DxtraBETA
Back to blog
GuidesAustraliaSmall BusinessRegulations July 2026Updated 10 min read

The Small Business Guide to Australia's Privacy Act in 2026

Australian privacy law for small businesses in 2026: why the small business exemption still exists, the exceptions that override it, and what changed.

An Australian Privacy Act document beside a laptop showing a newsletter sign-up form

Start with the thing most articles get wrong

If you have been reading about Australian privacy law, you have probably seen the claim that the small business exemption has been removed. It has not. As of the current version of the Privacy Act 1988 (Cth) — Compilation No. 104, dated 4 June 2026 — section 6D still exempts most businesses with an annual turnover of A$3 million or less from the Act's obligations. That is the law in force, not a transitional arrangement and not something that quietly lapsed.

That matters, because a lot of owners have spent worry on the wrong problem: a deadline that does not exist, while the thing that genuinely puts them in scope — an exception in the same section — goes unnoticed. The exemption is also narrower than the turnover number suggests, and there are now ways to be on the wrong end of a privacy problem that have nothing to do with whether the regulator can reach you.

Who this applies to

Australia's main privacy law is the Privacy Act 1988 (Cth), built around thirteen Australian Privacy Principles, usually shortened to the APPs. They are the operative rules: how you may collect personal information, what you must tell people, how you can use and disclose it, how you secure it, and what rights people have to see and correct it. The regulator is the Office of the Australian Information Commissioner, or OAIC, and an organization bound by the APPs is called an APP entity.

Above A$3 million in annual turnover, you are an APP entity and the rest of this post is your baseline. Under it, you are probably exempt — but check the exceptions first, because several catch ordinary small businesses.

You are covered regardless of turnover if you are a health service provider that holds health information. That is broader than it sounds: a physiotherapy practice, a small dental clinic, a solo psychologist, a gym collecting injury histories on its intake form. You are covered if you trade in personal information — that is, you buy or sell it — so selling a customer list on exit, or taking money to pass contact data to a partner, puts you in scope. You are covered if you are a credit reporting body, or a contracted service provider under a Commonwealth contract, which sweeps in small consultancies that would never think of themselves as regulated. And you are covered if you opt in voluntarily, which some businesses do because enterprise customers ask for it.

Read that list against what your business actually does. The gym owner who added a health questionnaire two years ago is the one most likely to be surprised.

What you actually have to do

If you are an APP entity, these take most of the time. If you are exempt, treat them as the standard customers already assume you meet.

Be open about how you handle personal information. The APPs require a clearly expressed, up-to-date privacy notice (Australia's law calls this an APP privacy policy), available free of charge, describing what you collect, why, who you disclose it to, whether it goes overseas, and how someone can complain. The failure mode is rarely a missing policy — almost everyone has one — but a template describing a business you are not running. If yours does not mention the analytics tool, the email platform, or the offshore support contractor you actually use, it is not doing its job.

Collect only what you need, and tell people at the time. Personal information should be collected because it is reasonably necessary for what you do, and people must be told at or around the point of collection who you are, why you are collecting it, and who you will pass it to. Sensitive information, including health information, generally requires consent. In practice this means auditing your forms: the checkout field asking for date of birth when you have no reason to know it is a liability, not a feature.

Use information for the purpose you collected it for. If you took an email address to fulfill an order, using it for a marketing campaign is a different purpose, and the rules on secondary use and direct marketing both apply. People must be able to opt out easily, and you have to honor it. This is where most complaints about small organizations start.

Secure what you hold, and get rid of what you do not need. You must take reasonable steps to protect personal information from misuse, interference, loss, and unauthorized access — and to destroy or de-identify it once you no longer need it. The second half is the one people skip. Old customer databases, exported spreadsheets, and a decade of form submissions in an inbox are all risk you are choosing to keep.

Know what happens when data goes overseas. If you disclose personal information to an overseas recipient — and most cloud tools involve exactly that — you generally have to take reasonable steps to ensure they handle it consistently with the APPs, and you often stay accountable for what they do. Write down which tools store data where.

Have a breach plan before you need one. Under the Notifiable Data Breaches scheme, an APP entity that suspects an eligible data breach must assess it within 30 days, and where the breach is likely to result in serious harm, must notify the OAIC and the affected individuals as soon as practicable. Thirty days sounds generous until the clock starts on a Friday and nobody knows who is responsible.

Be able to answer access and correction requests. People can ask what personal information you hold about them and ask you to fix it. You need a route for the request to arrive, a way to find the data across your systems, and a habit of responding within a reasonable time. If you cannot search your own records, you cannot answer.

What changed

The Privacy and Other Legislation Amendment Act 2024 passed in December 2024 and is the most significant change in years. Four parts matter here.

First, it created a statutory tort for serious invasions of privacy, which commenced in June 2025. This is the one to understand, because an individual can sue you directly, independently of the OAIC — and the small business exemption does not shield you from being sued. Being outside the Act is not the same as being outside legal risk.

Second, it introduced new criminal offenses for doxxing, the malicious publication of someone's personal details. Third, it directed the OAIC to develop a Children's Online Privacy Code. Status: not yet in force; registration due by 10 December 2026. The OAIC released an exposure draft of the code on 31 March 2026, and consultation on it closed on 5 June 2026. Whatever you may read elsewhere, the code is not yet law. The 10 December 2026 date is the deadline for the OAIC to register it, and when its obligations will start for businesses has not been settled.

Fourth, it expanded enforcement powers and added new civil penalty tiers. Be careful with any dollar figure you see online: Commonwealth penalties are set in penalty units, and the value of a unit rose from A$330 to A$364 on 1 July 2026, so totals published before that date are stale. The numbers move, and they move upward.

Further tranches of reform have been flagged, including proposals that could narrow or remove the small business exemption. On 31 August 2026 the government released an exposure draft of the next reform bill, the Privacy Amendment (Personal Data Protection) Bill 2026, for consultation that closed on 18 September 2026. It is a draft, not law, and it does not change the small business exemption. None of it is enacted. Treat it as a reason to build habits that survive a change in the law, not a deadline to panic about.

Common mistakes

The most expensive mistake is assuming turnover settles the question. Owners check the A$3 million figure, conclude they are exempt, and never read the exceptions — which is how a clinic or gym ends up regulated without knowing it.

The second is treating a privacy notice as a document rather than a description. A notice that does not match your real tools and data flows is worse than a short plain one, because it puts in writing a promise you are not keeping.

The third is confusing exemption with immunity. The statutory tort, Australian Consumer Law, promises made in your own contracts, and the plain commercial damage of a breach all reach businesses the Privacy Act does not.

The fourth is collecting sensitive information casually — health details on an intake form, or identity documents kept "just in case". The fifth is having no owner: privacy belongs to someone specific, or it belongs to nobody at 5pm on a Friday.

Where Dxtra fits

Dxtra generates a privacy program from a questionnaire about your business: a privacy notice, a cookie notice, consent records, processing records, a public Transparency Center, and a process for handling data subject access requests. It covers 500+ privacy obligations across 140+ countries and starts at about A$14 (US$10) a month. It will not tell you whether your gym counts as a health service provider — that is a judgment call for an adviser — but it handles the documentation layer.

Where to start

Do three things now. Write down every system that holds customer data and where it lives, spreadsheets included. Check your business against the exception list above and get a straight answer on whether you are an APP entity. Then name the person who owns a breach if one happens, and give them half an hour to write down what they would do.

After that, look at what your website tells the public, because that is the part customers and regulators can see without asking. Dxtra's free scan reads your site's public pages in under a minute with no signup and returns a risk band with findings mapped to named sources, so you can see what is missing before you decide what to fix.

Run your free privacy scan →

Sources

Current as of 15 October 2026. Figures, fees and commencement dates move; check the linked source before you rely on any of them.

This article is general information, not legal advice. Rules change; confirm anything that matters with the Office of the Australian Information Commissioner (oaic.gov.au) or a qualified adviser before you rely on it.

Ready to get compliant?

Start your privacy program today — from $10/month.

Get StartedProduct Tour