# Does the Privacy Act apply to your small business? Not always, but check URL: https://aura8.ai/blog/does-the-privacy-act-apply-to-small-business/ Updated: 3 November 2026 > Businesses with annual turnover of $3 million or less are generally outside the Privacy Act, but the OAIC says health service providers, including allied health professionals, and several other kinds of business are covered whatever their turnover. A small business can also opt in. ## Is a small business covered by the Privacy Act? Often not, but it depends. The OAIC says a small business has annual turnover of $3 million or less, and that small businesses that are not covered and have not opted in do not have to comply with the Act. But several kinds of small business are covered whatever their turnover. $3 millionThe turnover line. Some businesses are covered even below it. ## Who is covered whatever their size? The OAIC lists these, among others: health service providers, businesses trading in personal information, Commonwealth contractors, residential tenancy database operators, credit reporting bodies, businesses covered by anti-money laundering rules, Consumer Data Right accredited businesses, businesses related to a covered business, and businesses that have opted in. ## Does that include physios and clinics? Yes. The OAIC describes health service providers as businesses providing services relating to physical, emotional, psychological or mental health, and names allied health professionals, medical practitioners and complementary therapists among examples. They must comply with the Australian Privacy Principles whatever their turnover. ## Can a small business choose to be covered? Yes. The OAIC says a small business can opt in, after which it must comply. For businesses that are not covered, the OAIC still recommends protecting personal information as best practice. ## Will the exemption stay? A law firm's summary of the August 2026 exposure draft for the next round of Privacy Act reforms says the draft keeps the exemption, and that the Government agreed in principle to remove it but deferred that step. That is a draft, not law, and it had not been introduced to Parliament when the summary was written. ## Why this matters for being found Our reading: the way you describe your business online makes promises about how you handle information, for example on a contact form. Those promises should be true whether or not the Act covers you. Our article on the 10 December rule covers what changes for businesses that are covered. ## What does this article not tell you? - Whether your business is covered. Check your turnover and activities with the OAIC page or your legal adviser. - How the law might change after the draft reforms. - This is general information, not legal advice. ## Is your website ready for AI? Our free check reads your site the way AI tools do, tests four AI crawlers live and scores nine dimensions out of 100. Run the free check ## Sources - Small business · OAIC, undated page. Read by us on 27 October 2026. - Australia's Privacy Act reforms: inside the second tranche · LK Law, 15 September 2026. Law-firm summary, read by us on 30 September 2026. We keep what a source says separate from our reading of it. If a source is from another country or a different date, we say so. We are not giving advice, and nothing here is a promise of rankings, citations or sales. ## What should I read next? ARTICLE ### Six practices for using AI responsibly Read the articleARTICLE ### No AI Act: what the National AI Plan means Read the articleARTICLE ### Fake reviews and misleading claims Read the article ## Questions ### Is a physiotherapy clinic covered by the Privacy Act? The OAIC says health service providers are covered whatever their turnover, and lists allied health professionals among its examples. ### Can a small business opt in to the Privacy Act? Yes. The OAIC says it can, and must then comply with the Australian Privacy Principles.