Is the small business exemption still in force in 2026?

Yes. As of November 2026, the Privacy Act 1988 small business exemption (section 6D) is still in force. The $3 million annual turnover threshold still applies, meaning most small businesses remain exempt from the Act’s Privacy Principles. The Australian Government has proposed removing this exemption as part of broader Privacy Act reform, but that legislation has not passed Parliament. Until it does, the existing rules stand. For the official position, see the OAIC Privacy Act Review page.

One of the most significant proposed changes to Australian privacy law is the potential removal of the small business exemption from the Privacy Act 1988. Currently, businesses with annual turnover under $3 million are largely exempt from the Act’s requirements. If the exemption is removed: as the government has proposed: hundreds of thousands of Australian small businesses will have new legal obligations around how they collect, store, and use personal information, including data processed by AI tools.

What Is the Small Business Exemption?

The Privacy Act 1988 contains a general exemption for businesses with annual turnover of $3 million or less. This means most Australian small businesses: sole traders, small retail shops, local service providers, tradespeople: are not currently required to comply with the Australian Privacy Principles (APPs) that govern how personal information must be handled.

There are some exceptions: businesses that handle health information, run loyalty programs, or are related to larger entities are already covered regardless of turnover. But for most small businesses, the exemption has meant that formal privacy compliance has been optional.

What’s Changing?

The Australian Government’s Attorney-General’s Department has proposed removing the small business exemption as part of a broader overhaul of the Privacy Act. The rationale: digital technology: and particularly AI: means that even small businesses now collect and process significant amounts of personal data, and the $3 million threshold no longer reflects the reality of how data flows through the economy.

As of March 2026, the exemption has not yet been removed: but legislative reform is actively progressing. The government has indicated its intent to expand Privacy Act coverage, and small businesses should be preparing now rather than waiting for the law to change.

What Would Removal Mean for Small Businesses?

If the small business exemption is removed, businesses under $3 million turnover would need to:

Have a compliant privacy policy that explains what personal information you collect, why, and how it’s used
Only collect personal information that is reasonably necessary for your business functions
Give individuals the right to access and correct their personal information
Protect personal information from misuse, interference, loss, and unauthorised access
Notify affected individuals (and the OAIC) of eligible data breaches under the Notifiable Data Breaches scheme
Take reasonable steps to ensure overseas recipients of personal information protect it appropriately: relevant if you use US-hosted AI tools

The AI Connection

This is where AI tools become directly relevant. Many AI platforms, ChatGPT, Claude, AI-powered CRMs, marketing automation tools: process personal information. Under the current exemption, most small businesses don’t have formal obligations about this. Once the exemption is removed, using an AI tool that sends Australian customer data to overseas servers could create compliance obligations around cross-border disclosure of personal information.

This is one of the reasons we recommend small businesses consider AI tools with Australian data residency: it simplifies compliance regardless of what the law ultimately requires.

What Should Small Businesses Do Now?

Don’t wait for the law to change: start building good privacy habits now
Create or update your privacy policy: free templates are available from the OAIC’s small business privacy resources
Audit your AI tools: understand what personal data each tool processes and where it’s stored
Prefer Australian data residency where practical
Subscribe to OAIC updates: so you know when reform legislation is introduced

The businesses that will find compliance easiest are those that treat privacy as a practice rather than a legal checkbox. Good data hygiene is good business: it builds customer trust, reduces breach risk, and positions you well regardless of what the law ultimately requires.