Privacy Act
Small Business Exemption Checker
Australia’s $3M small business exemption is under review. Evaluate whether your organisation is already legally covered under Section 6D carve-outs, and discover what technical controls are required under proposed federal privacy reforms.
This tool provides general informational analysis and does not constitute formal legal advice.
Why Australia’s Small Business Privacy Exemption is Under Reform
When the Privacy Act 1988 was amended in 2000 to cover the private sector, businesses with an annual turnover under $3,000,000 AUD were granted an exemption under Section 6D to prevent excessive administrative burden on small enterprises. In 2000, most small businesses stored paper invoices and desktop spreadsheets.
Today, even a 5-person agency or retail boutique processes hundreds of thousands of customer records through cloud CRMs, payment gateways, marketing automation platforms, and third-party SaaS tools. Recognizing that small businesses are increasingly the entry point for state-sponsored and criminal ransomware syndicates, the Attorney-General's Privacy Act Review concluded that the small business exemption is an unacceptable regulatory vulnerability.
📌The Three Major Post-Reform Realities for Small Businesses:
- • Universal APP Compliance: All businesses will be required to maintain a compliant Privacy Policy, implement reasonable data security (APP 11), and honor customer access and deletion requests.
- • Mandatory Breach Reporting: Breaches involving personal information likely to cause serious harm must be formally notified to the OAIC within 30 days.
- • Severe Financial Liabilities: Penalties for serious or repeated privacy interferences have escalated dramatically, with the OAIC actively enforcing compliance across mid-tier firms.
A Joint Technical and Legal Mandate
Complying with the Australian Privacy Principles is fundamentally a dual discipline:
- • Drafting compliant customer terms and privacy policies.
- • Structuring data processing agreements with enterprise clients.
- • Determining whether a specific incident triggers the legal threshold for mandatory OAIC breach notification.
- • Eliminating customer PII from unencrypted spreadsheets.
- • Enforcing phishing-resistant MFA across email, cloud, and CRM logins.
- • Deploying centralized audit logging and automated backup retention.
- • Hardening web applications and client portals against data exfiltration.
AgenorIT partners seamlessly with Australian legal practitioners, ensuring that when your lawyers draft a privacy policy, your technical infrastructure actually upholds every word of it.
Frequently Asked Questions
Clear regulatory answers regarding Australian privacy law, small business exemptions, and enforcement.
What is changing with the Privacy Act small business exemption under proposed reforms?▾
Historically, Australian businesses with an annual turnover of $3,000,000 AUD or less were exempt from the Privacy Act 1988 under Section 6D. Following the federal government’s Privacy Act Review, the Attorney-General agreed in-principle to remove or significantly narrow this small business exemption. While initial enforcement and regulatory reforms were enacted under the Privacy and Other Legislation Amendment Act 2024, removing the small business threshold remains proposed legislation subject to consultation.
What legally qualifies as "personal information" under Australian law?▾
Under Section 6 of the Privacy Act, personal information is information or an opinion about an identified individual, or an individual who is reasonably identifiable. This includes customer names, personal email addresses, phone numbers, home addresses, IP addresses, credit card details, employee records, and any notes or inquiries submitted via website forms.
How does the Notifiable Data Breaches (NDB) scheme apply to small businesses?▾
If an entity is covered by the Privacy Act, it is mandatory under the NDB scheme to notify the Office of the Australian Information Commissioner (OAIC) and affected individuals within 30 days if a data breach involving personal information is likely to cause serious harm. Failing to notify carries maximum civil penalties under the Privacy Act, with enhanced tiered civil penalty powers introduced in late 2024.
Are certain small businesses already covered regardless of their turnover?▾
Yes. Under Section 6D(4), statutory carve-outs trigger immediate coverage even if your turnover is under $3M AUD. These include: (1) private sector health service providers (doctors, psychologists, allied health), (2) businesses that trade in personal information, (3) Commonwealth contract suppliers, and (4) reporting entities under the AML/CTF Act.
What happens if a business takes no action before privacy reforms take effect?▾
Businesses that fail to implement compliant data handling risk substantial penalties if they experience a cyber breach, uninsurability under Australian cyber liability policies, loss of corporate clients demanding upstream supplier privacy compliance, and formal OAIC regulatory investigations.
Strengthen Your Cyber Resilience Baseline
Meeting the Australian Privacy Principles requires robust security controls. Evaluate your organization against Australia’s gold standard cyber framework: