"We're too small for this to apply to us" is the most common thing we hear from business owners, and it's the most common way businesses end up caught out. Here's how the exemption actually works.

The turnover test

Australia's Privacy Act has long included a small business exemption for businesses with annual turnover under $3 million. That threshold itself hasn't been abolished. But this is where most people stop reading, and it's the wrong place to stop.

Why "narrowing" is the right word, not "removed"

The exemption is under genuine reform pressure, and its practical scope has been shrinking for years, but a full repeal has not been legislated. What has happened is that the list of businesses excluded from the exemption regardless of turnover has grown, and enforcement attention on borderline cases has increased. Treat the exemption as narrowing, not as gone, but don't treat it as a safe default either.

Exceptions that already apply, regardless of size

You can be under the $3 million threshold and still be covered by the Privacy Act if your business:

  • Trades in personal information (buying, selling, or providing access to it as part of your business)
  • Provides a health service, in any capacity, and holds health information
  • Is a contracted service provider to the Commonwealth government
  • Is related to a larger business that isn't exempt
  • Has opted in to being covered (some businesses do this deliberately, for trust reasons)

A lot of small businesses assume none of these apply to them, then realise on closer look that a loyalty program, a referral partnership, or a wellness offering puts them squarely in one of these categories.

How to actually check if you're covered

Turnover is the first question, not the only one. The real test is what data you collect, what you do with it, and which sector you operate in. If you handle customer data of any kind and you're not certain which category you fall into, that uncertainty is itself the risk, because "we assumed we were exempt" is not a defence the OAIC accepts. A Deep Scan checks your specific business against the current rules and tells you plainly where you stand, rather than leaving you to guess from a turnover figure alone.

This is general information, not legal advice. For advice on whether the small business exemption applies to you, speak with a qualified privacy lawyer.