Does the Privacy Act Apply to You?
Do I Need Cyber Compliance in Australia? Start With Whether the Privacy Act Covers You
Not every Australian business is covered by the Privacy Act. Most businesses with an annual turnover of $3 million or less are exempt, unless an exception applies, and the exceptions catch more small businesses than people expect: any health service provider, for example. If the Act does cover you, you must take reasonable steps to protect the personal information you hold and you must assess and report eligible data breaches. If it does not, your clients, insurers and contracts will often ask for much the same thing anyway.
Does the Privacy Act apply to my business?
The Privacy Act binds “APP entities”: Australian Government agencies and private sector organisations. A business is an organisation for this purpose unless it is a small business operator, which broadly means every business it carries on has an annual turnover of $3 million or less.
Two details trip people up. Turnover is tested across the whole history of the business, so a business that went over $3 million in any financial year since 2001–02 stays covered even if it has shrunk since. And the turnover of related companies counts: a small subsidiary of a covered company is covered too.
Then come the exceptions. Some bring a small business into the Act for everything it does. Others bring it in only for a particular activity.
Covered for the whole business, regardless of turnover
- You provide a health service and hold health information (other than in an employee record). This includes GPs, dentists, pharmacies, allied health, psychology and many NDIS and aged care providers.
- You disclose personal information for a benefit, or pay to collect it, without consent or legal authority.
- You are a credit reporting body.
- You are related to a company that is not a small business.
- You are a registered employee or employer association.
- You have opted in to the Privacy Act by registering with the OAIC.
Covered only for a specific activity
- Reporting entities under the AML/CTF Act, for activities connected with that Act.
- Contracted service providers under a Commonwealth contract, for the work done under that contract.
- Operators of a residential tenancy database, for the database.
- Accredited persons under the Consumer Data Right, for personal information that is not CDR data.
This is a summary. The Act has a few further narrow categories, and regulations can add more.
Sources: Privacy Act 1988 (Cth), ss 6C, 6D, 6E and 6EA · OAIC, Small business
What the Privacy Act requires of a covered business
The Act does not hand you a cyber security checklist. It sets principles, and the security one is deliberately general. The obligations a covered business most often has to show it has dealt with are these.
Protect what you hold
APP 11 requires reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, and to destroy or de-identify it once you no longer need it. Since December 2024 the Act says those steps include technical and organisational measures.
Assess and report breaches
Under the Notifiable Data Breaches scheme, a suspected eligible breach has to be assessed, normally within 30 days, and an eligible one reported to the OAIC and the people affected.
Keep a current privacy policy
APP 1 requires a clearly expressed, up-to-date privacy policy. From 10 December 2026 it must also describe certain automated decisions that use personal information.
Answer to the OAIC
The OAIC can investigate complaints and breaches, issue infringement and compliance notices for some breaches, and seek civil penalties in court. Here is what regulators check.
Exempt from the Act is not the same as exempt from the question
A small business outside the Privacy Act has no APP 11 duty and no obligation to notify the OAIC of a breach. That is a real difference, and you should not let anyone tell you otherwise. In practice, though, the same expectations tend to arrive by other routes.
Contracts
Covered businesses have to take reasonable steps over personal information they share with suppliers, so their contracts commonly pass privacy and security terms down to you.
Tax file numbers
If you hold TFNs, as most employers do, the TFN Rule applies to that information whatever your size, and a TFN data breach can be notifiable.
Insurers and clients
Cyber insurers and larger clients ask what controls you run and who is responsible for them. They do not check your turnover first.
A rule that may change
The Government agreed in principle in 2023 to remove the small business exemption, subject to consultation and an impact analysis. The exposure draft bill released in August 2026 does not remove it. Treat it as a possibility, not current law.
Is your business meeting its obligations under the Privacy Act?
Answer 10 questions to identify where your business may not be taking the reasonable steps required by Australian privacy law.
How Prepared Is Your Business?
Businesses covered by the Privacy Act must take reasonable steps to protect personal information. This assessment helps you identify where your obligations may not be met and where your evidence may be insufficient.
Answer 10 questions to identify where your business may not be taking reasonable steps.
Write the answer down, and review it when the business changes
Whether the Act applies is a decision with legal consequences, and it is one most businesses make once, informally, and never revisit. A short dated record avoids most of the trouble.
What to record
- Annual turnover for each financial year, and for related companies
- Each exception you considered, and why it does or does not apply
- Who made the call, and on what date
When to revisit it
- Turnover approaches or passes $3 million
- You start providing a health service or holding health information
- You win a Commonwealth contract or take on AML/CTF obligations
If you are covered
- Owners named for each privacy and security obligation
- Dated records that controls were reviewed and gaps fixed
- A breach response process that people know how to use
Cleverer asks these applicability questions once for the whole organisation, prompts for reconfirmation each year, and writes the answer into every policy it generates, so a covered business is not described as exempt and an exempt one is not handed obligations it does not have. For a covered business it then tracks who owns each safeguard, when it was last reviewed and what was fixed. More on how to prove cyber compliance.
Common questions about whether the Privacy Act applies
Does the Privacy Act apply to small businesses?
Not usually. A business with annual turnover of $3 million or less is generally a small business operator and is exempt. It is covered if it provides a health service and holds health information, trades in personal information, is related to a larger covered company, or falls within another exception set out in the Act.
Does the Notifiable Data Breaches scheme apply to my business?
It applies to entities that have APP 11 obligations, plus credit reporting bodies, credit providers and holders of tax file number information. A small business that is outside the Act is generally outside the scheme, except for any TFN information it holds.
Is the small business exemption being removed?
It may be. In its 2023 response to the Privacy Act Review, the Government agreed in principle to remove it, but only after consultation and an impact analysis, and with support for small businesses first. Neither the 2024 amendments nor the exposure draft bill released in August 2026 removes it. Until a law passes, the exemption stands.
We are an allied health clinic with three staff. Are we covered?
Very likely yes. Providing a health service and holding health information takes a business out of the small business exemption regardless of turnover. That is why most clinics, practices and many care providers are covered.
We are exempt. Do we still need cyber security controls?
The Privacy Act will not require them, but your clients, insurer and suppliers probably will, and the losses from a breach do not depend on the Act. The practical difference is that an exempt business can size its controls to its own risk and contracts rather than to APP 11.
Know where you stand, and be able to show it.
Work out whether the Privacy Act applies, record the answer, and keep a dated record of the steps you take either way. That record is what clients, insurers and, for covered businesses, the OAIC will ask to see.
General information only. This page is not legal advice.
