Does the Privacy Act now apply to your business?

Most small business owners assume the Privacy Act is for big companies. The Act does exempt most businesses with an annual turnover of $3 million or less, but the exceptions are wider than people expect, and several of them have nothing to do with size.

Two changes this year make the question worth settling now. On 1 July 2026 the anti-money laundering reforms brought an estimated 100,000 small firms under the Privacy Act for the first time. From 10 December 2026, every business the Act covers must say in its privacy policy where software makes or shapes significant decisions about people.

What an APP entity is

A business the Privacy Act covers is called an APP entity, after the 13 Australian Privacy Principles that set the rules for collecting, storing, using and sharing personal information. An APP entity needs a privacy policy that meets those principles, has to keep personal information secure, and must report serious data breaches to the Office of the Australian Information Commissioner (OAIC) and to the people affected.

Does the Act apply to you?

One tick means your business is an APP entity, or should assume it is until an adviser says otherwise.

• Turnover last financial year was above $3 million, counting all income except the sale of assets such as vehicles or premises

• We provide a health service and keep health information, which includes allied health, childcare and gyms that keep injury notes

• We have bought, sold or been paid for personal information, including client lists or leads

• We hold a contract with a Commonwealth agency

• We are a subsidiary or sister company of a business that is an APP entity

• We are a reporting entity with AUSTRAC, or an authorised agent of one

• We have opted in to the Privacy Act, or a contract required us to

If nothing is ticked, write the answer down with the date and who assessed it, and check again at the end of each financial year.

The anti-money laundering route

The AUSTRAC tick catches the most professional firms. Section 6E(1A) of the Privacy Act treats a small business that is a reporting entity under the anti-money laundering laws as covered, whatever its turnover. Financial planners and mortgage brokers have been in that position since 2006, and since 1 July 2026 it also takes in lawyers, conveyancers, accountants, real estate agents, and trust and company service providers.

The coverage follows the service you provide. The Act applies to personal information handled for the work that makes you a reporting entity, so conveyancing brings a sole practitioner in, while a firm that only does litigation may stay out. Where only one part of a firm provides those services, write down where the line sits.

What changes on 10 December

From 10 December 2026 your privacy policy must list the kinds of personal information used by any computer program that makes, or substantially shapes, a decision that could significantly affect someone. That covers rule-based software and spreadsheet formulas as well as AI, including tools where a person signs off but usually follows the result. An identity check that can stop an onboarding, a risk profile that drives advice, and a tenancy or credit score are all examples. The OAIC can issue infringement notices for privacy policies that fall short.

Where to start

Update the privacy policy. It is the one document the regulator and your clients can read today, and the December disclosure has to go in it. A template bought online a few years ago is unlikely to meet the current wording.

List the tools that make decisions about people. Include every piece of software, formula or vendor service that scores, ranks, flags, approves or declines anything about a person, and decide for each one whether it belongs in the disclosure. Expect to find two or three.

Secure the identity documents you collect. The OAIC’s guidance for reporting entities says not to keep copies of full identity documents for anti-money laundering records. Whatever you do hold has to be kept secure, and the seven basics for small businesses are where that starts.

Get help with your privacy obligations

If you want help working out whether the Privacy Act applies to your business, or getting your privacy policy ready for 10 December, get in touch. Cyber People supports Sunshine Coast businesses on site, and Australian businesses remotely.

General information only. Not legal advice. Confirm your own obligations with your advisers.

Sources: Privacy Act 1988 (Cth), sections 6D and 6E; Office of the Australian Information Commissioner, Privacy guidance for reporting entities under the AML/CTF Act (updated August 2026); OAIC, automated decision-making transparency guidance (September 2026); HWL Ebsworth, Small businesses, big change: privacy obligations under tranche 2 of the AML/CTF reforms.