Does the Privacy Act apply to small businesses in Australia?

Most businesses with an annual turnover of $3 million or less are exempt from the Privacy Act. However, several exceptions override the exemption regardless of turnover, including health service providers, businesses that trade in personal information, credit reporting bodies, and contractors delivering Australian Government contracts.

Do I need a privacy policy if my business is exempt?

Not as a legal requirement under the Privacy Act if the exemption genuinely applies. In practice most exempt businesses still publish one, because insurers, tender panels, larger clients and app stores ask for it, and because the Australian Consumer Law still prohibits misleading statements about how you handle customer information.

Does the Privacy Act apply to a medical or allied health practice?

Yes. Health service providers are covered by the Privacy Act regardless of annual turnover. This includes GPs, dentists, physiotherapists, psychologists, allied health practices and most other businesses providing a health service and holding health information.

Does the Privacy Act apply to my small business?

Last updated: 13 October 2026

The short answer

If your business has an annual turnover of $3 million or less, you are probably a “small business operator” and exempt from the Australian Privacy Principles. That exemption covers the large majority of Australian businesses.

The catch is that the exemption falls away entirely if any one of several exceptions applies, and it falls away for the whole business, not just the part that triggered it.

The exceptions that override the exemption

Turnover stops mattering if your business:

provides a health service and holds health information. This is the big one. It covers GPs, dentists, physiotherapists, psychologists, chiropractors, allied health practices, gyms running health assessments, and many others. A sole practitioner with modest turnover is covered.
buys or sells personal information. Trading in personal information for a benefit removes the exemption. Selling or renting a customer list is the obvious case.
is a credit reporting body, or handles tax file number information in certain ways.
provides services under an Australian Government contract. Plenty of small consultancies in Canberra fall in here without realising the privacy consequence of the contract they signed.
is related to a larger business that is itself covered.
has opted in to being treated as an APP entity.

Assessed against: Privacy Act 1988 (Cth), section 6D (small business operators) and the Australian Privacy Principles.

Why exempt businesses still publish a privacy policy

Being exempt from the Privacy Act is not the same as having no obligations and no reason to care. Most exempt businesses we assess still publish a policy, for four practical reasons.

The Australian Consumer Law still applies. If you tell customers their details are safe, or imply you do not share them, that statement must be true. Misleading conduct does not require the Privacy Act.
Insurers and tender panels ask. Cyber insurance questionnaires and government or corporate procurement forms routinely request your privacy policy. “We are exempt” is a slow answer.
Platforms require it. App stores, payment providers and advertising platforms often make a published policy a condition of use.
Turnover changes. The exemption is tested against current turnover. A good year can move you across the line without anyone noticing until something goes wrong.

Is the exemption going away?

Removing the small business exemption has been recommended and remains under government consideration, but it has not been legislated. The reforms commencing 10 December 2026 do not themselves remove it.

The sensible reading is that the exemption is a timing advantage rather than a permanent position. Businesses that use the time to document what they collect and where it goes will have a short task ahead of them if it is removed. Businesses that treat the exemption as the end of the conversation will have a long one.

This guide is general information about published standards. It is not legal advice and does not take your circumstances into account.

A five-minute self-check

Is your annual turnover above $3 million? If yes, the Act applies. Stop here.
Do you provide any kind of health service and keep records about people's health? If yes, the Act applies regardless of turnover.
Do you hold a contract with an Australian Government agency? If yes, check the privacy clauses in it.
Do you sell, rent or trade customer lists? If yes, the Act applies.
Are you part of a group where another entity is covered? If yes, check whether you are related for the purposes of the Act.

Five noes and the exemption probably applies to you today. It is still worth knowing what you collect and where it goes, because that is the work either way.

Not sure which side of the line you are on?

Send me your website address. I run a short external check and send you what I find, including whether anything on your site suggests the exemption does not apply. No charge, no obligation.

Get a free check Privacy Act assessments