BSA filed comments with the Attorney-General’s Department (AGD) on the Exposure Draft of the Privacy Amendment (Personal Data Protection) Bill 2026. The submission argues that the proposed exception for information processor does not fully implement the controller-processor distinction, and recommends targeted amendments to ensure that roles and corresponding responsibilities are more clearly allocated. BSA also recommended guidance-first enforcement of the new "fair and reasonable" test, no-fault principles for the 72-hour breach notification requirement, and recalibration of the "large digital platform" thresholds.