FAQ
IT law FAQs: quick answers for Australian businesses
Short answers to the questions we are asked most about privacy, data breaches, AI, online business, IP and workplace technology.
Privacy
Does the Privacy Act apply to my small business?
Usually not if annual turnover is $3 million or less, but you are covered regardless of size if, for example, you provide a health service, trade in personal information or contract to the Commonwealth.
What counts as personal information?
Information or an opinion about an identified individual, or one who is reasonably identifiable, including names, contact details, IP addresses, device IDs and location data.
Can I store customer data overseas?
Yes, but under APP 8 you must generally take reasonable steps to ensure the overseas recipient handles it consistently with the APPs.
Can someone sue me for invading their privacy?
Yes. Since 10 June 2025 individuals can sue for serious invasions of privacy that are intentional or reckless, under a statutory tort.
Data breaches and cyber security
How long do I have to report a data breach?
An eligible data breach must be notified to the OAIC and affected individuals as soon as practicable. A suspected breach must be assessed within 30 days.
Do I have to report a ransomware payment?
Yes, if your business had turnover above $3 million in the previous financial year or is a critical infrastructure entity. Report to the Australian Signals Directorate within 72 hours.
Is paying a ransom illegal?
Not generally, but it must be reported if you are covered, and paying a sanctioned person or entity can be an offence.
AI and automated decisions
Is there an AI Act in Australia?
No. The National AI Plan released on 2 December 2025 relies on existing technology-neutral laws, supported by an AI Safety Institute.
What changes on 10 December 2026?
Privacy policies must explain when computer programs are used to make, or substantially help make, decisions that could significantly affect individuals.
Can I train AI on other people’s content?
It is risky. Australia has no text and data mining exception, and in October 2025 the Government ruled one out.
Online business
Do I have to give refunds for online sales?
You must provide the remedies required by the consumer guarantees, which can include a refund for a major failure. Change-of-mind refunds are optional unless you promise them.
Can I send marketing emails to customers?
Only with consent, clear identification of the sender and a working unsubscribe that is honoured within five working days.
IP and domains
Do I need to register copyright?
No. Copyright is automatic in Australia and there is no registration system.
Who owns code written by a contractor?
Usually the contractor, unless copyright is assigned to you in writing.
Does a business name protect my brand?
No. Only a registered trade mark gives exclusive rights to a brand.
Workplace
Can my employer monitor my work email in NSW?
Generally yes, with at least 14 days’ written notice and in accordance with a notified computer use policy.
Is hidden camera surveillance at work legal in NSW?
Only with a covert surveillance authority from a magistrate, to investigate suspected unlawful activity.
Need advice on your situation?
Our guides are general information. For advice on your circumstances, send us an enquiry and an ITLAW lawyer will get back to you, usually within one business day.