For years, most small Australian businesses have quietly relied on a simple rule: if your annual turnover is under $3 million, the Privacy Act mostly doesn’t apply to you. No formal privacy policy, no data breach plan, no structured consent process required.

That exemption is being wound back. Multiple rounds of reform are progressively bringing more small businesses under full Privacy Act obligations — with real dates attached and real penalties for getting it wrong. If your website collects names, emails, phone numbers, or payment details through a contact form, an online booking system, or a checkout, this is worth twenty minutes of your attention now rather than a scramble later.

What’s Actually Changing

This is happening in stages rather than as one single cut-off date, which is part of why it’s easy to miss:

• Specific regulated industries — including real estate agencies, accounting and law firms, conveyancers, and dealers in high-value goods — have already started losing their exemption as anti-money-laundering rules expanded to cover them.
• The broader small business exemption itself is on track to be removed later in 2026, which would bring the vast majority of remaining small businesses — regardless of industry — under the same rules that currently only apply to larger companies.
• New disclosure obligations around automated decision-making are also being phased in, relevant to any business using software or AI tools to make decisions about customers without a human directly reviewing them.

Because the exact dates and detail are still moving as legislation progresses, treat any specific date you read (including in this article) as a guide rather than gospel, and check the Office of the Australian Information Commissioner (OAIC) directly for the current, confirmed timeline before making decisions based on it.

Who This Affects

If your business collects any personal information — customer names, emails, phone numbers, addresses, payment details, even just an inquiry through a contact form — you’re in scope once your exemption ends, no matter how small the team is. This applies whether that data flows through your website, your booking system, your email marketing list, or your point-of-sale.

Businesses in real estate, trades, healthcare, hospitality, retail, and professional services are all named specifically in the reform discussion, but genuinely, if you have a “Contact Us” form on your website today, this concerns you.

What Your Website Needs to Have in Place

Most of what’s required touches your website directly, since that’s usually where personal information first gets collected:

1. A real, accurate privacy policy

Not a generic template copied from another site — a policy that actually reflects what data you collect, why, how it’s stored, and who (if anyone) it’s shared with.

2. Clear, specific consent on every form

Pre-ticked checkboxes and vague bundled terms are exactly what these reforms are designed to move away from. Each form on your site should make it clear what someone is agreeing to.

3. A plan for what happens if there’s a data breach

Knowing who to notify, and how quickly, if customer data is ever exposed — this needs to exist before an incident happens, not be figured out during one.

4. Basic technical safeguards

Things like secure hosting, encrypted forms, and controlled access to who on your team can see submitted customer data.

This is squarely where good web design and development overlaps with compliance — a site built properly handles most of this by default, rather than bolting it on afterwards.

The Cost of Getting This Wrong

The reforms carry genuinely large maximum penalties for serious or repeated breaches — reported figures run into the tens of millions of dollars, or a percentage of annual turnover, whichever is greater — alongside smaller, more immediate infringement notices for lesser breaches. Regulators have also signalled active, proactive compliance checks rather than only responding after something goes wrong.

Beyond the legal exposure, there’s a simpler business cost: customers are increasingly wary of who they hand their details to. A visible, genuine privacy policy and a form that clearly explains what happens to someone’s information is also just good trust-building — the kind that supports conversions, not just compliance.

A Simple Starting Checklist

You don’t need to solve this in one afternoon, but a good starting point is to:

• Check the OAIC website to see whether your industry or turnover already brings you into scope.
• List every place on your website that collects personal information — contact forms, bookings, newsletter sign-ups, checkouts.
• Review (or write, if you don’t have one) a privacy policy that actually matches what those forms do.
• Talk to a solicitor or compliance advisor if you’re unsure how the reforms specifically apply to your business — this article is general information, not legal advice.

FAQ

Open any website on your phone right now and count how long it takes to feel usable. Two seconds feels instant. Three feels like a wait. Five feels broken. Most visitors never tell you that — they just leave, and you never see them again.

That’s the reality behind Core Web Vitals: Google’s set of measurements for how fast and stable a page actually feels to a real person, on a real connection, on a real phone. In 2026, more than half of mobile sites still fail them — which means for a lot of small businesses, slow-loading pages are quietly costing customers and rankings at the same time.

What Core Web Vitals Actually Measure

Core Web Vitals are three specific, measurable signals Google uses to judge the real-world experience of a page:

• LCP (Largest Contentful Paint) — how long it takes for the main content (usually a hero image or headline) to actually appear. Good is 2.5 seconds or under.
• INP (Interaction to Next Paint) — how quickly the page responds when someone taps a button or link. Good is 200 milliseconds or under. This replaced the older “First Input Delay” metric and is now the trickiest one for most sites to pass.
• CLS (Cumulative Layout Shift) — whether things jump around while the page loads (like a button shifting right as you’re about to tap it). Good is a score of 0.1 or under.

A site doesn’t need to be flashy to pass these — it needs to be lean, well-built, and free of the small technical habits that quietly slow everything down.

What Slow Pages Are Costing Australian Businesses

These aren’t abstract engineering metrics — they translate directly into lost revenue:

On mobile specifically — where most Australian shoppers and searchers now are — average load times on a typical 4G connection sit well above the “good” 2.5-second target, which is exactly why mobile pass rates lag so far behind desktop.

Why Google Cares (and Why Rankings Follow)

Core Web Vitals are a confirmed part of Google’s ranking signals, and they sit alongside a simpler truth: Google’s whole business depends on people trusting search results, so it has every incentive to favour pages people actually stay on. A fast, stable page keeps someone reading. A slow, jumpy one sends them straight back to the results page — and that “quick bounce back” behaviour is exactly the kind of signal that works against you over time.

Speed also matters more than ever now that AI-powered search is summarising and citing sources directly — a slow site is more likely to time out or get skipped entirely during how these tools gather information, on top of losing human visitors.

Where Most Websites Lose Their Speed

In our experience rebuilding and auditing small business sites, the same handful of culprits show up again and again:

1. Oversized, unoptimised images

A single uncompressed hero photo can be heavier than the rest of the page combined. Modern formats and proper sizing usually cut this down dramatically with no visible quality loss.

2. Too many third-party scripts

Chat widgets, tracking pixels, review plugins, font libraries — each one adds a network request and can block the page from responding quickly, which directly hurts INP.

3. No caching or a slow host

Cheap, shared hosting with no caching layer means every visitor waits on the server to rebuild the page from scratch, every single time.

4. Bloated page builders and unused code

Drag-and-drop builders are convenient but often ship far more CSS and JavaScript than a page actually needs, all of which the browser has to download and process before anything feels responsive.

Fixing It: What Actually Moves the Needle

The good news is that this is one of the more fixable problems in digital marketing — it’s mostly technical housekeeping, not guesswork:

• Compress and properly size every image before it goes on the site, and serve modern formats where possible.
• Audit third-party scripts and remove anything that isn’t earning its keep.
• Use a host and caching setup built for speed, not just the cheapest available plan.
• Reserve space for images and ads before they load, so nothing jumps around (this alone can fix a poor CLS score).
• Get a proper technical audit rather than guessing — tools can flag the exact metric failing, but knowing *why* it’s failing on your specific site takes experience. This is exactly the kind of thing we look at as part of every web design and development project we take on.

None of this requires rebuilding a brand or starting from scratch. Most sites we’ve audited get back into “good” territory with focused, technical fixes rather than a full redesign.

FAQ