Small Business Privacy Policy Australia: The $3M Test
The Privacy Act 1988 treats a business with annual turnover of $3 million or less as a small business, and most are not covered. Here is who is still caught, what the OAIC says a policy must do, and what to put on your site.
Vikas Thakur Founder, RockingWeb 6 min read 
Key takeaways
- A small business, for the Privacy Act, has annual turnover of $3 million or less, counted across all income
- The OAIC says most small businesses are not covered, but 7 situations in its Notifiable Data Breaches guidance bring one back in
- Opting in under section 6EA costs $0 in fees, and you need a privacy policy first
- In OAIC’s January to June 2023 report, 87% of notified breaches involved contact information, the data a website form collects
- The OAIC pages read on 3 November 2026 still describe the $3 million test
As at 3 November 2026, the OAIC says most Australian businesses with annual turnover of $3 million or less are not covered by the Privacy Act 1988, unless an exception applies.
That is good news if you run a trade, a retail shop or a service business in Rockingham, Baldivis, Mandurah, Cockburn or anywhere in Perth. It does not mean you can ignore privacy. Your website collects names, emails and phone numbers every time someone fills in a form. This guide shows you how to test whether the Act reaches you, and what to publish either way.
What the OAIC says about small business
The Office of the Australian Information Commissioner (OAIC) defines a small business as one with annual turnover of $3 million or less. It adds that turnover “includes all income from all sources” and leaves out assets held, capital gains and proceeds of capital sales.
Most small businesses are outside the Act. The OAIC says some are not.
Takeaway: the $3 million line is a starting point, not a finish line. The exceptions decide whether you are in.
The 7 situations that pull a small business back in
The OAIC’s Notifiable Data Breaches guidance lists when a small business operator must comply with the Australian Privacy Principles (APPs). You are in if your business:
| Situation | What it means in plain terms |
|---|---|
| Holds health information and provides a health service | Health providers are covered whatever their turnover |
| Is related to an APP entity | A subsidiary of a covered business can be caught |
| Trades in personal information | You disclose personal details for a benefit, service or advantage, or collect them from others for one |
| Is a credit reporting body | Credit reporting sits under its own rules |
| Is an employee association registered under the Fair Work (Registered Organisations) Act 2009 | A specific registered-association case |
| Holds Consumer Data Right accreditation | Accredited under the Competition and Consumer Act 2010 |
| Has opted in under section 6EA | A voluntary choice, covered below |
The OAIC also says a small business that carries on certain activities, such as providing services to the Commonwealth, must comply for the personal information connected with those activities.
Takeaway: if you sell, swap or share customer lists for any benefit, you are probably trading in personal information. Read that row twice.
What a privacy policy has to do under APP 1
APP 1 asks for “a clearly expressed and up-to-date privacy policy describing how it manages personal information”. The OAIC says that policy should be published on the entity’s website.
If you opt in, the OAIC wants a link to the policy with your application. It says applications from businesses without a policy “will be declined”.
Why your website form matters
Think about what your contact form collects. A name. An email. A phone number. In the OAIC’s January to June 2023 Notifiable Data Breaches report, contact information turned up in 87% of notified breaches. Identity information appeared in 64%. Financial details appeared in 40%.
Those figures come from breaches reported to the OAIC, so they describe covered entities. They still tell you which data attackers go after, and a form on your site gathers exactly that.
What to put on your website
- Say what you collect: name, email, phone, enquiry text, and anything you add to a booking or quote form.
- Say why you collect it and who sees it, including your email provider and any form tool.
- Say how someone can ask to see or correct their details, and give a real contact address.
- Link the policy in your footer and beside each form.
- Put a date on it, then review it when you change a form, a tool or a supplier.
If you are not covered, a short, plain policy still tells customers what you do with their details. If you might trade in personal information, take advice before you publish.
This is general information, not legal advice. The OAIC says to complete its checklist or seek advice from your industry association or lawyer. Whether the Privacy Act applies to your circumstances is a question for your lawyer.
Frequently Asked Questions
Does my small business need a privacy policy in Australia?
Not always under the Privacy Act. The OAIC says most small businesses with annual turnover of $3 million or less are not covered, but some are, for example businesses that provide a health service or trade in personal information. Check the exceptions above, then ask your lawyer if you are unsure.
What counts as annual turnover?
The OAIC says annual turnover includes all income from all sources. It does not include assets held, capital gains or proceeds of capital sales.
Can a small business choose to follow the Privacy Act?
Yes. Section 6EA lets a small business opt in and be treated as an organisation under the Act. The OAIC says it does not charge a fee, and it declines applications from businesses that have no privacy policy.
Where should the privacy policy live on my website?
The OAIC says an APP 1 privacy policy should be published on the entity’s website. A link in the footer of every page, and next to any form that collects personal details, makes it easy to find.
Need a hand with your forms?
If your site collects enquiries, we can check what each form gathers and where it goes. See web design in Rockingham, or the pages for Baldivis, Mandurah and Cockburn. To talk it through, get in touch.
Sources
OAIC, Small business
. Source of the $3 million definition and the turnover rule. Read 3 November 2026.OAIC, Opting in to the Privacy Act
. Source of section 6EA, the no-fee statement and the APP 1 policy wording. Read 3 November 2026.OAIC, Part 4: Notifiable Data Breach (NDB) Scheme
. Source of the list of small business exceptions. Read 3 November 2026.OAIC, Notifiable Data Breaches Report: January to June 2023
. Source of the 87%, 64% and 40% figures. Read 3 November 2026.
Last reviewed: 3 November 2026.
Vikas Thakur
Founder of RockingWeb. 16 years of experience from working at TPG, iiNet and Monadelphous, now building websites, software and digital marketing for local businesses in Rockingham and Perth.
