Does the Privacy Act apply to your small business? Not always, but check

Is a small business covered by the Privacy Act?

Often not, but it depends. The OAIC says a small business has annual turnover of $3 million or less, and that small businesses that are not covered and have not opted in do not have to comply with the Act. But several kinds of small business are covered whatever their turnover.

Who is covered whatever their size?

The OAIC lists these, among others: health service providers, businesses trading in personal information, Commonwealth contractors, residential tenancy database operators, credit reporting bodies, businesses covered by anti-money laundering rules, Consumer Data Right accredited businesses, businesses related to a covered business, and businesses that have opted in.

Does that include physios and clinics?

Yes. The OAIC describes health service providers as businesses providing services relating to physical, emotional, psychological or mental health, and names allied health professionals, medical practitioners and complementary therapists among examples. They must comply with the Australian Privacy Principles whatever their turnover.

Can a small business choose to be covered?

Yes. The OAIC says a small business can opt in, after which it must comply. For businesses that are not covered, the OAIC still recommends protecting personal information as best practice.

Will the exemption stay?

A law firm's summary of the August 2026 exposure draft for the next round of Privacy Act reforms says the draft keeps the exemption, and that the Government agreed in principle to remove it but deferred that step. That is a draft, not law, and it had not been introduced to Parliament when the summary was written.

Why this matters for being found

Our reading: the way you describe your business online makes promises about how you handle information, for example on a contact form. Those promises should be true whether or not the Act covers you. Our article on the 10 December rule covers what changes for businesses that are covered.

What does this article not tell you?

• Whether your business is covered. Check your turnover and activities with the OAIC page or your legal adviser.
• How the law might change after the draft reforms.
• This is general information, not legal advice.

Sources

1. Small business · OAIC, undated page. Read by us on 27 October 2026.
2. Australia's Privacy Act reforms: inside the second tranche · LK Law, 15 September 2026. Law-firm summary, read by us on 30 September 2026.

We keep what a source says separate from our reading of it. If a source is from another country or a different date, we say so. We are not giving advice, and nothing here is a promise of rankings, citations or sales.