18/06/2026
🟢 Historically, Australian small businesses with an annual turnover under $3 million enjoyed a generous "small business exemption," meaning they didn't have to strictly comply with the Privacy Act. That era is coming to a close.
The Federal Government is progressively narrowing this loophole. Starting around mid-2026, the privacy net is widening significantly to pull in an estimated 100,000+ small businesses.
The Trigger: If your business buys, sells, or trades mailing lists, utilises advanced data-matching, or handles customer data at scale for digital marketing, you are likely losing your exemption.
The Marketing Impact: You will be legally required to have a clear, accurate Privacy Policy and explicit opt-in frameworks for data collection ... no more burying tracking terms in fine print.
The entire roadmap to removing or narrowing the small business exemption stems from the Attorney-General's Department. You can read the comprehensive report, individual submissions, and the official government response on the Attorney-General's Department Privacy Act Review Page.
But wait ... there's more.
The passing of anti-money laundering legislation expanding the AML/CTF Act explicitly strips the small business privacy exemption away from "reporting entities" regardless of their $3 million turnover footprint.
The Office of the Australian Information Commissioner (OAIC) estimates this captures more than 100,000 real estate agents, accountants, lawyers, and high-value dealers overnight because they are legally forced to handle strict "Know Your Customer" identification documents.