Does the Privacy Act apply to my small business?
In short: Often not: the Privacy Act generally does not apply to a business with an annual turnover of $3 million or less. But exceptions apply whatever your turnover, including private sector health service providers, businesses that buy or sell personal information and, since 1 July 2026, AML/CTF reporting entities for the personal information they handle for that work. As at 12 November 2026 the $3 million exemption is still in law; the tranche 2 privacy bill is a consultation draft, not law.
Last checked against the sources listed below. By oowl. General information for Australian small businesses, not legal advice or advice for any particular organisation. Related service: Privacy Act and data breaches.
The basic rule
The Privacy Act 1988 binds Australian Government agencies and most private sector organisations, but a "small business operator" is generally left out. A small business operator is a business with an annual turnover of $3 million or less. The Act deals with this in sections 6D to 6EA, and sets out how turnover is worked out in section 6DA. If your turnover is near the line, ask your accountant which figure counts before you rely on the exemption.
The exceptions that apply whatever your turnover
The OAIC lists the situations where a business with turnover of $3 million or less is still covered, on its rights and responsibilities page. They include:
- private sector health service providers, which can include allied health, psychology and dental practices, and other businesses that hold health information;
- businesses that buy or sell personal information;
- contracted service providers under an Australian Government contract;
- credit reporting bodies, and businesses accredited under the Consumer Data Right;
- residential tenancy database operators, and reporting entities under the anti-money laundering law;
- businesses related to another business that is covered, and businesses that have chosen to opt in.
Check the OAIC page for the full and current list, because each category has its own definition.
The AML/CTF change from 1 July 2026
From 1 July 2026 the anti-money laundering and counter-terrorism financing (AML/CTF) rules apply to more professions, including lawyers, conveyancers, accountants, real estate professionals, dealers in precious stones and metals, and trust and company service providers that provide certain "designated services". The OAIC's guidance for reporting entities says the Privacy Act applies to a reporting entity's handling of personal information for its AML/CTF obligations, even if the business would otherwise be a small business.
Two limits matter. Coverage follows the service you provide, not your job title: AUSTRAC's professional designated services page explains which services count. And the rest of your business is not necessarily pulled in; the OAIC's point is about the personal information handled for AML/CTF purposes. Our Privacy Act quick-start page sets out what that means in practice for professional services firms.
The statutory tort for serious invasions of privacy
A statutory tort for serious invasions of privacy has applied to conduct from 10 June 2025. The OAIC's page on the tort explains it. It is a right for individuals to take a claim to court. The OAIC describes it as broader in application than the rest of the Privacy Act, so it can reach businesses that are not otherwise covered by the Australian Privacy Principles. Whether a particular situation is a serious invasion of privacy is a legal question for a lawyer.
Tranche 2: a draft, not law
On 31 August 2026 the Attorney-General's Department released an exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026 for consultation, with submissions closing on 18 September 2026. The department says the bill remains subject to further consideration by government. A draft is not law and has no start date. Until Parliament passes a change, the $3 million exemption and its exceptions work as described above. We will update this page when that changes.
What to do next
- Work out your turnover on the Act's basis, and write down the figure and the date.
- Go through the exceptions above one by one. Health information and buying or selling personal information are easy to overlook.
- If you are covered, you need a clear privacy policy, a map of the personal information you hold and a plan for suspected data breaches. From 10 December 2026, organisations covered by the Act must also say in their privacy policy where a computer program makes or informs decisions that significantly affect people (OAIC guidance). See what the first 30 days after a data breach look like.
- If you are not covered, the exemption is not a reason to ignore security. Customers, contracts and insurers still ask. Our free email spoofing check shows in a minute whether someone could send fake email as your domain.
This is general information, not legal advice. oowl is not a law firm; for a firm answer on whether the Act applies to you, ask a privacy lawyer.
Sources
- Privacy Act 1988, Federal Register of Legislation (sections 6D to 6EA)
- Privacy Act rights and responsibilities, Office of the Australian Information Commissioner
- Privacy guidance for reporting entities under the AML/CTF Act, Office of the Australian Information Commissioner
- Professional designated services, AUSTRAC
- Statutory tort for serious invasions of privacy, Office of the Australian Information Commissioner
- Privacy reform: consultation on exposure draft legislation, Attorney-General's Department
- Transparency for AI and automated decision-making, Office of the Australian Information Commissioner
oowl writes each guide in its own words from these public sources and rechecks them before changing the date above. Guidance changes, so check the sources for the latest detail. Related guides: The first 30 days after a data breach under the NDB scheme; Cyber insurance questionnaire: how to answer the MFA, backup, EDR and patching questions. All guides: oowl guides.
Common questions
Is the $3 million small business exemption being removed?
Not yet. As at 12 November 2026 it is still in the Privacy Act. The government has released an exposure draft bill for consultation, and says it remains subject to further consideration, but a draft is not law. We check this page against the sources and will update it if the position changes.
I turn over less than $3 million and I'm an accountant. Am I covered?
For the personal information you handle for AML/CTF obligations, yes, if you provide a designated service that makes you a reporting entity. Coverage follows the service, not the job title, so check AUSTRAC's guidance and, if unsure, ask your professional body or a lawyer.
Does the privacy tort apply to small businesses?
The OAIC describes the tort as broader in application than the rest of the Privacy Act, so being under the $3 million threshold should not be assumed to be a shield. It is a claim an individual brings in court, so take legal advice on any specific situation.
If the Act doesn't apply to me, do I still have to report a data breach?
The Notifiable Data Breaches scheme applies to organisations covered by the Privacy Act, so a business that is genuinely outside the Act has no duty under it. You may still want to tell affected people, report a cyber incident to ASD at cyber.gov.au and check what your contracts and insurance require.
Is this legal advice?
No. It is general information based on the sources linked below, last checked on 12 November 2026.
Want a second pair of eyes?
The free security check is a passive look at what your business already exposes to the internet, read from public records only, with a one-page result in plain English.