Does the Privacy Act Apply to My Business? The $3M Test

Does the Privacy Act apply to my business? It is one of the most common questions small business owners ask us, and the answer is not always the one they expect.

Most businesses with an annual turnover of $3 million or less are exempt. But there is a long list of exceptions, and some of them catch businesses that assume they are safe. This article walks through the test in plain English, so you can work out where you stand.

Why the answer matters now

Two things make this question more pressing in late 2026. From 10 December 2026, businesses covered by the Privacy Act must explain in their privacy policy when software makes, or helps make, significant decisions about people. Our article on the OAIC’s automated decision making guidance explains what that means.

Second, more small businesses became covered this year. Real estate agents, accountants, lawyers and conveyancers took on anti money laundering obligations on 1 July 2026, and that brings part of their work under the Privacy Act.

Does the Privacy Act apply to my business? Start here

There are three checks: your turnover, the list of exceptions, and the kind of work you do. Work through them in order.

Check 1: The $3 million turnover test

The Privacy Act calls a business with an annual turnover of $3 million or less a small business operator. In general, small business operators don’t have to follow the Australian Privacy Principles. Businesses that do have to follow them are called APP entities.

A few points trip people up:

• Turnover is not profit. It is the total income your business earns in the year, before costs.
• The test uses your turnover for the last financial year. A brand new business looks at its turnover for the current year.
• If your turnover goes over $3 million, you become covered. Plan for it before it happens.

Check 2: The exceptions that cover your whole business

Even if your turnover is under $3 million, the Privacy Act covers your whole business if any of these apply to you:

• You provide a health service and hold health information. This is wider than it sounds. The OAIC includes gyms, weight loss clinics, complementary therapists, child care centres and private schools.
• You buy or sell personal information, such as customer or contact lists.
• You provide services under a contract with the Australian Government.
• Your business is related to a business that is covered, such as another company in the same group.
• You are a credit reporting body or a registered employee association.
• You are accredited under the Consumer Data Right.
• You have chosen to opt in to the Privacy Act.
• Your type of business is named in the Privacy Regulation 2013.

The OAIC sets out the full list on its rights and responsibilities page.

Check 3: Work that is covered even if the business isn’t

Some small businesses are covered only for part of what they do. The Privacy Act applies to that work, but not to the rest of the business. This includes:

• Work you do as a reporting entity under the anti money laundering laws
• Running a residential tenancy database
• Running a protected action ballot

The anti money laundering change for professional services

This is the change most likely to catch a small firm off guard. Since 1 July 2026, many real estate agents, accountants, lawyers, conveyancers and trust and company service providers have obligations under the anti money laundering laws for certain services. These include checking customer identity and keeping records.

If you are a small business in one of these groups and you provide those services, the Privacy Act applies to that work. That means the identity documents and customer details you collect for those checks must be handled under the privacy principles.

It doesn’t automatically bring in the rest of your business. But in practice, many firms find it simpler to apply the same privacy standards across the board. Check with AUSTRAC or your professional body about which of your services are covered.

Is the small business exemption being removed?

Not yet. In 2023 the Government agreed in principle to remove it, but only after more consultation and support for small business. The draft privacy changes released for comment in 2026 did not include it, and no date has been set.

You may see claims online that the exemption is gone. It isn’t. But the direction is clear, and many owners are choosing to get ready now rather than scramble later.

What to do if you are covered

If the Privacy Act applies to your business, these are the basics to have in place:

• A clear, current privacy policy on your website
• Collect only the personal information you need, and tell people why you collect it
• Keep it secure, and delete it when you no longer need it
• Have a plan for data breaches. Serious breaches must be reported under the Notifiable Data Breaches scheme.
• Know which software and AI tools use personal information, and which help make decisions about people
• From 10 December 2026, add an automated decisions section to your privacy policy if you need one

Our article on the Privacy Act AI disclosure requirements explains the December change in more detail.

If you are exempt, should you still bother?

Being exempt means the privacy regulator can’t enforce the privacy principles against you. It doesn’t mean privacy stops mattering. There are good reasons to follow the basics anyway:

• Larger clients and government buyers often ask suppliers about privacy and AI in contracts and tenders
• Customers notice, and a clear privacy policy builds trust
• Other laws still apply, such as the Spam Act and consumer law
• If the exemption is removed, you will already be ready

A sensible middle path is to know what personal information you hold, keep it secure, and know which tools your staff put it into. Our guide to building an AI system inventory is a good place to start.

A quick checklist

• We know our annual turnover for the last financial year
• We have checked the list of exceptions
• We have checked whether a related business is covered
• If we provide services under the anti money laundering laws, we know which ones
• We know what personal information we hold and where it goes
• We know which software and AI tools use that information

Questions owners ask

Our turnover is $2.5 million. Are we definitely exempt?

Only if none of the exceptions apply. Check the list above carefully, especially health services, buying or selling personal information, and related businesses.

I’m a sole trader. Does the Privacy Act apply to me?

The same test applies. A sole trader with a turnover of $3 million or less is usually exempt, unless one of the exceptions applies.

Does putting customer details into ChatGPT change anything?

It doesn’t change whether you are covered. But if you are covered, the privacy principles apply to how you use that information, including in AI tools. Our piece on the policy gap created when staff use ChatGPT covers this.

Can we choose to be covered?

Yes. A small business can opt in by applying to the OAIC. Some businesses do this because a client or a tender asks for it.

The short version

Start with turnover, then check the exceptions. Don’t forget related businesses and the new anti money laundering rules. If you are covered, the 10 December 2026 privacy policy change is your next deadline. If you are not, following the basics now still makes good business sense.

This article is general information, not legal advice. If you are unsure whether the Privacy Act applies to your business, please speak with a qualified adviser.

How Lead Comply can help

Not sure where you stand? Book a complimentary assessment and we will help you work it out. From 23 October you can also start free in the Lead Comply AI Governance Portal to list your AI tools and build the automated decisions section of your privacy policy.