The Privacy Law Change Every Australian Small Business Needs to Know Before December 2026

If you run a small business in Australia, privacy law is about to matter more than it ever has before.

Most business owners know privacy is important in theory. But for decades, the practical reality was simple: if your annual turnover was under $3 million, the Privacy Act largely did not apply to you. That era is ending — not in one sudden hit, but through a series of layered reforms that are already underway.

December 2026 is the next major marker on that timeline. Here is what you actually need to know.

What Is Changing — and What Is Already Law

It helps to separate what is confirmed from what is still proposed, because the two carry very different obligations right now.

What is already in force

Since June 2025, individuals can sue a business directly for a serious invasion of privacy — regardless of whether that business is covered by the Privacy Act. This statutory tort applies even to exempt small businesses. Getting privacy wrong is no longer just a regulatory risk; it is a litigation risk.

Since 1 July 2026, businesses in sectors such as real estate, accounting, law, and conveyancing have been pulled under the Privacy Act through expanded anti-money laundering reforms — even if their turnover sits well below $3 million. The Office of the Australian Information Commissioner estimates more than 100,000 small businesses were affected by that change alone.

What is confirmed for 10 December 2026

From 10 December 2026, any business already covered by the Privacy Act must disclose in its privacy policy whether it uses automated decision-making — any software or AI system that uses personal information to make decisions that could significantly affect a customer or employee. This includes automated pricing, AI-powered screening tools, algorithmic eligibility assessments, and similar processes. If you use it and it affects people, you will need to say so, clearly, in plain language.

What is proposed but not yet law

The most widely discussed change — removing the small business exemption entirely for businesses under $3 million turnover — has been agreed in principle by the federal government and is being progressed as a second tranche of reforms. As of October 2026, it is not yet legislated and has no confirmed commencement date. Treat it as coming, not as an obligation you have already missed.

Which Business Activities Are Most at Risk

Whether or not the exemption removal is confirmed in your timeframe, the direction is clear. If your business does any of the following, you have data exposure to think about right now:

• Customer databases and CRM systems holding names, emails, purchase history, or contact records
• Email marketing lists built without clearly documented consent
• Website contact and booking forms with bundled or vague opt-in language
• Automated tools that segment, score, or filter customers in any way
• Staff records including contractors and casual employees

Many small businesses built these systems quickly, without privacy architecture in mind. The gap between how data is actually handled and what current law expects is often larger than owners realise.

Three Practical Steps to Take Right Now

You do not need a legal team to make a meaningful start. These three actions are within reach for any small business owner this month:

1. Map your data

List every place your business collects personal information — forms, booking systems, email lists, your CRM, social media lead ads. Know what you hold, where it lives, and who can access it.

2. Review your consent mechanisms

Pre-ticked boxes, bundled opt-ins buried in terms and conditions, and vague authorisations are no longer acceptable. Consent must be informed, specific, voluntary, and current. If your forms are not there yet, fix them.

3. Update or create a privacy policy

If you do not have one, publish one. If you have one, check that it reflects your actual practices — particularly if you use any AI or automated tools that influence customer-facing decisions.

These steps protect you now. They also position you well ahead of whatever changes the second tranche of reforms brings.

Why Acting Early Is a Trust Signal

Here is the thing most compliance conversations miss: customers notice how you handle their data.

A business that is transparent about what it collects and why, that makes it easy to opt out, and that treats personal information with obvious care — that business earns trust. In an environment where public confidence in data handling has been shaken by a run of high-profile breaches, that trust is genuinely competitive.

Acting early on privacy is not just about avoiding fines. It is about being the kind of business people feel safe doing business with.

The December 2026 deadline is real. The direction of travel is unmistakable. The smartest move is to start before the pressure arrives — when you can do it calmly, not in crisis.

Frequently Asked Questions

Does the Privacy Act apply to my small business right now?

It depends. If your annual turnover is under $3 million and you are not in a sector affected by the AML/CTF reforms (such as real estate, law, or accounting), you may still be exempt from most obligations. However, the new statutory tort for privacy invasions applies regardless of your size, and the exemption is widely expected to be removed in a future reform tranche.

What happens if I use AI tools in my business?

From 10 December 2026, if you are covered by the Privacy Act and use software to make decisions that could significantly affect individuals — such as automated pricing, eligibility, or screening tools — you must disclose this in your privacy policy in plain language.

What if the small business exemption ends — how long do I have to prepare?

The government has flagged that a transition period and support measures will accompany the change if and when it becomes law. That means preparation now gives you a head start before the window narrows.

Is this legal advice?

No. This article provides general marketing and business guidance on the direction of Australian privacy law. For obligations specific to your business, consult a qualified legal professional.

Your data practices say a lot about how you run your business. If you would like to talk about how to build a more trustworthy customer experience — from the first touchpoint to long-term retention — start the conversation here.