For years, most small Australian businesses have quietly relied on a simple rule: if your annual turnover is under $3 million, the Privacy Act mostly doesn’t apply to you. No formal privacy policy, no data breach plan, no structured consent process required.
That exemption is being wound back. Multiple rounds of reform are progressively bringing more small businesses under full Privacy Act obligations — with real dates attached and real penalties for getting it wrong. If your website collects names, emails, phone numbers, or payment details through a contact form, an online booking system, or a checkout, this is worth twenty minutes of your attention now rather than a scramble later.
Key factReforms progressing through 2026 are expected to bring millions of additional small Australian businesses under full Privacy Act obligations, with maximum penalties for serious breaches reaching into the tens of millions of dollars.
What’s Actually Changing
This is happening in stages rather than as one single cut-off date, which is part of why it’s easy to miss:
- Specific regulated industries — including real estate agencies, accounting and law firms, conveyancers, and dealers in high-value goods — have already started losing their exemption as anti-money-laundering rules expanded to cover them.
- The broader small business exemption itself is on track to be removed later in 2026, which would bring the vast majority of remaining small businesses — regardless of industry — under the same rules that currently only apply to larger companies.
- New disclosure obligations around automated decision-making are also being phased in, relevant to any business using software or AI tools to make decisions about customers without a human directly reviewing them.
Because the exact dates and detail are still moving as legislation progresses, treat any specific date you read (including in this article) as a guide rather than gospel, and check the Office of the Australian Information Commissioner (OAIC) directly for the current, confirmed timeline before making decisions based on it.
Who This Affects
If your business collects any personal information — customer names, emails, phone numbers, addresses, payment details, even just an inquiry through a contact form — you’re in scope once your exemption ends, no matter how small the team is. This applies whether that data flows through your website, your booking system, your email marketing list, or your point-of-sale.
Businesses in real estate, trades, healthcare, hospitality, retail, and professional services are all named specifically in the reform discussion, but genuinely, if you have a “Contact Us” form on your website today, this concerns you.
What Your Website Needs to Have in Place
Most of what’s required touches your website directly, since that’s usually where personal information first gets collected:
1. A real, accurate privacy policy
Not a generic template copied from another site — a policy that actually reflects what data you collect, why, how it’s stored, and who (if anyone) it’s shared with.
2. Clear, specific consent on every form
Pre-ticked checkboxes and vague bundled terms are exactly what these reforms are designed to move away from. Each form on your site should make it clear what someone is agreeing to.
3. A plan for what happens if there’s a data breach
Knowing who to notify, and how quickly, if customer data is ever exposed — this needs to exist before an incident happens, not be figured out during one.
4. Basic technical safeguards
Things like secure hosting, encrypted forms, and controlled access to who on your team can see submitted customer data.
This is squarely where good web design and development overlaps with compliance — a site built properly handles most of this by default, rather than bolting it on afterwards.
The Cost of Getting This Wrong
The reforms carry genuinely large maximum penalties for serious or repeated breaches — reported figures run into the tens of millions of dollars, or a percentage of annual turnover, whichever is greater — alongside smaller, more immediate infringement notices for lesser breaches. Regulators have also signalled active, proactive compliance checks rather than only responding after something goes wrong.
Beyond the legal exposure, there’s a simpler business cost: customers are increasingly wary of who they hand their details to. A visible, genuine privacy policy and a form that clearly explains what happens to someone’s information is also just good trust-building — the kind that supports conversions, not just compliance.
A Simple Starting Checklist
You don’t need to solve this in one afternoon, but a good starting point is to:
- Check the OAIC website to see whether your industry or turnover already brings you into scope.
- List every place on your website that collects personal information — contact forms, bookings, newsletter sign-ups, checkouts.
- Review (or write, if you don’t have one) a privacy policy that actually matches what those forms do.
- Talk to a solicitor or compliance advisor if you’re unsure how the reforms specifically apply to your business — this article is general information, not legal advice.
FAQ
Possibly, and increasingly likely over time. Certain industries are already affected, and the broader small business exemption is expected to be removed later in 2026. Check the OAIC website or a solicitor for how it applies to your specific situation.
Start with your privacy policy and your forms. Make sure the policy is accurate to what you actually do, and that any form collecting personal information is clear about what someone is agreeing to.
No — this article is general information to help you understand what’s changing and start the conversation. For advice specific to your business, speak with a solicitor or check the OAIC directly.
A web designer can’t give legal advice, but a properly built website — with clear consent on forms, secure data handling, and a real privacy policy in place — covers a large part of what’s required on the technical side.