If your business turns over less than A$3 million a year, the Privacy Act probably does not apply to you, unless you handle health information, trade in personal information, or hold a Commonwealth contract. Whatever your size, the single best move this week is working through the OAIC’s small-business checklist and locking down any sensitive data you hold.
TL;DR:
- Businesses with less than A$3 million annual turnover generally do not need to comply unless they handle health data, trade in personal information, or hold a Commonwealth contract.
- If the Privacy Act applies, a small business must follow key principles such as collecting only necessary data, informing people of its use, and securely protecting personal information.
- Simple, low-cost security measures like updating software, using multi-factor authentication, and encrypting backups can significantly reduce privacy risks for small businesses.
- Certain activities, including trading in personal information or providing health services, disqualify businesses from exemption regardless of turnover.
- Preparing for upcoming privacy reforms involves mapping data, assessing consent practices, and establishing incident response plans to avoid disruption and build trust.
Table of Contents
- How do you check if the Privacy Act covers your business?
- If the Privacy Act applies, what do you actually have to do?
- Exemptions and edge cases that catch businesses out
- What the 2026 privacy reforms mean for you
- A practical checklist for privacy and security basics
- What to do in the first 24 to 72 hours after a suspected breach
- Why we treat privacy as part of cybersecurity, not a separate job
- How TechBug can help you put this into practice
- Sources
- FAQ
How do you check if the Privacy Act covers your business?
Most small businesses assume they are automatically exempt, but the turnover test has specific rules worth checking properly. Your annual turnover is calculated using the same method as your income tax return, and it counts gross income from your business activities, not just profit. A business that dips under A$3 million in one year but was covered previously does not automatically drop out of the Act either, so it pays to check each financial year rather than assume.
Certain activities pull a business into coverage regardless of what it turns over:
- Providing a health service and holding health information, including allied health, naturopathy or fitness businesses that keep client health records.
- Trading in personal information, meaning you buy, sell or disclose it for a benefit, service or advantage.
- Holding a Commonwealth contract, which brings contractual privacy obligations even for a two-person operation.
- Operating as a credit reporting body or a related credit provider.
- Reporting obligations under anti-money-laundering and counter-terrorism financing law.
The OAIC’s small business guidance includes a practical checklist and a voluntary opt-in register for businesses that want to demonstrate compliance even when they are not legally required to.
If the Privacy Act applies, what do you actually have to do?
Coverage means following the Australian Privacy Principles, thirteen rules covering how you collect, use, store and dispose of personal information. For a small business, the practical weight falls on a handful of them: only collecting information you genuinely need, telling people why you are collecting it, not using it for unrelated purposes without consent, letting people access and correct their own records, and destroying or de-identifying data once you no longer need it.
APP 11 is the one that causes the most confusion. It requires “reasonable steps” to protect personal information, and reasonable scales with the size and risk profile of the business. According to the OAIC’s guide to securing personal information, practical and low-cost measures for a small operation include:
- Keeping software patched and operating systems updated on a regular schedule.
- Requiring multi-factor authentication for any account with administrative access.
- Storing encrypted backups offsite, separate from your main network.
- Adding basic security clauses to supplier and subprocessor contracts.
Staff are usually the weakest link, not the software. A receptionist who reuses a password across five systems, or a bookkeeper who emails spreadsheets full of customer details without a second thought, creates more exposure than most technical gaps. Governance does not need to be complicated: a written policy, a nominated privacy contact and an annual refresher for staff cover most of what a regulator expects from a business this size.
Pro Tip: Write down your “reasonable steps” even if they are simple. A documented basic control beats an undocumented good one if the OAIC ever asks.
Exemptions and edge cases that catch businesses out
The small-business exemption is not a blanket shield, and several common activities void it outright. Running a residential tenancy database, holding a Commonwealth contract, trading in personal information, providing health services, or reporting under anti-money-laundering law all bring specific obligations regardless of turnover, as the OAIC’s APP guidelines confirm.
Coverage can also be partial. A business might be exempt for its general retail operation but covered for a side activity, such as a gym that is otherwise under the turnover threshold but runs a naturopathy clinic on the premises.
Watch for these traps:
- Outsourcing payroll or bookkeeping to a third party does not transfer your privacy obligations away from you.
- Shared logins across a team make it impossible to trace who accessed what, which undermines any “reasonable steps” defence.
- Employee records held for employment purposes sit largely outside the Act, but records about job applicants or contractors often do not.
What the 2026 privacy reforms mean for you
The Government’s reform agenda, detailed in the Attorney-General’s Department consultation material, signals a shift away from blanket size-based exemptions towards accountability based on the risk of what you actually do with personal information. The exposure draft proposes a “fair and reasonable” test for handling personal information, a right to erasure for individuals, tighter consent requirements, and higher penalties, along with new controls on trading in personal information.
Businesses that are not yet legally covered but start preparing now avoid a scramble later. The OAIC has flagged that voluntary compliance ahead of reform builds customer trust and reduces the disruption when new rules land.
Sensible preparatory steps, none of which require legal coverage to be worthwhile:
- Map what personal information you hold, where it sits and who can access it.
- Audit your existing consent language against what you actually do with the data.
- Run a basic privacy impact assessment on any higher-risk service, such as one collecting health or financial details.
A practical checklist for privacy and security basics
Most of what regulators expect from a small business is achievable without a compliance department. Work through these in roughly this order:
- Map the personal information you collect, why you collect it, and how long you keep it.
- Cut collection down to what you actually need and update your privacy policy to match reality.
- Set retention and destruction rules so old data does not sit around indefinitely.
- Apply basic ICT controls: patch management, multi-factor authentication, encrypted backups and role-based access so staff only see what their job requires.
- Update supplier and cloud contracts to require subprocessors meet the same baseline security standards you do.
- Train staff on privacy basics and document an incident response plan before you need it.
A six-step data retention approach and a BYOD policy covering personal devices cover two of the gaps businesses most often miss.
Pro Tip: Tackle the contract updates early. Chasing a supplier for a security clause after a breach is much harder than getting it signed upfront.
What to do in the first 24 to 72 hours after a suspected breach
Speed and documentation matter more than perfection in the early hours of a suspected breach.
- Isolate affected systems immediately and preserve logs and evidence rather than wiping anything.
- Notify whoever manages your IT and privacy internally, and start a written timeline of what happened and when.
- Assess whether the incident meets the threshold for an “eligible data breach” under the Notifiable Data Breaches scheme, meaning unauthorised access, disclosure or loss likely to cause serious harm.
- If it does, notify affected individuals and the OAIC as soon as practicable, and keep records of the assessment process itself.
- Bring in professional help for containment and forensic work if the breach involves ransomware, a compromised server or anything beyond what your team can confidently handle alone.
Detailed guidance on containing a breach within 72 hours walks through this sequence in more detail for businesses without an in-house IT security function.
Why we treat privacy as part of cybersecurity, not a separate job
Privacy and security are the same problem viewed from two angles. A ransomware-safe backup, staff trained to spot phishing, and access controls that limit who sees what all reduce privacy risk as a side effect of good security practice. If you are unsure where your business stands, a proper health check is worth the hour it takes.
— Ru
How TechBug can help you put this into practice
Mapping your data, tightening access controls and building an incident response plan takes time most small business owners do not have spare. TechBug’s managed IT services cover the technical side of privacy compliance directly: patching, backups, access management, staff training and emergency response when something goes wrong. Because TechBug works vendor-agnostic, you get advice suited to your setup rather than a push towards a particular product. If you want a straight answer on where your business stands, get in touch with TechBug for a health check or emergency support.
Sources
For rules that may change, go direct to the source: the OAIC’s small business guidance, the NDB quick reference guide, the Attorney-General’s reform consultation, and the Privacy Act 1988 text itself. Businesses handling customer reviews and public-facing data may also find this guide to managing online reputation useful background reading.
This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.
FAQ
Who is exempt from the Privacy Act?
Small businesses with an annual turnover under A$3 million are generally exempt, unless they fall into a listed exception. Businesses providing health services, trading in personal information, holding a Commonwealth contract, or reporting under anti-money-laundering law remain covered regardless of turnover.
Does the Privacy Act apply to all companies?
No. It applies to Australian Government agencies and to organisations above the turnover threshold, plus any business, regardless of size, caught by one of the statutory exceptions. Many exempt businesses still choose to comply voluntarily through the OAIC’s opt-in register.
What are the new privacy laws expected in Australia in 2026?
The Attorney-General’s Department has released consultation material and an exposure draft proposing a “fair and reasonable” handling test, a right to erasure, tighter consent rules, and stronger controls on trading personal information, alongside higher penalties. The reforms broadly shift accountability from business size towards the risk of the activity itself.
What are the main obligations under the Privacy Act?
Covered entities must follow the Australian Privacy Principles, which govern how personal information is collected, used, disclosed, secured and eventually destroyed or de-identified. Businesses covered by the Act also carry duties under the Notifiable Data Breaches scheme to assess and report eligible breaches likely to cause serious harm.