Who must prepare for the proposed removal of the small business exemption?

Removing the Privacy Act small business exemption (<$3M turnover) is proposed for a future reform tranche — agreed in principle, not yet law.

Removing the Privacy Act's small business exemption (s 6D) — which currently exempts most businesses with annual turnover under $3M — was recommended in the Privacy Act Review and agreed in principle by the Government. It was NOT included in the first reform tranche (the Privacy and Other Legislation Amendment Act 2024). As of 2026 it remains proposed for a future ('second tranche') bill with no commencement date set. If enacted, roughly 2 million Australian SMBs would become 'APP entities' — requiring a Privacy Policy, lawful collection notices, NDB readiness, training, and access/correction processes. Businesses can prepare now, but no specific commencement date should be treated as fixed.

Applies when the business has not app holds pi.

How the regulator frames it: Any business currently relying on the small business operator exemption (annual turnover under $3M).

What triggers it: Commencement of a future bill removing the small business exemption (not yet introduced to Parliament).

Jurisdiction: Commonwealth law, so the test is the same in every state and territory.

Outcome across the 35 industries Rules Mate maps (24 of 35: depends on size or structure; 11 of 35: no).

Structure does not change the answer in the 24 industries it can reach: for every structure the answer is "depends on size or structure".

Each line is one run of the Rules Mate applicability engine for a single business profile, with the reason the engine gives:

• Pty Ltd company in fintech (non-bank) with 6–19 employees, turnover $1M–$3M: applies. Holds personal information but relies on the small business exemption (turnover under $3M)
• Pty Ltd company in real estate agents with 6–19 employees, turnover $1M–$3M: does not apply. Requires not app holds pi.
• Pty Ltd company in fintech (non-bank) with 500+ employees, turnover $100M–$1B: does not apply. Requires not app holds pi.

When due

Not yet legislated — proposed for a future privacy reform tranche.

Frequency

Ongoing

Evidence to keep

Privacy Policy, collection notices, breach response plan, staff training records, data inventory.

Status

Upcoming (not yet in force)

Priority

High

Maximum penalty: The standard Privacy Act penalty regime (up to $50M / 3× benefit / 30% turnover for serious or repeated interferences) would apply if and when the exemption is removed.

Rules Mate has not yet classified the audit or assurance level for this obligation. Any audit, review or certification requirement is set by the regulator source listed below.

• Publish a Privacy Policy that meets APP 1: Every APP entity needs a clearly-expressed Privacy Policy covering APP 1.4 requirements.
• Notifiable Data Breach (NDB) scheme: Under the NDB scheme, APP entities must notify the OAIC and affected individuals of an eligible data breach likely to cause serious harm — assessed within 30 days.
• APP 3 collection of sensitive information: APP 3 bars collecting sensitive information — health, race, religion, sexual orientation and more — without consent. What counts as sensitive, the exceptions and penalties.
• Automated decision-making transparency in your privacy policy (APP 1.7–1.9): From 10 December 2026, APP entities that use computer programs to make or substantially assist decisions that significantly affect individuals must say so in their APP privacy policy.
• APP 12 & APP 13 access and correction requests: Individuals can ask to access (APP 12) and correct (APP 13) the personal information you hold — the strict response times, allowable refusals and how to comply.

Across the 1,890 business profiles Rules Mate evaluates, these obligations apply to most of the businesses this one applies to, and are far more common among them than among businesses generally:

• Instant Asset Write-Off (annually re-set threshold): applies to 100% of the same businesses (1.5× the overall rate)

Rules Mate tracks 20 published obligations tagged "privacy", 3 of them rated critical. For a professional services Pty Ltd company with 6–19 employees operating in every state, 4 of those apply outright. This obligation is rated high priority, and is an ongoing duty.

Regulated by Office of the Australian Information Commissioner.

OAIC: Privacy and freedom of information regulator. Administers the Privacy Act 1988, the Notifiable Data Breaches scheme, and the Australian Privacy Principles.

• Office of the Australian Information Commissioner

Privacy Act 1988: Federal privacy Act.

• Privacy Act 1988

Free tools that help with this obligation:

• Privacy Act 2026 readiness
• NDB notification timer
• Marketing compliance check (Spam Act)