Australia’s 2026 privacy reform puts personal information management in focus for community engagement projects. When planning your project, consider what information you need to collect and how you will manage it. Include registration forms, survey questions and downloaded reports in that review.
What is changing?
The draft Privacy Amendment (Personal Data Protection) Bill 2026 proposes fair and reasonable handling of personal information, stronger consent standards and restrictions on trading personal information without clear permission. It also proposes a right to request erasure from large digital platforms, which would not automatically apply to every website.
Consultation closed on 18 September 2026. As of 26 October, the proposals remain subject to government consideration and may change.
Managing personal information in your engagement project
- Only collect what you need. Before adding a registration field or survey question, ask yourself how you will use the answer. For example, you might need a participant’s suburb to understand local views on a park upgrade. Do you also need their full street address?
- Explain the options clearly. In Engagement Hub, participants can unsubscribe or remove their account through the user Dashboard.
This converts them to an offline user, so administrators can still access their information and engagement history through SRM and reporting. Account removal by the user does not delete their personal information.
- Know how to handle a deletion request. If a participant wants their personal details deleted, they can contact the organisation running the engagement platform. The organisation can remove their details from the SRM completely, which will anonymise their past feedback through the deletion process. Make sure your team knows who handles these requests.
- Review what you keep external to your engagement software. If you download data from your engagement platform, downloaded reports and information held outside your platform is included in this legislation. Existing APP 11 obligations generally require covered entities to take reasonable steps to destroy or de-identify information no longer needed for a permitted purpose, subject to exceptions such as legal retention requirements. Therefore, if you have downloaded reports from Engagement Hub containing identifiable personal data, this will also need to be deleted.
As you follow Australia’s 2026 privacy reform developments, review how your team manages participant requests. Engagement Hub already provides account removal and client-managed deletion tools to support this work. To find out more about using these options in your consultation, contact our team.
