Does the Australian Privacy Act apply to my small business?
The short answer
Usually not if your annual turnover is A$3 million or less: most small businesses are exempt. But the exemption doesn’t cover businesses that provide a health service and hold health information, and there are other exceptions. If the Act applies, you must follow the 13 Australian Privacy Principles and report serious data breaches.
Applies in Australia
If the Act applies to you
- APP 1: have a clear, up-to-date privacy policy.
- APP 3: collect only what you reasonably need. Health and other sensitive information generally needs consent.
- APP 6: use information only for the purpose you collected it, or a related one people would expect.
- APP 8: take reasonable steps before sending information overseas.
- APP 11: protect it, and destroy or de-identify it when you no longer need it.
- Notifiable data breaches: if a breach is likely to cause serious harm, assess it quickly (within 30 days) and notify the OAIC and the people affected.
Penalties for serious interferences with privacy can reach A$50 million for companies, or more depending on the benefit gained and turnover.
A new right to sue, which covers small businesses too
Since 10 June 2025, people can sue over a serious invasion of their privacy, such as intrusion into their private life or misuse of their information, where it was intentional or reckless. Unlike most of the Privacy Act, this applies to small businesses as well.
Even if you’re exempt from the principles, following them is good practice, and customers and partners increasingly expect it.
SlopDox provides compliance assistance only. This is general information to help you prepare — not legal advice, and no guarantee that a law does or doesn’t apply to you. For decisions, speak to a qualified lawyer.
Words used here
- Australian Privacy Act
- Australia’s main privacy law, built around 13 Australian Privacy Principles. Health businesses are covered whatever their size.
- Personal data
- Any information about an identifiable person — names, emails, addresses, health notes, photos. Privacy laws control how you collect, store and protect it.
- Data breach
- Personal data lost, stolen or seen by someone who shouldn’t see it. Many laws require you to report serious breaches within days.
Still have a question?
Ask the SlopDox assistant: it answers from this catalog, any time. Or let SlopDox keep track of your websites for you, free for up to 3 websites.