Does the Privacy Act cover your small business?

Most small businesses in Australia sit outside the Privacy Act 1988 (Cth), because the small business exemption applies to anyone with an annual turnover of $3 million or less. But there's a long list of exceptions, and if your business does any one of a dozen common things, from handling health information to running a loyalty program, the exemption doesn't apply to you regardless of how small you are.

What is the small business exemption?

The Office of the Australian Information Commissioner (OAIC) sets the line at annual turnover. If your business turns over $3 million or less across a financial year, you're generally treated as a small business and the Privacy Act doesn't apply to you. That turnover figure counts all your income, not just profit, and it excludes the value of assets or one off proceeds like selling equipment or property.

It's a turnover test, not a headcount or revenue quality test. A five person consultancy billing $3.2 million is covered. A twelve person business turning over $2.5 million generally isn't, unless one of the exceptions below catches it.

The exceptions that catch small businesses anyway

This is the part worth reading properly, because it catches more businesses than people expect. Even under the $3 million threshold, the Privacy Act applies if your business is any of the following:

• A health service provider. Broader than clinics and doctors. It includes complementary therapists, gyms and personal trainers who record health information, childcare centres, and private schools that hold health details about students.

• Trading in personal information. If you buy or sell personal information, or disclose it to someone else for a benefit, service or advantage, this applies to you. Referral arrangements and some loyalty or rewards programs can fall into this category.

• A Commonwealth contractor, providing services under a contract with the Australian Government.

• An operator of a residential tenancy database, including property managers and agencies that run or contribute to tenant databases.

• A credit reporting body.

• A reporting entity under anti-money laundering law, covered by the Anti-Money Laundering and Counter-Terrorism Financing Act 2006.

• An employee association, registered under the Fair Work (Registered Organisations) Act 2009.

• A business conducting protected action ballots.

• Accredited under the Consumer Data Right system.

• Related to a business the Privacy Act already covers. If a related entity is covered, you generally are too.

• Prescribed by the Privacy Regulation 2013.

If none of these apply to you and your turnover is under $3 million, the Privacy Act doesn't bind you. That doesn't mean privacy stops mattering, it means the legal obligation isn't there in the same way.

Who counts as an "organisation" if you are covered?

"Organisation" is a broad label under the Act. It takes in sole traders, companies, partnerships, unincorporated associations and trusts, not just larger corporates. It excludes exempt small business operators, political parties, and state or territory government authorities, which sit outside the Act's ordinary definition. The Act also doesn't apply to individuals acting in a personal capacity, public schools, most universities, and media organisations operating under their own published privacy standards.

You can opt in even if you're exempt

If your business is exempt, you can still choose to be covered. It's a genuine application to the OAIC, not an automatic switch, businesses do it for commercial reasons: it's a public commitment to good privacy practice, and larger clients sometimes ask for it during procurement before they'll sign on with a smaller supplier.

To opt in, you apply through the OAIC with a link to your privacy policy (or a copy, if it isn't published yet). Your policy needs to actually comply with the Australian Privacy Principles (APPs), otherwise the application is declined. Once approved, your business goes on a public opt-in register showing your trading name and ABN. There's no application fee, and you can opt back out later by notifying the OAIC in writing, though conduct from while you were opted in can still be the subject of a complaint afterward.

What it means once you're covered

Whether you're covered by turnover, by an exception, or because you've opted in, the same obligations apply: you need to comply with the APPs. That covers things like having a privacy policy, only collecting information you actually need, keeping it secure, and giving people a real way to access or correct what you hold about them, plus a way to complain if something goes wrong. Businesses handling credit information or tax file numbers have some extra specific rules on top of that.

What to do about it

1. Work out your turnover properly

Use your actual annual turnover, not an estimate. Include all income, not just profit, and don't include one off asset sales.

2. Check the exceptions list against what your business actually does

Read through it slowly. The health services and information trading exceptions are the two that trip people up most often, because they cover more activities than the names suggest.

3. Decide, and document the decision

If you land outside the Privacy Act, note why, including the turnover figure and which exceptions you checked and ruled out. If your circumstances change, that reasoning changes too.

4. Weigh up opting in

If clients are asking for it, or privacy is part of how you want your business to be seen, opting in might be worth the application. If nobody's asking, it's optional for a reason.

5. Get it checked if you're unsure

This is one area where getting it wrong is expensive to unwind. If your business is borderline, it's worth a proper check rather than a guess.

Common questions

My turnover is under $3 million. Am I definitely exempt?

Not necessarily. Check the exceptions list first. Health service providers, businesses that trade in personal information, and a handful of other categories are covered no matter how small they are.

Does turnover mean profit?

No. It's your business's total income across the year, excluding proceeds from selling assets or capital.

Can I choose to be covered even if I don't have to be?

Yes, by applying to the OAIC to opt in. You'll need an APP compliant privacy policy in place first, and your business will appear on a public register once approved.

If I'm exempt, should I still have a privacy policy?

It's not required, but plenty of exempt small businesses have one anyway, because customers and larger clients ask for it. Our guide on privacy policy requirements in Australia covers what to include if you decide to.

This is general information, not legal advice. Every business handles information a bit differently, so if you're not sure how this applies to yours, it's worth checking with a lawyer or privacy adviser.

Sources: Small business, Opting in to the Privacy Act and Rights and responsibilities, Office of the Australian Information Commissioner, last modified 5 September 2024 and 9 September 2024 respectively.