Privacy Act for accountants: what changed on 1 July 2026

Does the Privacy Act apply to accountants now?

If your accounting practice provides designated services under the AML/CTF Act, yes. Since 1 July 2026, those practices are AML/CTF reporting entities, and reporting entities lose the small business exemption in the Privacy Act 1988 (Cth). That means the Australian Privacy Principles (APPs) apply to you, whatever your turnover.

For most practices this is a brand new compliance job. It's also a chance to show clients their information is handled properly, which matters when you're holding their tax file numbers and trust deeds. Privacy risk belongs alongside professional indemnity and AML/CTF compliance in your governance and risk framework. It's a partner-level issue, not a back-office task.

Which accounting services are designated services?

The Privacy Act includes a small business exemption that generally excludes businesses with annual turnover of $3 million or less. Most accounting practices have relied on it for years.

That changed on 1 July 2026. Under section 6E of the Privacy Act, a small business operator that is a reporting entity under the AML/CTF Act must comply with the Privacy Act for its AML/CTF-related activities. The exemption doesn't apply.

Your practice is likely affected if it provides any of the designated services set out in the AML/CTF Act, including:

• acting for a client in buying, selling or transferring a business or legal entity

• managing client money or assets

• creating or managing trusts, companies or similar structures.

Not every service you offer is a designated service. Standard tax return preparation, general bookkeeping and routine audit work are generally not captured. But if any part of your practice provides a designated service, the Privacy Act obligations follow.

Not sure where you stand? Get advice. CPA Australia and AUSTRAC have both published guidance, and Savira has a self-assessment tool built for accounting practices.

What has changed under the Privacy Act?

1. Much stronger enforcement powers

The Privacy and Other Legislation Amendment Act 2024 expanded the powers of the Office of the Australian Information Commissioner (OAIC). It can now issue infringement notices for certain breaches, use stronger investigation and information-gathering powers, and run public inquiries into systemic privacy practices.

2. Significantly higher penalties

Courts can order penalties of up to $50 million, three times the benefit obtained, or 30% of adjusted turnover, for a company’s serious interference with privacy (Privacy Act s 13G). Lower-tier penalties and OAIC infringement notices now apply to less serious breaches.

3. Individuals can now sue

The statutory cause of action for serious invasions of privacy commenced on 10 June 2025. Individuals can take legal action where an invasion of privacy was intentional or reckless, serious, and where they had a reasonable expectation of privacy. Litigation and class action risk is real and present.

4. New Privacy Act coverage for accounting practices

Since 1 July 2026, accounting firms providing designated services under the AML/CTF Act are reporting entities, and every reporting entity is covered by the Privacy Act regardless of turnover. Your privacy obligations sit alongside your other regulatory requirements, not in place of them.

Why are accountants in the regulator's sights?

The AML/CTF Tranche 2 reforms brought accountants into scope as reporting entities, and that brought them into scope under the Privacy Act at the same time. This isn't theoretical. The obligations commenced on 1 July 2026.

Accounting carries a significant privacy risk profile. Practices routinely handle:

• tax file numbers and identity documents

• financial records and business ownership structures

• trust deeds

• in some cases, details of a client's personal circumstances.

Much of this is collected face to face or by email, often with little explanation of how it will be used, stored or shared.

The OAIC's guidance for AML/CTF reporting entities is clear that your AML/CTF obligations are not a blank cheque to collect personal information. You still collect only what is reasonably necessary, and you need to be upfront with clients about what you collect and why. You don't need to keep full copies of identity documents for record keeping. Keep the relevant details instead, and destroy or de-identify full copies once you no longer need them.

How you use client information matters too. Using it beyond the reason you collected it, such as for marketing, cross-selling or sharing with referral partners, can breach the Privacy Act without proper consent.

Which Australian Privacy Principles matter most for accountants?

• APP 1, privacy policy: You need a clear, accurate and accessible privacy policy (here's what it must include) explaining what personal information you collect, why, how you use it, and how people can access or correct it.

• APP 3 and APP 5, collection and notification: Collect only what is reasonably necessary, and tell clients at or before collection why you're collecting it and how it will be handled. Client onboarding and engagement letters are a specific risk point.

• APP 6, use and disclosure: Personal information should generally only be used for the purpose it was collected for. Marketing, cross-selling or sharing with referral partners without consent can breach this principle.

• APP 7, direct marketing: You can't use personal information for direct marketing without consent or a compliant opt-out. The OAIC can issue infringement notices for certain direct marketing breaches.

• APP 11, security: Take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access. That includes your practice management system, email and document storage.

• APP 12 and APP 13, access and correction: People must be able to access and correct their personal information. Penalty notices can apply if you don't comply.

What should your accounting practice do now?

First, if you provide designated services and haven't enrolled with AUSTRAC, do it now. Enrolment closed on 29 July 2026, and AUSTRAC has started issuing notices to businesses that appear to be providing designated services without enrolling. Enrolment is free and done through AUSTRAC Online Services.

Then work through privacy in three stages. Fix the critical gaps first, build governance next, and embed privacy into how your practice runs over the longer term.

Not sure where you stand on each principle? Work through the Privacy Act checklist, 13 yes or no questions, one per APP.

Immediate: 0 to 3 months

1. Work out whether your practice provides designated services and is a reporting entity.

2. Draft or update your privacy policy so it reflects how you actually handle personal information.

3. Review client onboarding and engagement letters for APP 5 collection notices.

4. Stop using client information for marketing or referrals without documented consent.

5. Tighten basic security, including removing dormant system accounts and using stronger authentication.

Medium term: 3 to 12 months

1. Appoint a privacy lead within the practice.

2. Document a privacy management plan.

3. Map where personal information lives across your practice management system, document storage and email.

4. Set retention periods for client files, identity documents and engagement records.

5. Review vendor and outsourcing contracts for privacy coverage.

6. Run annual privacy training using accounting-specific scenarios.

Strategic: 12 to 18 months

1. Integrate privacy processes with your AML/CTF program rather than running them as separate workstreams.

2. Run privacy impact assessments for higher-risk activities, particularly client onboarding and entity structuring.

3. Add privacy risk to partner meeting reporting and risk registers.

4. Review your professional indemnity and cyber insurance cover.

5. Treat privacy capability as a genuine point of difference for clients in regulated sectors.

Privacy compliance checklist for accounting practices

Use this to keep the team accountable. Give each item an owner and track progress.

• Privacy policy: Draft or update it and publish it now. Next, schedule an annual review.

• Collection notices: Add privacy disclosures to engagement letters and onboarding now. Next, standardise templates across all service lines.

• Client files: Audit what is stored and where now. Next, set and enforce retention and deletion periods.

• Marketing: Confirm consent and opt-out on all client communications now. Next, review governance of your CRM and mailing lists.

• Security: Tighten access controls on your practice management system now. Next, commission a periodic risk assessment.

• Training: Run an initial all-staff session now. Next, build an annual refresher into the calendar.

• Governance: Appoint a privacy lead now. Next, build privacy into the partner meeting reporting cycle.

A three page PDF you can work through this week. Download it here:

Get the checklist

How Savira helps accounting practices

Getting the foundations right means less rework, less risk and fewer surprises if the regulator comes knocking.

Savira handles the parts of privacy compliance that are ongoing rather than one-off. Generate and maintain a privacy policy that reflects what your practice actually does, collect and record consent through your website, and keep an auditable record of who agreed to what and when, so you can answer a client or a regulator without digging through inboxes.

Whether you're a sole practitioner or a national network, you get the compliance foundations without needing a consultant or a developer. See how Savira works for accounting practices.

This guide was last updated 29 August 2026 to reflect the commencement of Tranche 2 on 1 July 2026. Australian privacy law keeps evolving, so we'll keep it current as the rules change.

This is general information, not legal advice. Every business handles information a bit differently, so if you're not sure how this applies to yours, it's worth checking with a lawyer or privacy adviser.

Source: Privacy guidance for reporting entities under the Anti-Money Laundering and Counter-Terrorism Financing Act (OAIC). To see where your practice stands, get my risk score.