While the APRA is still a “discussion draft,” it aims to provide a national data privacy and security framework outlining consumer rights and data management requirements. Under the APRA, companies would have to limit the types of consumer data they collect, retain, and use, allowing only data needed to operate their services.