Insight

Most business owners assume privacy law does not apply to them if they are small, and right now, for most of them, that assumption happens to be correct. But "right now" is doing some heavy lifting in that sentence. This is general information, not legal advice, if you want a definitive answer for your specific business, talk to a lawyer.

• The core law is the Privacy Act 1988, and the main test is turnover. If your business has annual turnover over $3 million, the Act applies to you, and you need to comply with the 13 Australian Privacy Principles, covering things like what you collect, how you tell people about it, how you store it, and how long you keep it [1].
• Turnover is not the only test. Regardless of size, the Act applies if you are a health service provider, if you trade in personal information, for example selling a customer list, if you are a Commonwealth contractor, a credit reporting body, or you have voluntarily opted in. A lot of small businesses assume they are automatically exempt and are wrong [1].
• The exemption is currently under review. The Government formally agreed in principle in 2023 to remove or narrow the $3 million exemption. It has not happened yet, the first round of reforms in 2024 left it untouched, but the direction is clear enough that building your website and systems as if it is coming is a reasonable bet [2].
• Cookies and tracking are already covered by privacy guidance, separate from the turnover question entirely. If your website uses tracking pixels or similar tools to collect information about visitors, the OAIC has specific guidance on what that means for your obligations [3].
• A statutory tort for serious invasions of privacy has existed since June 2025. This gives individuals the right to personally sue over a serious privacy invasion, independent of any regulator action, regardless of whether your business is otherwise covered by the Act [4].
• A Children's Online Privacy Code is coming. If your website or app could reasonably be used by children or teenagers, new obligations are being finalised and are due to be registered by December 2026 [5].

Even if your business technically sits under the threshold today, that is a legal answer, not necessarily a business one. Customers increasingly expect the same standard of care regardless of your turnover, and the rules are only moving in one direction. If you are building or redesigning a website, this is exactly the kind of requirement worth raising during discovery, rather than retrofitting it after launch. For anything specific to your own business, get proper advice from a lawyer, we are not one.

Citations:

• [1] OAIC — Small business
• [2] Attorney-General's Department — Government response to the Privacy Act Review Report
• [3] OAIC — Tracking pixels and privacy obligations
• [4] Corrs — Australia's ongoing privacy reforms: bolstering Australia's privacy regulatory framework
• [5] OAIC — Children's Online Privacy Code

Still have questions? Give us a call, book a quick meeting, or send us a message to understand more without any pushy sales tactics.