OAIC Privacy Act Reform 2026: What Australian Small Businesses Need to Watch

Australia’s privacy laws went through a major overhaul in late 2024. If you missed it, the Privacy and Other Legislation Amendment Act 2024 passed parliament in November and came into force in December, covering new rules on doxxing, a statutory tort for serious privacy invasions, and a Children’s Online Privacy Code framework. You can catch up on what’s already changed →

But that was just round one. The Attorney-General’s Department has been clear: more reforms are coming. The proposals that didn’t make the 2024 cut are still on the table, working their way through consultation and draft legislation. For small businesses that use AI tools to collect or process customer data, at least three of those proposals deserve serious attention.

The $3 million exemption: what it is and why it’s under pressure

Right now, the Australian Privacy Principles (APPs) only apply to private sector organisations with an annual turnover of $3 million or more. Businesses below that threshold, a café using a loyalty app, a sole trader collecting client emails, a tradie with a CRM, are generally exempt from the full Privacy Act obligations.

That threshold dates from 2000. The Privacy Act Review Report, released by the AG’s Department in February 2023, called it out directly: the $3M line is increasingly hard to justify when a small business using a cloud-based AI tool may be collecting and processing thousands of customer records.

The government’s September 2023 response agreed “in principle” to review the exemption. It hasn’t been legislated yet, but the direction is clear. The review is ongoing, targeted consultation is continuing in 2025–2026, and the OAIC has publicly supported removing or significantly narrowing it.

If the exemption goes, businesses currently sitting below $3M will face the full suite of APP obligations: privacy policies, data minimisation, purpose limitation, breach notification, and subject access rights. For businesses already using AI tools that profile customers, make recommendations, or process behavioural data, that’s not a minor compliance tweak.

AI-specific obligations: what’s coming on the horizon

The Privacy Act Review flagged automated decision-making as a specific gap in current law. The APPs don’t currently require businesses to tell customers when an AI system is making decisions about them, or give individuals any right to contest those decisions.

The proposals still working through consultation would change that in two ways:

• Transparency requirements: Businesses using automated systems to make decisions with material effects, credit assessments, service eligibility, pricing, would need to disclose that automated processes are involved and explain the logic in plain terms.
• Meaningful consent: Where sensitive personal information feeds AI systems (health data, financial history, behavioural profiles), consent requirements are expected to tighten. Burying it in page 12 of a terms-of-service document won’t cut it under the proposed framework.

These proposals haven’t been legislated yet. But the government has committed to progressing them, and the OAIC has indicated it will treat AI-related complaints as a priority as enforcement capacity grows. Businesses that build their AI data practices now around the proposed standards, not just the current minimums, will be better placed when the legislation lands.

Direct rights of action: the enforcement shift

One of the more consequential proposals still in pipeline: giving individuals a direct right to sue for privacy breaches, without needing to go through the OAIC first.

Currently, if a business mishandles your data, you complain to the OAIC, the OAIC investigates, and action (if any) flows from there. The process is slow and the OAIC is under-resourced relative to the volume of complaints. A direct right of action would let individuals take complaints straight to the Federal Court.

This matters for small businesses because it changes the risk equation. A class action brought by 500 customers whose data was processed without proper consent is a different kind of exposure than an OAIC conciliation. The proposal is still subject to consultation on thresholds and scope, but the direction of travel is toward more individual enforcement, not less.

OAIC’s enforcement trajectory

The OAIC’s budget and powers have grown since the 2022 penalty reforms, which lifted maximum fines for serious or repeated Privacy Act breaches to $50 million (or more, based on benefit obtained). The 2024 Amendment Act gave the OAIC additional investigation and information-sharing powers.

Commissioner Carly Kind, who took over in January 2023, has been direct about priorities: AI and data governance, children’s privacy, and the data practices of businesses that collect information at scale. The OAIC Annual Report for 2023–24 showed a 19% increase in privacy complaints received.

The regulatory environment is tightening. Not dramatically. The OAIC still resolves most complaints through conciliation rather than civil penalty action. But the trajectory is clearly toward more active enforcement, and the proposed reforms will give the OAIC more tools to act on it.

Three things to do now, before the reforms land

You don’t need to wait for legislation to get ahead of this. Three practical steps that will matter regardless of how the final reforms shake out:

1. Map what data your AI tools actually collect. If you use a CRM, booking system, chatbot, email marketing tool, or any AI-powered platform that touches customer data, list what personal information flows in, where it’s stored, and who else can access it. Most small businesses haven’t done this. It’s the foundation for everything else.

2. Check your consent language. Review how you currently collect consent for data use. If your privacy policy or sign-up flow hasn’t been updated in the last 12 months, it probably doesn’t reflect current practice, let alone what’s proposed. The OAIC has guidance on what meaningful consent looks like under the APPs, and it’s worth a read even before new obligations kick in.

3. Assign someone to watch the consultation process. The AG’s Department will publish draft provisions for public feedback before any remaining proposals become law. Subscribing to updates from the OAIC and AG’s website means you’ll see the changes before they’re final, not after. Industry associations like the Council of Small Business Organisations Australia (COSBOA) will also run submissions you can engage with.

The 2024 amendments were the first instalment. The harder questions about AI, automated decisions, and the $3M exemption are still being worked through. Small businesses that collect customer data through AI tools now are in the crosshairs of where these reforms are headed. Getting the basics right before the legislation lands is considerably easier than retrofitting compliance after the fact.

Sources: Attorney-General’s Department, Privacy | Government Response to the Privacy Act Review Report, September 2023 | Review of the Privacy Act 1988, AG’s Department | OAIC, Office of the Australian Information Commissioner

📊 Compare AI tools side by side | 💼 Free resources & AI prompt packs