Does the Privacy Act apply to small business? A guide for app and software owners

Does the Privacy Act apply to small businesses?

Usually not, if your annual turnover is $3 million or less, but the exceptions are wide enough that many small businesses with an app are covered anyway. The OAIC’s own summary is that most small businesses are not covered by the Privacy Act 1988, but some are.

The test has two parts. First, turnover: a small business is one with annual turnover of $3 million or less, and the OAIC’s checklist asks whether you’ve exceeded $3 million in any financial year since 2002. Turnover means all income from all sources, but not assets held, capital gains or proceeds of capital sales. Second, the exceptions: if any one applies, you’re covered regardless of turnover.

If you’re covered, you have to comply with the Australian Privacy Principles (APPs), and the Notifiable Data Breaches scheme applies to you. If you’re not, you still have reasons to handle personal information carefully, covered below.

Which small businesses are covered regardless of turnover?

The OAIC lists the categories that bring a small business under the Privacy Act whatever its size. Several of them are common among businesses that build apps.

The Privacy Act covers a business that is	Examples relevant to apps and software
A health service provider	Clinics, allied health, telehealth, and apps that record or help manage someone’s health
Trading in personal information	Selling leads, sharing customer data for a benefit, or paying for personal information
A contractor providing services under a Commonwealth contract	A small developer building software for a federal agency
An operator of a residential tenancy database	Tenant screening tools
A credit reporting body	Credit scoring services
A reporting entity under the AML/CTF Act	Since 1 July 2026, many lawyers, accountants, conveyancers and real estate businesses
An employee association registered under the Fair Work (Registered Organisations) Act	Union membership platforms
A business that conducts protection action ballots	Ballot services
Accredited under the Consumer Data Right system	Fintechs receiving CDR data
Related to a business the Privacy Act covers	A small subsidiary of a larger group
Prescribed by the Privacy Regulation 2013	Specific businesses named in the regulation
Opted in to be covered	Businesses that chose to be covered

The OAIC also notes that some small businesses have other obligations under the Privacy Act even outside the APPs, such as the credit reporting rules in Part IIIA and the Privacy (Tax File Number) Rule 2015 for handling tax file numbers.

The 2026 AML/CTF change

This is the change small professional firms most often miss. AUSTRAC says that from 1 July 2026, businesses including lawyers, accountants, conveyancers, real estate professionals and dealers in precious stones and metals come under the AML/CTF regime, taking the number of regulated businesses from around 19,000 to close to 100,000. The OAIC lists AML/CTF reporting entities among the businesses the Privacy Act covers regardless of turnover.

So a small accounting practice or real estate agency that became a reporting entity this year should check with its lawyer how far the Privacy Act now applies to it. If you build or run software for these firms, such as client onboarding, identity checks or document portals, design it to the APPs.

Health service providers

Health is the other common trap. A small practice, a telehealth startup or a wellness app can be a health service provider, and health information is also “sensitive information” under the Privacy Act, with stricter rules on collection. Whether your app is a health service depends on what it does, so get advice before launch rather than after.

What do tranche 1 and tranche 2 change?

Tranche 1 is law and partly in force; tranche 2 is a draft that keeps the small business exemption. The timeline as at 8 November 2026:

Date	Change	Applies to small businesses?
10 December 2024	Privacy and Other Legislation Amendment Act 2024 receives Royal Assent (tranche 1)	Mostly to APP entities
10 June 2025	Statutory tort for serious invasions of privacy commences	Yes: the OAIC says it extends to individuals and entities that may not be APP entities
31 August 2026	Exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026 released (tranche 2)	Keeps the small business exemption
18 September 2026	Consultation on the exposure draft closes
By 10 December 2026	OAIC must finalise and register the Children’s Online Privacy Code	Applies to APP entities providing online services likely to be accessed by children
10 December 2026	Automated decision making transparency obligations in privacy policies begin	APP entities

What the tranche 2 exposure draft does

The Attorney-General’s Department says the bill “remains subject to further consideration by government”. Gadens’ summary notes that the draft introduces a single fair and reasonable test for collecting, using and disclosing personal information, that the small business exemption for businesses with turnover under $3 million has not been removed, and that commencement dates and transition periods are still blank. Gadens also reports that the Government intends to introduce the legislation before the end of 2026.

For small businesses, the most relevant drafted change is to the trading exception. The exposure draft rewrites subsection 6D(8) so that a business collecting personal information disclosed to it as a trade can remain a small business operator if it collects the information with the individual’s consent or as required or authorised by law. If your business model involves buying or selling personal information, such as lead generation, watch how this is finalised.

For automated decisions, see our guide to the Privacy Act automated decision making rules.

Can an exempt business still get into trouble?

Yes. Being outside the APPs doesn’t put you outside every privacy risk. Three examples:

1. The statutory tort. Since 10 June 2025, individuals can sue for serious invasions of privacy, and the OAIC says the tort reaches individuals and entities that may not be APP entities. Remedies can include damages, an injunction or an order to apologise.
2. Contracts. A larger customer, a government agency or an enterprise partner will usually require you to handle their data to the APPs or better, notify breaches within set times, and keep data in particular locations. Breaching those terms is a contract problem whatever the Privacy Act says.
3. Other laws. Spam, telemarketing, surveillance, health records and consumer law apply independently of the small business exemption, and some states have their own health records laws.

What should your app or software do anyway?

Build to the core privacy practices from the start, because they cost little at design time and a lot to retrofit. This checklist assumes you may be covered now, or later, or by contract:

Practice	What to build	Why it matters even if exempt
Privacy policy	A plain English policy covering what you collect, why, who you share it with and where it’s stored	Apple requires a privacy policy link for every app; many partners require one
Collection notices	Short notices at the point of collection, such as sign up and forms	Builds trust; required under APP 5 if covered
Minimal collection	Only fields you actually use; avoid collecting sensitive information you don’t need	Less data means less risk and simpler compliance
Security	Encryption in transit and at rest, access control by role, audit logs, patching	Required under APP 11 if covered; customers check it
Retention and deletion	Rules for how long each type of data is kept, and deletion that actually works	Limits the damage of any breach
Overseas disclosure	A list of every service that receives personal information and where it processes it	Required under APP 8 if covered; needed for questionnaires
Access and correction	A way for users to see and correct their information	Required under APPs 12 and 13 if covered
Breach readiness	Logging that shows what was accessed, and a written response plan	Needed to assess and notify under the NDB scheme

Our guide to notifiable data breaches covers what your logs and systems need to answer after an incident.

What if your app uses AI?

Using AI doesn’t change whether you’re exempt, but it changes how much personal information flows and where it goes. Sending customer conversations, documents or records to an AI model is a disclosure to that provider, often overseas. If you’re covered, APP 8 applies; if you’re not, your customers and partners will still ask.

Practical steps: check where the model provider processes and stores data, whether it uses your data for training, and whether an Australian region is available; strip or mask personal information before it reaches the model where you can; and note any AI processing in your privacy policy. Our guide to the Privacy Act and AI goes into detail, and AI for small business covers the wider decisions.

What if a bigger customer makes you sign privacy terms?

Read them as the real standard you’ll be held to, because for many small software businesses the contract is stricter than the law. Common clauses:

• Comply with the APPs as if you were an APP entity
• Notify the customer of any suspected breach within a short window, sometimes 24 to 72 hours
• Keep data in Australia, or in named locations
• Use only approved subcontractors, including cloud and AI providers
• Allow audits or answer security questionnaires
• Delete or return data when the contract ends

Before signing, list the services your software uses and where they process data, and check your logs could tell you what was accessed in an incident. If you can’t meet a clause, negotiate it before you sign rather than discovering it during a breach.

How AWLabs approaches privacy in small business software

We build software as if the Privacy Act applies, because for many clients it does or will, and because it rarely costs much at design time. That means minimal collection, role based access, encryption, audit logs, retention rules, Australian cloud regions where clients need them, and a record of every service that receives personal information. Senior engineers lead every build.

We don’t decide whether the Privacy Act applies to you, and we don’t make anyone compliant: your lawyer or privacy adviser does that, and we build to their requirements and give them the evidence. If you’re unsure, start with the OAIC’s small business checklist. Our cybersecurity and secure development service explains the controls we build in.