the HubSpot extension, so check your reps' templates too.

6. List where personal information goes. Enrichment tools, ad platforms you upload audiences to, AI tools that read contact records, integrations and agencies. For each one, write down what it receives and whether it only acts for you or uses the data for itself. Under the draft that is the line between a carved-out processor and a trade that needs consent. Our post on WhatsApp messages in HubSpot workflows covers the consent side of another channel.

Data moves out, rule is clear in the draftNot settled yet

Source: Exposure Draft Privacy Amendment (Personal Data Protection) Bill 2026, new APP 4.2 on trading. A draft, not law.

Your tranche 2 readiness checklist

What should you wait on?

Do not rebuild your privacy policy or your consent forms around the draft wording yet. The definitions, the exceptions and any transition period could all move before the bill is introduced. Do the database work now, because it is required already and it shrinks the job later. When the bill is introduced, check three things against the final text: the trading definition and its processor carve-out, how current consent has to be, and whether there is a grace period before it starts.

Frequently asked questions

Is Privacy Act tranche 2 law yet? No. As at 16 October 2026 it is an exposure draft, the Privacy Amendment (Personal Data Protection) Bill 2026. Consultation closed on 18 September 2026, and it has no commencement date.

Will I need an unsubscribe link in every marketing email? You already do. The Spam Act requires a working unsubscribe in every commercial email and SMS, honoured within 5 working days. The draft would extend an opt-out to every direct marketing communication by any means.

Can I still upload my contact list to an ad platform under the draft? The draft treats disclosure for direct marketing purposes as trading, which needs consent unless an exception applies, such as a provider acting on your behalf. Whether a given platform fits that exception will depend on the final text and what the platform does with the data.

Does tranche 2 apply to contacts I collected years ago? In the draft, yes. The fair and reasonable rules would apply to information held on or after commencement, whenever it was collected.

Does turning on HubSpot's data privacy settings make me compliant? No. It adds tools such as a cookie banner, consent text on new forms and unsubscribe links on sales emails, but you still need records of where each contact came from and what they agreed to.

Sources

• Privacy Reform, Consultation on Exposure Draft legislation, Attorney-General's Department, for dates, status and the exposure draft.
• Exposure Draft Privacy Amendment (Personal Data Protection) Bill 2026, Attorney-General's Department, for APP 3, APP 4, APP 7, APP 11, trading, consent and application provisions.
• Privacy Act reforms: tranche 2 proposals, McCullough Robertson, for a summary of the draft and the consultation dates.
• Key proposals in the draft Personal Data Protection Bill 2026, Clayton Utz, for commentary on consent and destruction.
• APP guidelines, Chapter 7: direct marketing, OAIC, for current APP 7.
• Rights and responsibilities, OAIC, for the small business exemption.
• Statutory tort for serious invasions of privacy, OAIC, for the 10 June 2025 start.
• Avoid sending spam, ACMA, for consent records and unsubscribe rules.
• Manage data privacy settings in your HubSpot account, HubSpot Knowledge Base, for what the switch does.
• Manage your contacts' messaging subscriptions, HubSpot Knowledge Base, for subscriptions and history.
• View and use record source properties, HubSpot Knowledge Base, for tracing imports.
• Manage unsubscribe links for one-to-one emails, HubSpot Knowledge Base, for sales and sequence emails.
• Manage data retention policy settings for inactive contacts, HubSpot Knowledge Base, for automatic deletion.
• Delete CRM records and Perform a permanent delete in HubSpot, HubSpot Knowledge Base, for the recycle bin and permanent deletes.

---

Want your HubSpot consent records and imports checked before the bill is introduced? See our RevOps and HubSpot work, or talk to us.