Legally, not every small business is required to have a privacy policy, but almost every business with a website needs one. Businesses with an annual turnover of $3 million or less are usually exempt from the Privacy Act, with some important exceptions. That said, from a business perspective, the majority of platforms, clients and customers you deal with will expect a privacy policy, regardless of legal requirements.
This is a question I'm asked a lot, and my answer hasn't changed: every business should have a privacy policy. What has changed is the law around it. Some small businesses that were exempt a year ago no longer are; new rules start on 10 December 2026, and the Government has released draft legislation for the next round of reform.
I've set out below how to work out where your business stands, legally; what your privacy policy needs to say, and what's changing.
Does the Privacy Act apply to my small business?
The Privacy Act 1988 (Cth) and its 13 Australian Privacy Principles apply to businesses with an annual turnover of more than $3 million. If your turnover is $3 million or less, you're generally exempt, unless your business falls into one of the exceptions.
You're covered by the Privacy Act, whatever your turnover, if your business:
provides a health service, which is defined broadly and can include allied health, wellness and some coaching practices that assess or support a person's health
buys or sells personal information, for example by trading mailing lists
provides services under a Commonwealth government contract
is a reporting entity under the anti-money laundering laws, which since 1 July 2026 includes many lawyers, accountants, conveyancers and real estate agents
is related to a larger business that is covered
has chosen to opt in to the Privacy Act.
The OAIC lists a handful of other, more specialised categories too, such as credit reporting bodies and operators of residential tenancy databases.
The anti-money laundering change is the one that catches people out. If your business became a reporting entity on 1 July 2026, you're now covered by the Privacy Act in full, even if you were exempt before. I explain who's captured in new AML/CTF obligations: what Australian business owners need to know.
Will the small business exemption be removed?
It's widely expected to. The Privacy Act Review recommended removing it, but the draft privacy reform bill released on 31 August 2026 leaves it in place for now. That could change as the bill progresses, so if you're near the line, or growing, it's sensible to start operating as if the Privacy Act applies to you.
Do I need a privacy policy if my business is exempt?
My recommendation is yes. Being exempt from the Privacy Act doesn't mean you can do without a privacy policy:
The tools you use require one. Google Analytics, Meta's advertising tools and the app stores all require you to have a privacy policy if you use them.
Your clients expect one. Larger clients often ask about privacy in their procurement or onboarding process, and a missing policy can slow a deal or end it.
It builds trust. Even a simple newsletter sign-up collects personal information. Telling people what you do with it, clearly, is part of operating professionally.
It builds credibility. Consumers are becoming more aware of less legitimate businesses, so a properly drafted privacy policy can be an effective tool to separate your business from them.
Privacy rights now reach further. Since 10 June 2025, individuals can sue for a serious invasion of their privacy, and that right isn't limited to businesses covered by the Privacy Act.
Is there a downside to having one? No. So ask yourself: why wouldn't my business have one?
What must a privacy policy include?
If the Privacy Act applies to you, Australian Privacy Principle 1 sets out what your privacy policy must cover:
The kinds of personal information you collect and hold.
How you collect it and how you hold it.
Why you collect, use and disclose it.
How people can access their personal information and ask you to correct it.
How people can complain about a privacy breach, and how you'll deal with the complaint.
Whether you're likely to disclose personal information overseas and, if practicable, to which countries.
From 10 December 2026, some businesses will also need to explain how they use automated decisions (more on that below).
Personal information is broader than most people think. A name and email address from a newsletter sign-up is personal information, and so is anything that can reasonably identify someone. And "overseas" catches more than you might expect: many cloud storage, email marketing, scheduling and AI tools store data outside Australia.
Your policy also needs to be free and easy to find, which in practice means linked from your website footer and from any form where you collect personal information.
Even if you're exempt, these six points are the right structure for your privacy policy. They're what clients, platforms and regulators expect to see.
What's changed in privacy law?
10 June 2025: a new right to sue for serious invasions of privacy. It applies to individuals and businesses, not only those covered by the Privacy Act.
January 2026: the OAIC's first sweep of privacy policies, checking around 60 organisations.
1 July 2026: lawyers, accountants, conveyancers, real estate agents and others become anti-money laundering reporting entities, and so are covered by the Privacy Act, whatever their turnover.
31 August 2026: a draft bill for the next round of reform is released for consultation. The small business exemption stays for now.
10 December 2026: new privacy policy rules on automated decisions, for businesses covered by the Privacy Act.
The OAIC can now issue infringement notices for privacy policies that don't meet the requirements, without going to court, so a policy that's out of date is a real risk for businesses the Act covers.
The 10 December 2026 rules on automated decisions
From 10 December 2026, if you use a computer program that relies on personal information to make a decision, or to substantially help make one, and that decision could significantly affect someone's rights or interests, your privacy policy must say:
what kinds of personal information the program uses
what kinds of decisions are made by the program alone
what kinds of decisions the program substantially helps to make.
For a small business, that might be software that automatically approves or declines applications, screens job candidates, or decides who is offered payment terms. If you use AI or automated tools to make decisions about clients, customers or staff, now is the time to check what they do and update your policy.
The next round of reform
The draft bill released on 31 August 2026 would replace several of the current principles with a single test: is your handling of personal information fair and reasonable in the circumstances? It would also shorten the time to report a serious data breach to 72 hours. The Government intends to introduce the bill by the end of 2026, and the detail may change before then. I'll update this guide as it does.
What are the most common privacy policy mistakes?
The ones I see most often:
Copying someone else's policy. It describes their business, not yours, and copying it may not only infringe their copyright, it may be inaccurate for your business.
A policy that doesn't match what you actually do. Your policy has to reflect the tools you really use: your email platform, booking system, CRM, analytics, and any AI tools.
Set and forget. Every new tool, new service or move into a new market can change what your policy needs to say. Review it at least once a year.
Forgetting AI. If you or your team put client information into AI tools, your policy should say so, and your processes should make sure it's handled appropriately.
Collecting more than you need. The less personal information you hold, the less you have to protect, and the less damage a data breach can do.
Hiding it. If people can't find your policy, it isn't doing its job.
A tailored privacy policy is part of my core legal package for service-based businesses, alongside your client service agreement and website terms. Book an introduction call if you'd like yours reviewed or drafted, or read more about what legal advice costs.
This article provides general information only and does not constitute legal advice. Your obligations depend on your specific circumstances.
Frequently asked questions
Does my small business need a privacy policy in Australia?
If your business is covered by the Privacy Act, yes, it's a legal requirement. Most businesses with an annual turnover of $3 million or less are exempt, but there are exceptions. Even if you're exempt, you'll often still need one, because tools like Google Analytics and Meta's advertising platforms require it and clients expect it.
Is my small business exempt from the Privacy Act?
Usually, if your annual turnover is $3 million or less. You're not exempt if you provide a health service, trade in personal information, are a reporting entity under the anti-money laundering laws, or fall into one of the other categories listed by the OAIC.
What must a privacy policy include?
The kinds of personal information you collect, how you collect and hold it, why you collect, use and disclose it, how people can access and correct it, how they can complain, and whether you disclose it overseas. From 10 December 2026, it must also explain any significant automated decisions.
What changes for privacy policies on 10 December 2026?
If you use a computer program that relies on personal information to make, or substantially help make, decisions that could significantly affect people, your privacy policy must describe the kinds of personal information used and the kinds of decisions involved.
Will the small business exemption be removed?
It's widely anticipated to be removed. But the draft privacy reform bill released on 31 August 2026 keeps the small business exemption, for now. The Privacy Act Review recommended removing it, so it may change in future.
Further reading
Legal requirements for running a small business in Australia: the compliance guide
When can I send an email or SMS? How to avoid breaking spam rules
New AML/CTF obligations have commenced: what Australian business owners need to know
Legal advice for small business owners in Australia: the complete guide
