The Privacy Law Change Every Australian Small Business Owner Needs to Know About Before December
Most Australian small business owners have built their customer databases, email lists, and online forms without giving privacy compliance much thought. And for years, that was fine — the Privacy Act 1988 largely exempted businesses turning over less than $3 million annually.
That's changing. And if you haven't looked at this yet, now is the time.
What's Actually Changing
The Australian Government passed the Privacy and Other Legislation Amendment Act 2024, which introduced a series of reforms to the Privacy Act 1988. Some of those changes are already in force. Others are rolling in progressively through 2026.
One of the most significant upcoming changes: from 10 December 2026, businesses that use automated decision-making processes that significantly affect individuals will need to be transparent about it. If you use a CRM, AI-driven email sequences, or automated lead scoring, this could apply to you.
Beyond that, the government is actively consulting on removing the small business exemption altogether. If that change proceeds, every Australian business — regardless of revenue — would need to meet the full requirements of the Privacy Act.
Even if the exemption removal isn't yet law, the direction of travel is clear. Businesses that act now will be ahead of the curve, not scrambling when the deadline hits.
Which Activities Are Most at Risk?
If you're a small business that collects, stores, or uses customer information in any of the following ways, you need to pay attention:
- Customer databases — Do you know exactly what personal information you hold, where it's stored, and how long you keep it?
- Email marketing lists — Are you collecting consent in a way that's clear, specific, and documented?
- Lead forms and enquiry forms — Do your online forms include a current, accurate privacy notice?
- CRM systems and automated tools — If your software makes decisions about customers or contacts automatically, is that disclosed anywhere?
The risk isn't just regulatory. Customers are paying more attention to how businesses handle their data. A privacy breach — or even the appearance of careless data handling — can damage trust in a way that's difficult to recover from.
Three Steps to Take Right Now
You don't need to become a privacy lawyer. But you do need to take a few practical steps before December arrives.
1. Audit What You Collect
Start with a simple review: what personal information does your business collect? Where does it go? Who has access? A basic document mapping your data flows is a practical starting point — it doesn't need to be complicated, just accurate.
2. Review Your Privacy Notice
Your website should have a privacy policy that reflects how you actually handle data today — not a boilerplate document from five years ago. If you use automated tools or share data with third-party software, that should be clearly disclosed. If you use automated decision-making, this becomes especially important from December.
3. Check Your Consent Mechanisms
When someone fills in your enquiry form or joins your email list, are they clearly told what they're signing up for? Vague tick boxes or pre-ticked consent fields won't hold up under updated standards. Make sure your opt-ins are explicit, specific, and documented.
If you're unsure where to start, a conversation with a qualified privacy professional or business advisor is a worthwhile investment before the December deadline.
Acting Early Is a Trust-Building Move
Here's the thing: getting your privacy practices in order isn't just about avoiding penalties. It's about becoming the kind of business customers feel safe doing business with.
Buyers today are increasingly aware of their data rights. Businesses that handle personal information with care — and communicate that clearly — build a level of trust that translates directly into loyalty and referrals.
The Privacy Act changes are a signal, not just a compliance task. They reflect a broader shift in what customers expect from the businesses they choose to support. Getting ahead of it now puts you in a stronger position commercially, not just legally.
The deadline is closer than it feels. A few focused hours this month could save you a great deal of disruption later.
Frequently Asked Questions
Does the Privacy Act currently apply to my small business?
Currently, most businesses with annual turnover under $3 million are exempt from the Privacy Act. However, this exemption is under active government consultation and may be removed. Certain business types — including health service providers and some financial services businesses — are already covered regardless of size. Check with a privacy professional if you're unsure.
What is the December 2026 Privacy Act deadline?
From 10 December 2026, new obligations around automated decision-making transparency come into force under the Privacy and Other Legislation Amendment Act 2024. Businesses using automated tools that significantly affect individuals will need to disclose this clearly in their privacy notices.
What should my privacy policy include?
At minimum: what personal information you collect, why you collect it, how it's stored, who you share it with, how long you keep it, and how individuals can access or correct their information. If you use automated tools that make decisions about customers or contacts, include that disclosure too.
Is this just a big-business issue?
Not for much longer. The government's consultation on removing the small business exemption signals that compliance will eventually extend to businesses of all sizes. Treating it as a future problem is the approach most likely to create a costly scramble later.
This article provides general information only and does not constitute legal or regulatory advice. We recommend consulting a qualified privacy professional for guidance specific to your business.
Want to get your business systems and customer experience running smoothly? Book a conversation with Jay →
