The Privacy Act 1988 is Australia's main federal privacy law. It regulates how Australian Government agencies and organisations with an annual turnover of more than $3 million (as of October 2026) handle personal information, through 13 Australian Privacy Principles (APPs). Most small businesses at or under $3 million aren't covered, but many are, regardless of size: health service providers (including gyms), businesses that trade in personal information, Commonwealth contractors and others.
The small business exemption is the part everyone has heard of, and it's narrower than people assume. Everything here comes from the Office of the Australian Information Commissioner (OAIC), which regulates the Act.
Who the Act covers
| Covered | Notes from the OAIC |
|---|---|
| Australian Government agencies | Plus the Norfolk Island administration |
| Organisations with turnover over $3 million | Individuals (including sole traders), companies, partnerships, unincorporated associations and trusts |
| Some small businesses, whatever their turnover | See the list below |
| Certain activities of anyone | Credit reporting, tax file numbers, health and medical research |
Annual turnover for this test means all income from all sources. It doesn't include assets held, capital gains or the proceeds of capital sales. If you haven't traded a full year, you project a full year's turnover from what you've earned so far.
Small businesses that are covered anyway
- Health service providers, which the OAIC says includes private hospitals, doctors, pharmacists, allied health, complementary therapists such as naturopaths and chiropractors, gyms and weight loss clinics, child care centres, private schools and private tertiary institutions.
- Businesses that trade in personal information, for example by selling a customer list, or swapping one list for another, without consent.
- Contractors providing services under a Commonwealth contract.
- Residential tenancy database operators and credit reporting bodies.
- Reporting entities under the AML/CTF Act 2006, for those activities.
- Registered employee associations, businesses accredited under the Consumer Data Right, and businesses related to a covered business.
- Businesses that have opted in, or that are prescribed by regulation.
The OAIC also asks whether your turnover has been over $3,000,000 in any financial year since 2002, so a business that shrank below the line can still be covered. Its privacy checklist for small business walks through these questions one by one.
The 13 Australian Privacy Principles
| APP | What it's about |
|---|---|
| 1 | Open and transparent management, including a clear, up-to-date privacy policy |
| 2 | Letting people stay anonymous or use a pseudonym where possible |
| 3 and 4 | Collecting solicited information (higher standards for sensitive information) and dealing with unsolicited information |
| 5 | Telling people about the collection |
| 6 | When you may use or disclose personal information |
| 7 | Direct marketing conditions |
| 8 | Steps before sending personal information overseas |
| 9 | Limits on adopting or using government identifiers |
| 10 and 11 | Keeping information accurate, and protecting it from misuse, loss and unauthorised access |
| 12 and 13 | Giving people access to their information and correcting it |
A breach of an APP is an "interference with the privacy of an individual" and can lead to regulatory action and penalties. If you're covered, APP 1 is where to start: our guide on whether a small business website needs a privacy policy covers the practical side.
Data breaches
Under the Notifiable Data Breaches scheme, any organisation or agency covered by the Act must notify affected individuals and the OAIC when a data breach is likely to result in serious harm. A breach includes a lost or stolen device with customer details, a hacked database, or information sent to the wrong person by mistake. The notice to individuals must recommend steps they should take, and you notify the OAIC through its online form.
What individuals can do
- Know why their information is collected, how it's used and who it's disclosed to.
- Ask for access to it, and have incorrect information corrected.
- Stop unwanted direct marketing.
- Complain to the OAIC if they think a covered business mishandled their information. The OAIC can investigate, conciliate and make determinations, and can open its own investigations.
If you're covered: a practical starting list
- Map what personal information you collect, where it's stored and who can see it.
- Publish a clear, up-to-date privacy policy (APP 1) and a collection notice where you gather details (APP 5).
- Check your marketing lists against the direct marketing conditions (APP 7), and give people an easy way to opt out.
- Before using overseas software or suppliers that hold customer data, check the cross-border rules (APP 8).
- Lock down access and decide when you'll destroy or de-identify data you no longer need (APP 11).
- Write down how you'll handle access and correction requests (APPs 12 and 13), and who decides whether a breach is notifiable.
None of this needs a big budget; most of it comes down to knowing where your customer data lives and who can reach it.
Tax file numbers: covered even if you're small
Even a business outside the APPs has rules if it handles tax file numbers: the Privacy (Tax File Number) Rule 2015 applies to TFN information. That matters for every employer collecting TFN declarations. Our guide to getting a TFN explains where the number comes from.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
The law keeps changing
The Act has been amended many times since it began in 1989. The APPs replaced the older principles on 12 March 2014, the Notifiable Data Breaches scheme arrived in 2018, enforcement powers were strengthened from 13 December 2022, and the Privacy and Other Legislation Amendment Act 2024 is commencing in stages. The OAIC says it's updating its guidance to reflect the 2024 changes, so check its site for the latest position.
The verdict
Don't assume the $3 million exemption covers you. If you run a gym, clinic, childcare service, or any business that shares customer lists, you're probably in. Run the OAIC's small business checklist, publish a privacy policy anyway (customers expect one), and have a plan for a data breach before you need it.
Frequently asked questions
Does the Privacy Act 1988 apply to small businesses?
Most small businesses with turnover of $3 million or less aren't covered, but some are regardless of turnover, including health service providers and businesses that trade in personal information.
How many Australian Privacy Principles are there?
There are 13 Australian Privacy Principles in the Privacy Act 1988.
Is a gym covered by the Privacy Act?
Yes. The OAIC lists gyms and weight loss clinics among health service providers, which are covered whatever their turnover.
Is reporting a data breach mandatory in Australia?
If the Privacy Act covers you, you must notify affected individuals and the OAIC when a data breach is likely to result in serious harm.
