Privacy Act 2026
Does the Australian Privacy Act Apply to Your Small Business in 2026? (Take This 2-Minute Test)
A plain-English test for Australian small businesses: does the Privacy Act 1988 apply to you in 2026? Turnover is not the whole story — the statutory tort, sensitive information and AML Tranche 2 can pull you in regardless of size. Free, date-aware checker inside.
"We're a small business, so the Privacy Act doesn't apply to us." It is one of the most common — and most dangerous — assumptions Australian owners make in 2026. The truth is that what you do matters more than how big you are. This is a quick, plain-English test, and at the end you can run a free checker that gives you a tailored answer.
(To be clear: this is about Australia's Privacy Act 1988, not the US Privacy Act of 1974.)
The $3M rule, and why it isn't the whole story
The Privacy Act has long exempted most small businesses with an annual turnover of $3 million or less — roughly 95% of Australian businesses, about 2.3 million entities. So far, so reassuring. But the exemption has always come with carve-outs, and the 2026 reform wave adds more pressure on top. (Source: IAPP.)
The four ways a small business gets pulled in anyway
1. You're in a category that's covered regardless of turnover. The exemption does not apply if, for example, you provide a health service and hold health information, you trade in personal information (buy or sell it for a benefit), or you are a contracted service provider under a Commonwealth contract. Several other categories apply too.
2. The statutory tort applies to everyone. Since 10 June 2025, an individual can sue directly for a serious invasion of privacy. This is a court action, not an OAIC matter, and it can reach businesses the Privacy Act itself does not cover. Turnover is irrelevant. (Source: OAIC.)
3. AML/CTF Tranche 2 captures you from 1 July 2026. If you are a real estate agent, conveyancer, lawyer, accountant, trust and company service provider, or a dealer in precious metals and stones, you become a reporting entity from 1 July 2026. Once you are, the Privacy Act applies to the personal information you collect for AML/CTF — regardless of turnover. This is the certain route for around 100,000 small firms. See AML Tranche 2 just dragged your agency into the Privacy Act. (Source: AUSTRAC.)
4. You use automated decision-making. If you use software or AI to make decisions that significantly affect people, an ADM disclosure obligation lands on 10 December 2026 — and your privacy policy has to be compliant to carry it. More in are you making automated decisions?
What about the proposed exemption removal?
You may have read that the small-business exemption "is being scrapped." Be careful: that removal is proposed only. As of June 2026 no Bill has been introduced and there is no commencement date. It is a "watch and prepare" item — not a current obligation. The honest summary is in the $3 million exemption explained.
The 2-minute test
Ask yourself:
- Is my annual turnover over $3 million?
- Do I provide a health service or hold health/other sensitive information?
- Do I buy or sell personal information for a benefit?
- Am I a contractor to a covered entity or under a Commonwealth contract?
- Am I in a Tranche 2 profession (real estate, legal, accounting, conveyancing, TCSP, precious-metals dealer)?
- Do I use automated decision-making that significantly affects people?
If you answered "yes" to any of the first four, the Privacy Act very likely applies to you now. A "yes" to Tranche 2 means it applies from 1 July 2026. A "yes" to ADM means the 10 December 2026 disclosure deadline is yours.
The free checker turns these into a tailored result with the right deadlines and links — run it below.
General information only, not legal or compliance advice. Current to June 2026; confirm your obligations at oaic.gov.au or with a qualified adviser. The removal of the $3M small-business exemption is proposed and not yet law. Last verified: 8 June 2026.
Run the free ML/TF risk assessment →