Does the Privacy Act apply to my business in 2026?

The Privacy Act has a small-business exemption for turnover of $3 million or less — but it is not the whole story.

Some sectors are covered regardless of turnover; AML/CTF Tranche 2 captures others from 1 July 2026.

Sensitive information (health, biometrics and similar) carries stricter rules and can remove the exemption.

Software or AI that makes — or substantially helps make — decisions significantly affecting a person (credit, pricing, screening, risk scoring).

Buying or selling personal information removes the small-business exemption.

Contracted service providers under a Commonwealth contract — or providers to a covered entity — can be brought in.