The Privacy and Other Legislation Amendment Act 2024 received Royal Assent on 10 December 2024, and most of it came into effect immediately. Norton Rose Fulbright described it as the most substantial change to Australia’s privacy regime since the original act passed in 1988.

For small businesses, there are two separate questions: what’s already in force, and what’s still coming.

What changed on 10 December 2024

A new tort of serious invasions of privacy. Individuals can now sue another party directly for serious privacy breaches, without going through the regulator first. The tort came into effect on 10 June 2025. For businesses, this means a customer whose data you handle carelessly could pursue you in court.

Stronger regulator powers. The Office of the Australian Information Commissioner (OAIC) now has more tools to investigate, penalise, and publicise breaches. This matters even for small operators who assumed they were below the enforcement radar.

Security requirements. Clearer expectations now exist around how you store and protect personal information, not just “take reasonable steps” but evidence of actual measures implemented.

Automated decision transparency. If your business uses AI or automated systems to make decisions about individuals (credit assessments, job applications, service eligibility), you’ll need to disclose that and provide a way for people to request human review. There’s a two-year grace period, with a deadline of 10 December 2026.

Doxxing is now a criminal offence. Publishing someone’s personal information to harass or threaten them is now a criminal offence under the Criminal Code.

The $3 million exemption, not gone yet, but coming

The most-discussed proposed change, removing the $3 million annual turnover exemption that’s kept most small businesses outside the Privacy Act’s reach, has not been passed into law.

Under current law, if your business turns over less than $3 million a year, you’re generally exempt from the Privacy Act. Exceptions apply: health service providers, credit reporting bodies, and businesses that trade in personal information are covered regardless of size.

The exemption removal was flagged for a second tranche of reforms, but the first Albanese government held back ahead of the 2025 election. Following Labor’s re-election in May 2025, the reforms are expected to proceed. As of mid-2026, the exemption technically remains in place.

The practical advice from lawyers: don’t bank on it. Prepare as if it’s gone, because the direction is clear.

What this means day-to-day for a small business

Most small businesses collect more personal data than they realise: customer names and emails from booking systems, payment details through POS systems, staff records, CCTV footage, CRM data, and website analytics.

None of that goes away when privacy law tightens. What changes is your accountability for it.

Three things worth doing now:

Know what you collect. Build a simple list of every system that stores personal information, your booking platform, email list, CRM, loyalty program, payroll system.
Have a privacy policy. It doesn’t need to be written by a lawyer, but it needs to exist and be accurate. The OAIC has free templates at oaic.gov.au.
Know what to do if something goes wrong. Australia’s Notifiable Data Breaches scheme requires you to notify the OAIC and affected individuals if a breach is likely to cause serious harm. If you don’t have a basic response plan, write one.

The new privacy tort is the biggest immediate change for small businesses. The $3 million exemption removal is likely coming. Getting your data practices sorted now costs less than dealing with a complaint or claim later.

📬 Get the SmallBizAI.au Weekly

Practical AI news for Australian small businesses — every week, free.

📖 More deep dives: News Deep Dives

📬 The SmallBizAI Brief

One practical AI tip for Australian small business. Every Tuesday. Free.

Join business owners getting smarter about AI every week.

Subscribe free →