AMLCompliant, home

Free checker · Australia's Privacy Act 1988 · general information, not legal advice

Does the Privacy Act apply to my business?

Last checked 25 September 2026 against the Privacy Act 1988 compilation C2026C00227 (compilation date 4 June 2026) and the Privacy and Other Legislation Amendment Act 2024

Six yes-or-no questions. Each answer is a link to the next question or to a result, with the section of the Act behind it. There is no form on this page, so nothing you choose is sent to us.

Australia's Privacy Act 1988 (Cth), not the United States Privacy Act of 1974. Answer each question for your whole business, then follow the link. This is a guide, not legal advice: you decide, and the Act decides in the end.

s 6D(1) the law, read in the authorised textOAIC guidance the regulator's published guidance, which is not law

Turnover over $3,000,000?

A business is a small business if its annual turnover for the previous financial year was $3,000,000 or less.1 s 6D(1) But you are not a small business operator if a business you carry on has had turnover over $3,000,000 in any financial year since you started it, or you are a company related to a company that carries on a business that is not small.2 s 6D(4) s 6D(9) Turnover is income, not profit.3 s 6DA

A health service, and health information?

Do you provide a health service to another person and hold health information about them, other than in an employee record?2 s 6D(4)

Both parts must be true. Only the cases in steps 1 to 4 take a business out of the exemption. Holding identity documents, biometrics or other sensitive information is not one of them.

Trading in personal information?

Do you disclose personal information about someone to anyone else for a benefit, service or advantage, or pay or give a benefit to collect personal information about someone from anyone else?2 s 6D(4) It does not count if you do it with the person's consent, or because a law requires or authorises it.4 s 6D(7) s 6D(8)

A Commonwealth contract, or credit reporting?

Are you a contracted service provider for a Commonwealth contract, whether or not you signed it, or a credit reporting body?2 s 6D(4)

Supplying services to a business that is covered by the Act does not count on its own. Only a Commonwealth contract does.

An AML/CTF reporting entity?

Do you provide a service listed in the AML/CTF Act, such as brokering a property sale, conveyancing, holding client money for a transaction, setting up companies or trusts, or providing a registered office address? Not sure? Use our free check.

Automated decisions about people?

Does a computer program make decisions for you, or do something substantially and directly related to making them, where the decision could reasonably be expected to significantly affect a person's rights or interests, and the program uses their personal information? Examples include software that screens tenants, scores credit or rejects applications.5

Your results

Applies now

The whole Act very likely applies

You are not a small business operator, so the Act binds you as an organisation.2 s 6D(4) That means the Australian Privacy Principles, including:

  • a clearly expressed, up-to-date privacy policy with the contents APP 1.4 lists;6
  • collection notices when you collect personal information (APP 5);6
  • the Notifiable Data Breaches scheme: take all reasonable steps to complete an assessment of a suspected eligible data breach within 30 days, and notify the Commissioner and affected people as soon as practicable if one has happened.7 s 26WH s 26WK s 26WL

Work through the checklist. Penalties are set out in Privacy Act penalties.

Go to step 6

Applies now

The Act applies to your AML/CTF activities

If a small business operator is a reporting entity because of something done in its small business, the Act applies to its activities for the purposes of, or in connection with, the AML/CTF Act, Regulations and Rules as if it were an organisation.8 s 6E(1A) The OAIC's guidance for reporting entities, updated 28 August 2026, says:9 OAIC

  • this covers collecting and storing personal information for customer due diligence, monitoring, reporting and record keeping;
  • you need a privacy policy and collection notices that explain how you handle personal information for AML/CTF. The OAIC publishes a template collection notice;
  • the AML/CTF Act does not require you to keep copies of identity documents. Destroy or de-identify copies once you no longer need them, and keep the details you need instead, such as the document type and the result of verification.

Your other activities stay outside the Act unless another case applies. More: AML tranche 2 and the Privacy Act.

Go to step 6

Probably exempt

The small business exemption probably applies

On your answers you are a small business operator, so most of the Act does not bind you.1 s 6D(1) Three things still matter:

  • The statutory tort has no turnover threshold, so it can reach a small business too. See the statutory tort card.
  • Tax file numbers. If you hold tax file number information, the tax file number rules bind you, and the data breach scheme covers that information.10 s 18 s 26WE
  • Changes. Check again if your turnover grows or your services change. You can also choose to be treated as an organisation.11 s 6EA

Step 6 does not apply to you: the automated-decision rule is about the privacy policy of a business the Act binds.

Proposed changes are not law. On 31 August 2026 the Attorney-General's Department released an exposure draft Bill for consultation, which closed on 18 September 2026. The draft keeps the small business exemption and re-words the trading cases.12 AGD No Bill to change the exemption has been introduced to Parliament.

Go to the last card

From 10 December 2026

Say how you use automated decisions

From 10 December 2026 your privacy policy must say:5

  • the kinds of personal information used by those programs;
  • the kinds of decisions the programs make on their own; and
  • the kinds of decisions where a program does something substantially and directly related to making the decision.

It applies to decisions made once the rule starts on 10 December 2026, even if the program was set up, or the information used, earlier.5 From that day a missing disclosure can lead to an infringement notice or a compliance notice.13 s 13K More: automated decision-making disclosure.

Go to the last card

Everyone

The statutory tort has no turnover threshold

Since 10 June 2025 an individual can sue another person who invades their privacy by intruding on their seclusion or misusing information about them. The person must have had a reasonable expectation of privacy, the invasion must be serious and intentional or reckless, and the public interest in their privacy must outweigh any competing public interest.14 It has no turnover threshold, though it has exemptions, for example for journalists. The OAIC says it is "broader in application than the Privacy Act".15 OAIC The courts decide these claims, not the OAIC.15

Damages for non-economic loss, with any exemplary or punitive damages, are capped at the greater of $478,550 and the defamation cap.14 More: the statutory tort.

Where to go next

Use the free checklistRead: does it apply to a small business?

AMLCompliant is published by Wani Meridian Pty Ltd, an independent private business. We are not affiliated with, or endorsed by, the Office of the Australian Information Commissioner, the Attorney-General's Department or any other government body. This checker is general information, not legal advice.

Independent. Not affiliated with, or endorsed by, AUSTRAC or the Australian Government.

Sources

Law is quoted from the authorised text on the Federal Register of Legislation, opened 25 September 2026. OAIC and Attorney-General's Department pages are guidance, not law. They open in a new window, and linking to them does not mean either body endorses this page.

  1. Privacy Act 1988 s 6D(1) to (3), compilation No. 104 (C2026C00227). legislation.gov.au/C2004A03712/latest/text

  2. Privacy Act 1988 s 6D(4) and (9); s 6C(1), definition of "organisation".

  3. Privacy Act 1988 s 6DA.

  4. Privacy Act 1988 s 6D(7) and (8).

  5. Privacy and Other Legislation Amendment Act 2024 (C2024A00128), Schedule 1, Part 15, items 87 to 89 (Australian Privacy Principles 1.7 to 1.9), commencing 10 December 2026 under s 2 table item 7. legislation.gov.au/C2024A00128/latest/text The examples are ours.

  6. Privacy Act 1988, Schedule 1, Australian Privacy Principles 1.3, 1.4 and 5.

  7. Privacy Act 1988 ss 26WE, 26WH, 26WK and 26WL.

  8. Privacy Act 1988 s 6E(1A).

  9. OAIC, "Privacy guidance for reporting entities under the Anti-Money Laundering and Counter-Terrorism Financing Act", updated 28 August 2026. Guidance, not law. oaic.gov.au

  10. Privacy Act 1988 ss 11(1), 18 and 26WE(1).

  11. Privacy Act 1988 s 6EA.

  12. Attorney-General's Department, "Privacy reform: consultation on exposure draft legislation", and the Exposure Draft Privacy Amendment (Personal Data Protection) Bill 2026. An exposure draft is not law. consultations.ag.gov.au

  13. Privacy and Other Legislation Amendment Act 2024, Schedule 1, item 87, which adds APP 1.7 to s 13K(1)(b) of the Privacy Act 1988 from 10 December 2026.

  14. Privacy Act 1988, Schedule 2, clauses 7(1), 11(5) and 15 (journalists); compilation endnote 3 ("sch 2: 10 June 2025").

  15. OAIC, "Statutory tort for serious invasions of privacy". Guidance, not law. oaic.gov.au

Questions

Is this legal advice?

No. It is general information that maps your answers to the sections of the Privacy Act 1988. The OAIC's pages are linked from each result. If your answer matters to a decision, ask a lawyer.

Why does AML/CTF status matter?

If a small business operator is an AML/CTF reporting entity, the Privacy Act applies to its AML/CTF activities as if it were an organisation, whatever its turnover (s 6E(1A)). The OAIC's guidance for reporting entities, updated 28 August 2026, explains what that means in practice.

Do you store my answers?

No. There is no form. Each answer is an ordinary link to another part of this page, so nothing you choose is sent to us.