Services / Privacy Act compliance
Privacy Act compliance assessments
Know what the 10 December 2026 changes mean for your business, where your current privacy policy falls short, and what it takes to close the gap.
What is changing
The Privacy and Other Legislation Amendment Act 2024 made the largest set of changes to Australian privacy law in years, and they are arriving in stages. The part most small businesses have not prepared for takes effect on 10 December 2026: if you use automated systems to make decisions that significantly affect someone, your privacy policy has to say so, and explain what personal information those systems use.
A Children’s Online Privacy Code is also due to be registered by that date. Separately, a statutory right to sue for serious invasions of privacy is already in force, which changes the calculation for every business holding personal information.
Most privacy policies on Australian small business websites were written before any of this, and many were copied from a template that was never accurate for the business in the first place.
Who this is for
- Businesses collecting customer details through a website, booking system or app.
- Practices and service businesses holding client records.
- Anyone using automated tools, scoring, or AI to help decide who gets what.
- Businesses being asked privacy questions by a larger client, insurer or tender panel.
Many small businesses fall under the small business exemption today. That exemption has been under active review, and it does not protect you from a client, insurer or tender panel that expects you to have your house in order.
What I assess
- What you actually collect, compared with what you think you collect and what you tell people you collect.
- Your privacy policy, against the requirements in APP 1 and the new disclosure obligations.
- Collection notices on forms, bookings and sign-ups, which is where gaps turn up most often.
- Consent and use: whether what you do with the information matches the purpose you collected it for.
- Third parties and overseas disclosure: the platforms, plugins and providers in your stack, and whether they are disclosed.
- Retention: whether you have a stated retention period and whether you follow it.
- Data breach readiness: whether you could meet your obligations under the Notifiable Data Breaches scheme if something went wrong tomorrow.
- Automated decision-making: where it exists in your business, and what you will need to disclose.
What you get
A written report naming what is already compliant, what is not, and what each gap would take to close. Where you want the gaps closed, I quote a fixed price before starting, and deliver the updated policy, collection notices and supporting documentation as an evidence pack you can hand to a client, insurer or regulator who asks.
Reports are written in plain English. You should be able to read yours and know exactly what to do next without needing it translated.
Assessed against: Privacy Act 1988 (Cth) and the Australian Privacy Principles
Common questions
Does the Privacy Act apply to my small business?
Businesses with an annual turnover of $3 million or less are currently exempt from the Privacy Act unless an exception applies, such as providing health services, trading in personal information, or being a contracted service provider to the Commonwealth. The exemption has been under review, and plenty of businesses that are technically exempt still need to demonstrate good privacy practice to win work. Part of the assessment is working out which category you are actually in.
What happens on 10 December 2026?
The automated decision-making transparency requirements take effect, and the Children's Online Privacy Code is due to be registered. If your business uses automated systems to make decisions that significantly affect people, your privacy policy will need to explain that.
Is this legal advice?
No. I assess your systems and documents against published standards, identify gaps, and give you documentation showing what was found and fixed. I am not a law firm. Where a question needs legal advice, you should get it from a qualified legal practitioner.
Related services
Start with a free check
I run a short external diagnostic and send you what I find. No obligation, and no pitch if there is nothing worth fixing.
I assess your systems and documents against published standards, identify where the gaps are, and give you the documentation to show you have addressed them. This is not legal advice.