The Privacy Act small business exemption: does it apply to you?

By the ITLAW Team · Last reviewed November 2026 · General information, not legal advice

Guides › Privacy & Data Protection › Small business exemption

Under the Privacy Act 1988 (Cth), a “small business operator” is generally not covered by the Australian Privacy Principles. A small business is one with an annual turnover of $3 million or less. The exemption is one of the most debated features of Australian privacy law and is under review in the Tranche 2 reforms.

How the turnover test works

Turnover is measured for the previous financial year. A business that started during the current year looks at its current-year turnover. If turnover rises above the threshold, the Act applies from that point. Special rules govern when a business can return to small business status, so get advice before relying on a later drop in turnover. Related companies are considered together: if a related body corporate is not a small business, you may be covered too.

Businesses covered regardless of size

The exemption does not apply if you:

• provide a health service and hold health information other than in an employee record, which captures many GPs, allied health, gyms, natural therapists and wellbeing apps
• disclose personal information to anyone else for a benefit, service or advantage, or provide a benefit to collect it, for example selling or buying customer lists, unless you have consent or it is required by law
• are a contracted service provider under a Commonwealth contract
• are a reporting entity under the anti-money laundering laws, for activities connected to those obligations (an expanded group from 1 July 2026)
• operate a residential tenancy database, or are a credit reporting body
• have chosen to opt in to the Privacy Act

Other laws still apply

• The statutory tort for serious invasions of privacy applies to anyone, regardless of size. See our article on the privacy tort.
• The Spam Act applies to all commercial email and SMS.
• State laws such as the Health Records and Information Privacy Act 2002 (NSW) may apply to health information.
• Contracts with larger customers often require you to comply with the APPs anyway.

Should a small business comply anyway?

Often, yes. Enterprise customers and government agencies regularly require suppliers to meet APP standards, cyber insurers ask about privacy practices, and the exemption may narrow or disappear under Tranche 2. A simple privacy policy, collection notices and basic security controls are low-cost and reduce risk.

Frequently asked questions

What is the turnover threshold for the Privacy Act?

$3 million. Businesses with annual turnover of $3 million or less are generally exempt unless an exception applies.

Are health businesses exempt if they are small?

No. A business that provides a health service and holds health information is covered by the Privacy Act regardless of turnover.

Will the small business exemption be removed?

It is under review as part of the Tranche 2 reforms. The final position will depend on the legislation the Government introduces.

← Back to the Privacy & Data Protection guide