The lower house passed the Data Protection (Amendment) Bill past midnight on Tuesday, capping three days of debate that ran well beyond the scheduled sitting hours. The bill tightens consent requirements for companies collecting personal data and creates a dedicated grievance officer role at every firm handling data above a set threshold.

Opposition members had pushed for an independent appeals body rather than leaving oversight to a government-appointed authority. The government agreed to a compromise: a statutory review of the appeals mechanism after eighteen months, to be tabled before both houses.

Compliance obligations begin in January, giving companies a four-month runway. Industry bodies welcomed the delay but said smaller firms would need clearer guidance on what counts as sensitive personal data under the new rules.