Under $3 million doesn’t always mean exempt, and Google, Meta and Stripe expect a policy anyway. Here is who needs one, what changed, and what to write.
The short answer
If the Privacy Act covers your business, you must have a clear, up-to-date privacy policy, usually on your website. Most businesses with annual turnover of $3 million or less are exempt, but many small businesses are covered anyway, including health and allied health providers, gyms that record health details, childcare centres, businesses that pay for or sell personal information without consent, and anyone whose turnover has been over $3 million in any year since 2002. As at 31 October 2026, the small business exemption has not been removed. Even if you are exempt, you will usually still need one: if you use Google Analytics, Google Ads lead forms, the Meta pixel, Stripe or the app stores, their terms require a privacy policy or privacy notice. Write your own from the checklist below rather than copying another business’s.
Government pages give different impressions, some law firm articles say the exemption is gone when it isn’t, and most templates online are written for other countries or other businesses. Below is who has to have a privacy policy in Australia, what changed between 2024 and 2026, and a fill-in outline you can adapt.
It is general information from the Office of the Australian Information Commissioner (OAIC) and other official sources, checked on 31 October 2026. It isn’t legal advice. The last section explains when to get a lawyer to look at your situation.
Do I need a privacy policy on my website?
It depends on whether the Privacy Act 1988 covers your business. The OAIC puts it simply: “Most small businesses are not covered by the Privacy Act 1988, but some are.”
A business the Act covers is called an APP entity, after the Australian Privacy Principles. The first principle says “An APP entity must have a clearly expressed and up-to-date APP Privacy Policy about how it manages personal information”, and must make it available free, “usually on its website”.
So the legal requirement applies to APP entities. If you are not one, the Privacy Act doesn’t require a policy, but the platforms you use often do, as explained further down.
The $3 million exemption, and who it doesn’t cover
Under the Privacy Act, a small business is one with annual turnover of $3 million or less. Two details matter:
- Turnover means “all income from all sources”, not just sales.
- The OAIC’s checklist asks whether your turnover was more than $3 million “in any financial year since 2002”. A business that was over the line once and later shrank may still be covered.
The OAIC lists businesses that are covered “Regardless of turnover”. The ones most likely to apply to a small business are:
| If your business | Examples |
|---|---|
| Provides a health service and holds health information | Doctors, dentists, physios, psychologists, naturopaths and chiropractors. The OAIC also names “a gym or weight loss clinic”, “child care centres” and “private schools and private tertiary educational institutions”. |
| Trades in personal information | A business that pays for leads or customer lists, or sells, swaps or passes on customer details for a fee or favour, without each person’s consent. |
| Is a contractor to the Australian Government | A business providing services to or for Australian Government agencies under a Commonwealth contract or subcontract. |
| Is a reporting entity under anti-money laundering law | Since 1 July 2026, AUSTRAC’s obligations reach accountants, lawyers, conveyancers and real estate agents who provide the services AUSTRAC now regulates. The OAIC says these businesses must follow the privacy principles “for your activities in relation to the AML/CTF Act”. |
| Is related to a covered business | A company that is a subsidiary of, or shares a parent company with, a covered business. |
| Runs a tenancy database, is a credit reporting body, or has opted in | Less common, but these are covered too. |
If you are not sure, work through the OAIC’s small business checklist.
Has the small business exemption been removed?
No. As at 31 October 2026 the exemption is still in place, despite some articles saying otherwise.
The government released a draft of the next round of privacy reforms on 31 August 2026, and consultation closed on 18 September 2026. The draft bill doesn’t remove the exemption. Law firm Gilbert + Tobin’s summary says: “Most notably, the Bill does not address the small business exemption or the employee records exemption”. The Attorney-General’s Department says the bill “remains subject to further consideration by government.”
The exemption could still go in a future bill, so it is worth writing a policy now rather than scrambling later.
Why most small businesses need one anyway
Even if the Privacy Act doesn’t cover you, the tools on your website probably require a privacy policy in their terms:
| If you use | What the terms say |
|---|---|
| Google Analytics | “You must post a Privacy Policy and that Privacy Policy must provide notice of Your use of cookies”, and “You must disclose the use of Google Analytics, and how it collects and processes data.” |
| Google Ads lead forms | “When you create a lead form in Google Ads, you need to provide a link to your privacy policy.” Remarketing lists have their own privacy policy requirements. |
| Meta pixel on your website | Meta’s Business Tools Terms require “a clear and prominent notice on each web page where our pixels are used that links to a clear explanation” of how data is collected and used. |
| Stripe payments | Stripe’s data processing agreement says you “must provide all necessary notices (including by making available a Privacy Policy)” to your customers. |
| An app on Apple or Google Play | Apple: “All apps must include a link to their privacy policy”. Google Play requires “a valid privacy policy” in the store listing and the app. |
State health records laws matter too. Victoria’s Health Records Act applies to private businesses that handle health information in Victoria, and the Victorian health department says “There is no ‘small business’ exemption.” New South Wales and the ACT have their own health records laws, so health businesses there should check with their state regulator.
Customers expect it. In a 2023 r/australia thread about the exemption, one of the replies read: “If you can’t comply with the privacy requirements, don’t collect people’s data, simple really.”
What changed between 2024 and 2026
- Fines for poor privacy policies. Since 11 December 2024, the OAIC can issue infringement notices to covered businesses whose policy is missing, unclear or out of date, or leaves out required information. The OAIC says one contravention can mean “up to 60 penalty units for a body corporate (currently $21,840)”, or $4,368 for an individual.
- A right to sue for serious invasions of privacy. This started on 10 June 2025. The OAIC says it is “broader in application than the Privacy Act, extending to individuals and other entities that may not necessarily be an Australian Privacy Principle entity.” In other words, the small business exemption doesn’t protect you from it. It is aimed at serious intrusions into someone’s private space and serious misuse of information about them.
- AI and automated decisions, from 10 December 2026. Covered businesses must explain in their privacy policy when a computer program uses personal information to make, or substantially help make, a decision that “could reasonably be expected to significantly affect the rights or interests of an individual”. The OAIC says generative AI and chatbots count as computer programs. Using AI to write a newsletter isn’t a decision about a person. Using software to approve or decline refunds, screen job applicants or set someone’s price could be.
What a privacy policy must include in Australia
For covered businesses, the Privacy Act lists what the policy must include. The same list makes a sensible policy for anyone. In plain English, say:
- What you collect. Names, phone numbers, emails, addresses, booking details, payment details (usually handled by your payment provider), and anything sensitive such as health information.
- How you collect it. Enquiry and booking forms, phone, email, in person, cookies and analytics, ad pixels, and other businesses that refer customers to you.
- Why you use it. To answer enquiries, deliver the work, send invoices, and send marketing if people agree to it.
- Who you share it with. The kinds of provider you use, such as your CRM, email platform, booking system, accountant, IT support and AI tools.
- Whether it goes overseas. Say if any of those providers store or process information outside Australia, and name the countries where you can.
- How people can see and correct their information. Who to contact and what happens next.
- How to complain, and how you’ll handle it. Who to contact, how quickly you’ll respond, and that they can go to the OAIC if they aren’t satisfied.
- When you last updated it. The law requires an up-to-date policy, so date it and review it.
The OAIC’s guide to writing a policy adds three useful tests. Check that it “does not use words such as ‘may’” when you actually do the thing. Check that it “is not simply based on a generalised template used by a different entity”. And keep any summary version to “no more than 500 words”, with a link to the full policy.
AI tools, overseas cloud services and your privacy policy
If you paste customer emails into ChatGPT or Copilot, or have a chatbot on your website, this part matters. The OAIC’s guidance on AI products says “Businesses should update their privacy policies and notifications with clear and transparent information about their use of AI”, and that public-facing tools such as chatbots should be “clearly identified as such”.
Two things to check:
- Where your providers process data. If a covered business sends personal information to an overseas provider, the OAIC says it remains “accountable for any acts or practices of the overseas recipient” in most cases. Many AI and cloud tools process data in the United States. Your policy should say so.
- What you actually put into AI tools. The simplest way to keep your policy honest is to keep customer details out of AI tools that don’t need them. Our guide to what customer information to keep out of AI tools covers this, and our one-page AI policy template turns it into a rule for your team.
Enquiry forms: the notice most websites forget
A privacy policy page isn’t the only requirement for covered businesses. When you collect personal information, you also need to tell people at the time, or soon after, who you are, why you are collecting it, who you usually share it with (including overseas) and where to find your policy. For online forms the OAIC suggests “clearly and prominently displaying the APP 5 matters in the form, or providing a readily accessible and prominent link” to a notice. A short line under the submit button does the job:
We’ll use your details to reply to your enquiry and, if you go ahead, to provide our services. [Only if true:] We don’t sell or trade your information. Read our privacy policy [link] for how we store it, who we share it with and how to contact us about it.
Link “privacy policy” to your own policy page. Add a separate, unticked box if you want to send marketing emails, because the Spam Act requires consent before you send them.
Privacy policy template for a small business in Australia
Use this fill-in outline as a starting structure. Replace every bracket with what you actually do and delete what doesn’t apply. Health service providers and other covered businesses need more than this outline, so have a lawyer review yours.
Privacy policy for [business name] (ABN [number])
Last updated: [date]
Who we are
[Business name] is a [type of business] in [town or area]. If you have a question about privacy, contact [name or role] at [email] or [phone].
What we collect
When you contact us or use our services we collect [your name, phone number, email, address, details of the job]. [If relevant: We collect health information, such as [injuries or allergies], only with your consent and only when we need it to provide our service safely.] We don’t collect your card details. Payments are handled by [payment provider].
How we collect it
Through our website forms, by phone, email and in person. Our website uses [Google Analytics / the Meta pixel] to understand visits and show ads, using cookies. You can block cookies in your browser. [If you use Google Analytics: link to Google’s page “How Google uses information from sites or apps that use our services”.]
Why we use it
To reply to your enquiry, quote, book and do the work, send invoices and keep records we are required to keep. We send marketing emails only if you agree, and every email has an unsubscribe link.
Who we share it with
Only providers that help us run the business: [CRM], [email platform], [booking system], [accountant], [IT support]. We use [AI tool] to help draft [replies / documents]. [We remove names and contact details before using it. / We put the details of your enquiry into it, and it processes them in [country].] [Only if true:] We don’t sell or trade your information.
[Only if it applies: Automated decisions]
[If software or AI makes or substantially helps make decisions about you, such as [refunds or approvals]: what it decides and what information it uses.]
Overseas
Some of these providers store or process information in [countries, for example the United States].
Keeping it safe
We use [password-protected accounts with two-factor sign-in]. We keep records for [period] and then delete them.
Seeing or correcting your information
Contact us at [email]. There’s no charge to ask. We’ll reply within [30 days].
Complaints
Contact us first at [email]. We’ll acknowledge your complaint within [5] business days and aim to resolve it within [30] days. If you aren’t happy with our response, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.
Mistakes to avoid
- Copying another website’s policy. It won’t describe what you actually do, and the OAIC warns against policies based on “a generalised template used by a different entity”. One commenter in an r/AusLegal thread was blunter: “Did you copy it off someone else’s website - thats copyright infringement.”
- Using a European or American template. Terms like “lawful basis” and “data protection officer” come from Europe’s GDPR. They don’t match the Australian principles and often miss Australian specifics, such as naming the countries your data goes to and how to complain to the OAIC.
- Treating the policy as protection. A privacy policy explains what you do. It doesn’t make careless handling acceptable.
- Setting and forgetting. Update it when you add a new tool, start using AI with customer information, or start collecting something new. Put a yearly review in your calendar.
When to see a lawyer
A plain-English policy built from the outline above is a reasonable start for many small businesses that aren’t covered by the Privacy Act. Get legal advice if:
- you provide a health service, or handle health information in Victoria, New South Wales or the ACT
- you are an accountant, lawyer, conveyancer or real estate agent with new anti-money laundering obligations
- your turnover has ever been over $3 million, you are part of a group of companies, or you work under a Commonwealth contract
- software or AI helps make decisions about customers or job applicants, such as approvals, refunds, pricing or screening
- you collect information about children, or sell, buy or share customer data with other businesses
- you have had a data breach or a complaint
Sources
Official guidance:
- OAIC, Small business, What is a health service provider? and Rights and responsibilities
- OAIC, APP Guidelines chapter 1, chapter 5 and chapter 8
- OAIC, Guide to developing an APP privacy policy and Guidance on privacy and the use of commercially available AI products
- OAIC, Infringement notices and Statutory tort for serious invasions of privacy
- Attorney-General’s Department, Privacy reform consultation, and Gilbert + Tobin, One giant leap: Tranche 2 of Privacy Act reform
- AUSTRAC, Obligations for tranche 2 reporting entities (PDF)
- business.gov.au, Protect your customers’ information; Victorian Department of Health, Health Records Act; ACMA, Avoid sending spam
Platform terms:
- Google Analytics terms, Google Ads lead forms, Meta Business Tools Terms, Stripe data processing agreement, Apple App Store Review Guidelines and Google Play user data policy
Discussions:
Checked on 31 October 2026. Privacy law is changing, so check the OAIC website for updates, especially after 10 December 2026 and if a new privacy bill is introduced. This guide is general information, not legal advice.
Practical thinking on AI, automation and the work behind a business.
