What the Australian Privacy Act Actually Means for Your Small Business
Australian SMEs are covered by the Privacy Act 1988 if they have an annual turnover above $3 million, or if they trade in personal information or provide health services. If you are below the threshold, you are not legally required to comply — but your customers, your landlord, and the larger companies you supply to will increasingly expect you to act as if you were.
What you need
You do not need a 50-page privacy manual. You need three things: a real privacy policy on your website (not a copy-pasted one), a short written breach response plan, and staff who know what to do when a laptop goes missing.
Your privacy policy should tell people what you collect, why you collect it, who you share it with, and how they can ask to see it. It should be written in plain English, not legal jargon. If you are not sure yours is good enough, put it in front of a customer who is not technical — if they cannot understand it, rewrite it.
The Notifiable Data Breaches scheme
If a breach is likely to result in serious harm, you must notify the affected individuals and the Office of the Australian Information Commissioner within 30 days. We write a one-page breach response plan for consulting retainer clients: who calls whom, what the notification says, and the technical response.
Practical steps for a small business with no privacy officer
Start with an inventory. Write down every piece of personal information your business holds: customer names and emails, staff records, supplier banking details, loyalty program data. Then write down where it lives — Xero, the CRM, a folder on the server, someone's personal email. Most SMEs are surprised by how scattered their data is.
Next, fix the obvious gaps. Stop emailing patient or customer PDFs to personal accounts. Turn on MFA for every system that holds personal data. Make sure your backup works. Then write a one-page breach response plan: who calls whom, in what order, within what timeframe.
If you are a health service or handle sensitive health information, the requirements are stricter — that is when you should bring in a privacy lawyer and let us do the technical implementation.
Want a privacy health check?
Book a free 30-minute call. We will look at your current privacy policy and tell you what is missing.
Book a Free ConsultationFrequently Asked Questions
Does the Privacy Act apply to my small business?
It applies to most businesses with an annual turnover over $3 million, and to some smaller ones that handle sensitive or health data, or trade in personal information. The threshold is tightening, so the safer assumption is that it applies to you.
Do I need a 50-page privacy manual?
No. You need three things: a real privacy policy on your website (not a copy-pasted one), a short written breach-response plan, and staff who know what to do when a laptop goes missing. That covers the vast majority of SME obligations.
What do we do if we have a data breach?
If the breach is likely to cause serious harm, the Notifiable Data Breaches scheme requires you to notify the OAIC and affected individuals promptly. Having a written plan beforehand means you act fast instead of improvising in a panic.