Does Privacy Act Reform — information controllers regime (proposed Tranche 2) apply to businesses with 1–5 employees?

Depends on size or structure (1–5 employees, turnover $100K–$1M).

Who must comply with Privacy Act Reform — information controllers regime (proposed Tranche 2)?

What the obligation is

Tranche 2 reforms in scoping — information controllers + processors regime.

Tranche 2 Privacy Act reforms under government consideration — controller/processor regime modelled on GDPR. Currently exposure-draft pending; in-force date TBC.

The applicability test

Applies when the business has APP-entity status (turnover > $3M or a s 6D(4) carve-out).

How the regulator frames it: TBC.

What triggers it: Pending.

Jurisdiction: Commonwealth law, so the test is the same in every state and territory.

Which industries are in or out

Outcome across the 35 industries Rules Mate maps (11 of 35: yes; 24 of 35: depends on size or structure).

Industry	Answer
Real estate agents	Yes
Accountants & bookkeepers	Yes
Lawyers & solicitors	Yes
Conveyancers	Yes
Trust & company service providers	Yes
Precious metals & stones dealers	Yes
Banks & ADIs	Yes
Aged care providers	Yes
NDIS providers	Yes
Health practitioners	Yes
Gambling & wagering	Yes
Fintech (non-bank)	Depends on size or structure
General insurers	Depends on size or structure
Superannuation trustees	Depends on size or structure
Credit licensees & mortgage brokers	Depends on size or structure
Medical devices & therapeutic goods	Depends on size or structure
Private health insurers	Depends on size or structure
Cafés & restaurants	Depends on size or structure
Hotels, pubs & licensed venues	Depends on size or structure
Retail trade	Depends on size or structure
E-commerce & online retail	Depends on size or structure
Construction (residential & commercial)	Depends on size or structure
Manufacturing	Depends on size or structure
Agriculture, forestry & fishing	Depends on size or structure
Mining & resources	Depends on size or structure
Road transport & logistics	Depends on size or structure
Aviation (incl. drones)	Depends on size or structure
Maritime & ports	Depends on size or structure
Education — registered training orgs	Depends on size or structure
Education — higher education providers	Depends on size or structure
Software & SaaS	Depends on size or structure
Professional services (general)	Depends on size or structure
Charities & not-for-profits	Depends on size or structure
Telecommunications carriers / CSPs	Depends on size or structure
Media & publishing	Depends on size or structure

Business structure and size

Structure does not change the answer across all industries: for every structure the answer is "depends on size or structure".

Size band	Answer across all industries, any structure
No employees (turnover $100K–$1M)	Depends on size or structure
1–5 employees (turnover $100K–$1M)	Depends on size or structure
6–19 employees (turnover $1M–$3M)	Depends on size or structure
20–99 employees (turnover $3M–$10M)	Yes
100–499 employees (turnover $10M–$100M)	Yes
500+ employees (turnover $100M–$1B)	Yes

Worked examples

Each line is one run of the Rules Mate applicability engine for a single business profile, with the reason the engine gives:

Pty Ltd company in real estate agents with 6–19 employees, turnover $1M–$3M: applies. AML/CTF reporting entity — covered by the Privacy Act for AML/CTF activities (s 6E(1A))
Pty Ltd company in fintech (non-bank) with 6–19 employees, turnover $1M–$3M: does not apply. Requires APP-entity status (turnover > $3M or a s 6D(4) carve-out)

Answers that bring it into scope

Starting from a small or large professional services company that does not otherwise meet the test, each of these single facts changes the engine's answer:

The business deals in crypto-assets or runs a digital currency exchange: it then applies (AML/CTF reporting entity — covered by the Privacy Act for AML/CTF activities (s 6E(1A))).
The business is a registered NDIS provider: it then applies (provides a health service and holds health information — not covered by the small business exemption (Privacy Act s 6D(4)(b))).
The business is an approved aged care provider: it then applies (provides a health service and holds health information — not covered by the small business exemption (Privacy Act s 6D(4)(b))).
The business supplies government customers: it then applies (government customer — contracted service providers to the Commonwealth are covered (Privacy Act s 6D(4)(e))).

What you must do, and when

When due: TBC.
Frequency: Ongoing
Evidence to keep: Pending.
Status: Upcoming (not yet in force)
Priority: High

Penalty for not complying

No maximum penalty is recorded for this obligation in the Rules Mate corpus; check the regulator source below.

Audit or assurance level

Rules Mate has not yet classified the audit or assurance level for this obligation. Any audit, review or certification requirement is set by the regulator source listed below.

Obligations that usually travel with it

What usually applies alongside it

Across the 1,890 business profiles Rules Mate evaluates, these obligations apply to most of the businesses this one applies to, and are far more common among them than among businesses generally:

Where it sits in the corpus

Rules Mate tracks 20 published obligations tagged "privacy", 3 of them rated critical. For a professional services Pty Ltd company with 6–19 employees operating in every state, 4 of those apply outright. This obligation is rated high priority, and is an ongoing duty.

Regulator, legislation and tools

Regulated by Office of the Australian Information Commissioner.

OAIC: Privacy and freedom of information regulator. Administers the Privacy Act 1988, the Notifiable Data Breaches scheme, and the Australian Privacy Principles.

Office of the Australian Information Commissioner

Privacy Act 1988: Federal privacy Act.

Privacy Act 1988

Free tools that help with this obligation:

Run the compliance journeyAnswer a short questionnaire about your business and get the obligations that apply to you, with the reason each one applies.

Questions

Who must comply with Privacy Act Reform — information controllers regime (proposed Tranche 2)?: Applies when the business has APP-entity status (turnover > $3M or a s 6D(4) carve-out).
Does Privacy Act Reform — information controllers regime (proposed Tranche 2) apply to sole traders?: Depends on size or structure. Across every industry and every size band, the engine's answer for a sole trader is: depends on size or structure.
Does Privacy Act Reform — information controllers regime (proposed Tranche 2) apply to businesses with 1–5 employees?: Depends on size or structure (1–5 employees, turnover $100K–$1M).
When is "Privacy Act Reform — information controllers regime (proposed Tranche 2)" due?: TBC.

Sources

Computed by the Rules Mate applicability engine from the published obligation corpus; facts last checked 3 October 2026. Rules Mate is not a law firm and this is general information, not legal advice. Confirm your position with the regulator source or a qualified adviser before acting.