Guide
Privacy Act & Small Business: What Australian SMBs Need to Know in 2026
The latest reform bill keeps the small business exemption, but that doesn't mean you're off the hook. Many small businesses are already covered, and new obligations are landing through 2026. Here's what you need to know.
Are you covered by the Privacy Act right now?
The current small business exemption excludes businesses with under $3 million annual turnover from most Privacy Act obligations, unless they fall into one of these categories:
- ✓Annual turnover over $3 million
- ✓Health service provider (GP, dentist, allied health, hospital, pharmacy)
- ✓Businesses that trade in personal information
- ✓Contracted service providers to the Australian Government
- ✓Credit reporting bodies
- ✓Operators of a residential tenancy database
- ✓AML/CTF reporting entities such as lawyers, accountants and real estate agents (for AML/CTF activities, from 1 July 2026)
If any of these apply, the Privacy Act applies to your business right now. If not, you're probably exempt from the APPs, but the statutory tort for serious invasions of privacy still applies to you.
What has already changed
Tranche 1 of the reforms passed in December 2024. These changes are law now or have fixed start dates:
Statutory tort for serious invasions of privacy
In force since June 2025. Individuals can sue over serious invasions of privacy, and it applies regardless of turnover.
Higher penalties and OAIC powers
Penalties for serious interferences with privacy went up, and the OAIC gained new enforcement tools including infringement notices.
AML/CTF reporting entities covered
From 1 July 2026, lawyers, accountants, real estate agents and other newly regulated AML/CTF businesses are covered for their AML/CTF activities, whatever their turnover.
Automated decision-making transparency
From 10 December 2026, privacy policies must explain when personal information is used in automated decisions that significantly affect individuals.
Children's Online Privacy Code
The OAIC is developing a code for online services likely to be accessed by children, due by December 2026.
What the Tranche 2 draft proposes
On 31 August 2026 the Attorney-General's Department released the exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026. Key proposals include:
Fair and reasonable test
Collecting, using and disclosing personal information would need to be fair and reasonable, even where you have consent.
Stronger data breach obligations
Data breach response requirements would be strengthened, including faster notification.
Updated definitions
Core definitions, including personal information and consent, would be overhauled.
Right to erasure on large platforms
Individuals could require large digital platforms to erase their personal information.
Not in the draft: removal of the small business exemption, removal of the employee records exemption, and a direct right of action. The draft could change before it goes to Parliament. Check the OAIC and Attorney-General's Department for updates.
The 13 Australian Privacy Principles
The APPs are the core of the Privacy Act. They set out how organisations must handle personal information across the full lifecycle.
APP 1
Open and transparent management
Must have a clearly expressed privacy policy
APP 2
Anonymity and pseudonymity
Must give individuals the option to remain anonymous where possible
APP 3
Collection of solicited information
Can only collect what is reasonably necessary for your functions
APP 4
Dealing with unsolicited information
Must destroy or de-identify unsolicited personal information you're not entitled to collect
APP 5
Notification of collection
Must notify individuals at or before the time of collection
APP 6
Use or disclosure of information
Can only use or disclose for the primary purpose of collection or with consent
APP 7
Direct marketing
Strict limits on using personal information for direct marketing
APP 8
Cross-border disclosure
Accountability for information disclosed overseas
APP 9
Government identifiers
Restrictions on using government identifiers like TFNs
APP 10
Quality of information
Must take reasonable steps to ensure accuracy
APP 11
Security of information
Must protect personal information from misuse, loss, and unauthorised access
APP 12
Access to information
Individuals have a right to access their personal information
APP 13
Correction of information
Must correct personal information that is inaccurate, out of date, or misleading
Common questions
Is my business currently covered by the Privacy Act?
Your business is covered NOW if: (1) your annual turnover exceeds $3 million, (2) you are a health service provider, (3) you trade in personal information, (4) you provide services to the Australian Government, (5) you operate as a credit reporting body, or (6) you are an AML/CTF reporting entity (for your AML/CTF activities, from 1 July 2026). If none of these apply, the small business exemption currently protects you.
What is the small business exemption?
The Privacy Act 1988 contains an exemption for businesses with annual turnover under $3 million. These businesses are generally not required to comply with the Australian Privacy Principles. However, this exemption does not apply to businesses in certain sectors regardless of size.
Is the small business exemption being removed?
Not in the current draft. The exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026, released on 31 August 2026, keeps the $3 million small business exemption. The Privacy Act Review recommended removing it, so it could come back in a later reform. Meanwhile, AML/CTF reporting entities have been covered for their AML/CTF activities since 1 July 2026, and the statutory tort for serious invasions of privacy applies regardless of turnover.
What do the Australian Privacy Principles require?
The 13 Australian Privacy Principles (APPs) cover: how you collect personal information, whether you need consent, how you store and secure data, when you can disclose information to third parties, how you handle data breaches, and what rights individuals have to access and correct their information.
What counts as 'personal information'?
Personal information is broadly defined under the Privacy Act as any information or opinion about an identified individual, or an individual who is reasonably identifiable. This includes names, addresses, email addresses, phone numbers, financial information, health information, and in many cases IP addresses and device identifiers.
Find out where your business stands
The free PrivacyScore assessment takes 3 minutes. No account required. You'll know exactly which APPs you need to work on, and whether the small business exemption currently applies to you.
Start free assessmentFree · No account required · Results instant