Many small businesses assume privacy laws only apply to larger organisations. In Australia, that is not always the case.

Under the Privacy Act 1988 (Cth), businesses with annual turnover of $3 million or less are generally exempt from the Australian Privacy Principles (APPs). However, important exceptions apply.

When can the Privacy Act apply?

A small business may still be covered if it:

• Provides a health service and holds health information.
• Trades in personal information.
• Provides services under certain Commonwealth Government contracts.
• Operates a residential tenancy database.
• Is covered by particular credit reporting or other regulated activities.
• Is an AML/CTF reporting entity in circumstances covered by the Privacy Act.

Recent changes to Australia's anti-money laundering laws have also brought additional professional services within the AML/CTF regime from 1 July 2026, making privacy compliance particularly relevant for some small professional businesses.

What if the Privacy Act applies?

Covered businesses may need to comply with the Australian Privacy Principles, including requirements concerning:

• Collection and use of personal information.
• Data security.
• Disclosure of information.
• Privacy policies.
• Access and correction requests.
• Data breaches and the Notifiable Data Breaches scheme.

Even if the Privacy Act does not apply, other state, territory, industry or contractual obligations may still govern how a business handles personal information.

Is your business covered?

The $3 million turnover threshold is only the starting point. The nature of your business and the information you handle can determine whether privacy obligations apply.

If you are unsure whether your business is covered, obtaining legal advice can help identify your obligations and reduce the risk of non-compliance.

This article provides general information only and does not constitute legal advice.