Is your small business ready for
Australia’s new privacy laws?
Answer 5 plain-English questions. Get a clear, personalised compliance result in under 2 minutes. Free — no signup required.
Your Business Details
Answer all 5 questions then click Calculate below
The $3M threshold is the current small business exemption line — but it is being phased out entirely by December 2026.
Some industries are regulated regardless of turnover — especially health, finance, and businesses covered under AML/CTF law from July 2026.
Personal information includes: customer names, emails, phone numbers, dates of birth, payment details, booking records, photos, IP addresses, and employee records.
This includes tools you may not think of as “AI”: Mailchimp, Meta Ads, HubSpot, Google Ads, Microsoft 365 Copilot, Xero (automated reporting), AI chatbots, automated scheduling, credit scoring, or any tool that makes automated decisions about people.
Select all that apply. These categories carry stricter consent rules and are an OAIC enforcement priority.
Answered all 5 questions? Click below to see your personalised compliance result.
⚡ Instant result — no email, no signup
Key Deadlines That Apply to You
Penalty Exposure
Serious or Repeated Privacy Breach
Federal Court can impose $50M, three times the benefit obtained, or 30% of adjusted turnover — whichever is highest.
Non-Compliant Privacy Policy
OAIC can issue this directly — no court process required. Applies if your policy is missing, outdated, or does not meet APP 1.
Failure to Notify a Data Breach
Under the NDB scheme, failing to notify affected individuals and the OAIC of an eligible breach attracts separate civil penalties.
Note: Maximum penalties generally apply in serious or repeated cases. Most first-time compliance issues are resolved through OAIC guidance or infringement notices.
Your Likely Obligations
Your Next Steps
Audit your data
List every type of personal information you collect, where it is stored, who can access it, and whether it is shared with third-party services.
Update your privacy policy
Your policy must reflect your actual data practices, name all third-party tools, and disclose any AI or automated decision-making use by December 2026.
Get professional advice
Visit oaic.gov.au or speak with a privacy lawyer to confirm your specific obligations and get a compliant privacy policy drafted.
Take Action Now
📋 Download Free OAIC Compliance Checklist 🔗 OAIC Official Guidance for Small BusinessWhy This Matters Now
Australia’s largest privacy reform in decades
The Privacy Act 1988 is being overhauled. The changes are not minor amendments — they are a fundamental expansion of who is regulated, what is required, and how penalties are enforced.
OAIC launched its first-ever active compliance sweep in January 2026
Real estate agents, pharmacists, car rental companies, licensed venues, and pawnbrokers were targeted first. Proactive enforcement has replaced reactive complaint handling.
About This Tool
How the checker works
The checker maps your five answers against current Privacy Act rules, AML/CTF Tranche 2 industry designations, and the December 2026 reform timeline. Here is what each question measures and why it matters.
Question 1
Annual Turnover
The $3M line is the current small business exemption threshold. Businesses above it are already regulated. Businesses below it may be exempt now — but all businesses are expected to be regulated by December 2026 regardless of turnover when the exemption is removed.
Question 2
Industry
The most critical question. Health services, financial services, and childcare have always been regulated. Real estate agents, accountants, lawyers, and high-value goods dealers became regulated from 1 July 2026 through AML/CTF Tranche 2 — regardless of their turnover.
Question 3
Personal Information
A business collecting zero personal data has minimal obligations even when regulated. Most businesses collect data without realising — customer names, emails, booking info, IP addresses, and employee records all count.
Question 4
AI and Automated Tools
From 10 December 2026, regulated businesses using automated decision-making must disclose this in their privacy policy. This catches many common tools — Mailchimp, Meta Ads, HubSpot, Google Ads, and automated CRM features all potentially qualify.
Question 5
Sensitive Data Categories
Specific categories carry stricter consent requirements and higher security obligations. They are also enforcement priorities for the OAIC. Children’s data additionally triggers the new Children’s Online Privacy Code by December 2026.
Critical Dates
The 2024–2026 Privacy Act timeline
These are the legislated dates that determine when obligations begin. Missing a deadline increases your liability — it does not reduce it.
10 December 2024
Privacy and Other Legislation Amendment Act 2024 — Royal Assent
Most significant reform in 30 years. Introduced the statutory tort, new APP 1 obligations, expanded OAIC enforcement powers, and the $66,000 direct infringement notice power.
June 2025
Statutory Tort for Serious Invasions of Privacy Commences
Individuals gained the right to sue organisations directly in court for serious privacy invasions — without going through the OAIC first.
January 2026
OAIC Launches First-Ever Active Compliance Sweep
The OAIC began proactively auditing businesses. First targets: real estate agents, pharmacies, car rental companies, licensed venues, and pawnbrokers.
1 July 2026
AML/CTF Tranche 2 — 100,000+ Businesses Newly Regulated
Accountants, tax agents, lawyers, conveyancers, real estate agents, and high-value goods dealers brought into the Privacy Act regime regardless of turnover.
10 December 2026
Full Exemption Removal + AI Disclosure + Children’s Code
Small business exemption removed entirely. New APP 1.7–1.9 mandate AI and automated decision-making disclosure. Children’s Online Privacy Code registered.
Who Is Affected
Which Australian industries are regulated
Regulation depends on your industry and turnover. Some sectors are regulated regardless of size.
Health Services
Always Regulated
Financial Services
Always Regulated
Childcare / Education
Always Regulated
Real Estate Agents
From 1 July 2026
Accountants / Tax Agents
From 1 July 2026
Lawyers / Conveyancers
From 1 July 2026
High-Value Goods
From 1 July 2026
Retail / eCommerce
By December 2026
Hospitality / Cafes
By December 2026
Trades / Construction
By December 2026
| Industry | From | Status | Reason |
|---|---|---|---|
| Health services | Always | Always | Health records — APP 3 sensitive category |
| Financial services / AFSL/ACL | Always | Always | ASIC / Privacy Act linkage |
| Childcare / Schools | Always | Always | Sensitive data about minors |
| Real estate agents | 1 Jul 2026 | AML Tranche 2 | AUSTRAC — AML/CTF Act expanded |
| Accountants / Tax agents | 1 Jul 2026 | AML Tranche 2 | Reporting entity — AML/CTF Act |
| Lawyers / Conveyancers | 1 Jul 2026 | AML Tranche 2 | Designated service provider |
| High-value goods dealers | 1 Jul 2026 | AML Tranche 2 | Cash transaction reporting — AUSTRAC |
| Retail / eCommerce | Dec 2026 | Exemption Removal | Small business exemption removed |
| Hospitality / Food | Dec 2026 | Exemption Removal | Small business exemption removed |
| Construction / Trades | Dec 2026 | Exemption Removal | Small business exemption removed |
Your Legal Obligations
The Australian Privacy Principles explained simply
Regulated businesses must comply with 13 Australian Privacy Principles. The four most commonly relevant for small businesses are shown first.
Transparent Privacy Policy
You must have a clear, up-to-date privacy policy describing what you collect, how you use it, and who you share it with. From December 2026 it must also disclose AI use.
Notification at Point of Collection
You must notify individuals at the point of data collection — what you are collecting, why, and who you might share it with.
Security of Personal Information
You must take reasonable steps to protect personal information from misuse, loss, and unauthorised access or disclosure.
Access and Correction
Individuals have the right to request access to personal information you hold about them and ask you to correct inaccurate data.
Anonymity and Pseudonymity
Where practicable, individuals must be able to interact with you anonymously or using a pseudonym.
Collection of Solicited Information
You may only collect personal information that is reasonably necessary for your business functions. Sensitive information requires explicit consent.
Unsolicited Personal Information
If you receive personal information you did not request, you must assess whether you could lawfully have collected it. If not, destroy or de-identify it.
Use or Disclosure
You may only use personal information for the primary purpose it was collected for. You need consent for anything else.
Direct Marketing
You may only use personal information for direct marketing with consent, or for current customers with similar offers. Always provide an easy opt-out.
Cross-Border Disclosure
Before sending personal information to overseas recipients — including cloud services like Google, Xero, or Mailchimp — you must ensure they protect data to APP standards. Disclose this in your privacy policy.
Government Identifiers
You must not use government identifiers (TFN, Medicare, passport) as your own customer identifier unless required by law.
Quality of Personal Information
Take reasonable steps to ensure personal information is accurate, up-to-date, and complete — especially before making decisions about individuals.
Correction of Personal Information
Individuals may request correction of inaccurate data. You must take reasonable steps to correct it and notify third parties where practicable.
Common Questions
Frequently asked questions from Australian SMBs
Sources and References
Where this information comes from
Office of the Australian Information Commissioner (OAIC)
oaic.gov.au/privacy/privacy-for-organisations/small-businessPrimary regulatory authority — official SMB guidance.
Privacy and Other Legislation Amendment Act 2024
legislation.gov.auSource legislation for the statutory tort, APP 1 amendments, infringement notice powers, and penalty increases.
AUSTRAC — AML/CTF Tranche 2 Reforms
austrac.gov.auAML/CTF reforms that brought accountants, lawyers, real estate agents and high-value goods dealers into the regulated population from 1 July 2026.
Attorney-General’s Department — Privacy Act Review
ag.gov.auGovernment department responsible for the small business exemption removal and overall Privacy Act reform program.
General information only
This guide provides general information about the Privacy Act 1988 (Cth) and its reforms. It does not constitute legal advice. The law is subject to change. Seek independent legal advice from a qualified Australian privacy lawyer. Last updated: July 2026 · v1.1