For decades, most small businesses in Australia were simply exempt from the Privacy Act. If your turnover was under a threshold, the rules largely didn’t apply to you. That’s changing. Reforms are removing the long-standing small-business exemption. From late 2026, millions of businesses that never had formal privacy obligations will be brought under the law for the first time. Understanding what the Privacy Act for small business now requires — and starting to prepare before the deadline — has become a genuine priority rather than a someday task.
This guide explains what’s changing, what the Privacy Act for small business will require, and how to get ready — written in plain terms for Australian trades, construction and professional-services owners. It’s general information, not legal advice, and the details are still developing, so confirm the current rules.
WHAT IS THE PRIVACY ACT FOR SMALL BUSINESS?
The Privacy Act is Australia’s main law governing how organisations collect, use, store and disclose personal information — the details about identifiable people, such as your customers and staff. Historically it applied mainly to larger businesses and certain sectors, with a broad exemption for small businesses under a turnover threshold.
That exemption is being removed. The practical effect is that the Privacy Act for small business is shifting from “probably doesn’t apply to me” to “applies to almost everyone”, bringing a large number of previously exempt businesses into scope for the first time.
WHAT’S CHANGING IN 2026
The reforms are being phased in, with the removal of the small-business exemption commencing in late 2026. Millions of Australian businesses that previously had no formal privacy obligations will become regulated. That’s a significant shift, and it means the Privacy Act for small business now demands attention from a huge share of the country’s businesses.
The stakes are real, too. The regulator has stronger enforcement powers and the ability to issue penalties for breaches of core obligations. This includes not having a compliant privacy policy. The Privacy Act for small business isn’t just paperwork — non-compliance can carry meaningful consequences.
WHAT IT WILL REQUIRE OF YOU
While the detail depends on your business and the final rules, the core obligations centre on handling personal information responsibly:
- A privacy policy — a clear, compliant policy explaining how you handle personal information.
- Collect only what you need — limiting the personal information you gather to what’s genuinely necessary.
- Keep it secure — protecting the data you hold against loss, misuse and breaches.
- Use it properly — only for the purposes you collected it, with appropriate transparency.
- Handle requests and breaches — being able to respond to access requests and data breaches appropriately.
None of this requires becoming a privacy lawyer. The Privacy Act for small business is mostly about handling people’s information fairly, securely, and transparently. It focuses on practical data management rather than just meeting formalities.
HOW TO PREPARE
1. Do a data audit
Work out what personal information you collect, where it’s stored, who can access it and who you share it with. You can’t comply with the Privacy Act for small business without knowing what data you hold.
2. Get a compliant privacy policy
Put a clear, accurate privacy policy in place that meets the requirements. This is one of the core obligations and a common enforcement focus.
3. Tighten your data security
Review how you protect personal information — access controls, passwords, backups. Good security is central to privacy compliance and overlaps with your cyber protection.
4. Collect less, keep it shorter
Limit what you collect to what you genuinely need, and don’t keep personal information longer than necessary. Less data held means less risk and easier compliance.
5. Start early
Begin preparing well before the deadline rather than scrambling at the last minute. A data audit and policy take time to do properly, so lead time helps.
WHY IT’S ABOUT PRACTICE, NOT JUST PAPERWORK
A common misunderstanding about the Privacy Act for small business is that it’s a document exercise. Writing a privacy policy, ticking the box, and considering it done is a misconception. The reforms deliberately push toward how you actually handle data day-to-day.
WHAT THIS MEANS FOR TRADES AND CONSTRUCTION
Trades and construction businesses sometimes assume privacy law is only for tech companies and large corporations. However, if you hold customer names, addresses, phone numbers, payment details, or staff records — which every trade business does — the Privacy Act for small business will likely apply to you once the exemption is removed.
COMMON PRIVACY ACT MISTAKES TO AVOID
- Assuming you’re still exempt. The exemption is being removed, so “we’re too small” will no longer apply to most businesses.
- Treating it as paperwork only. The focus is on actual data practices, not just having a policy on file.
- Collecting and keeping too much. Over-collecting and hoarding personal information increases both risk and compliance burden.
- Leaving it to the last minute. A proper data audit and policy take time, so late preparation invites mistakes.
Getting ready for a change like this is core ACS Consulting work. The Operations & Process Improvement service builds privacy-aware data handling into your everyday processes. The SME Data Analysis & Power BI service helps you audit, secure, and manage the data you hold. The Strategy & Business Planning service treats privacy compliance as part of managing business risk.
FREQUENTLY ASKED QUESTIONS
What is the Privacy Act for small business?
The Privacy Act is Australia’s main law governing how organisations collect, use, store and disclose personal information. Historically most small businesses were exempt under a turnover threshold, but reforms are removing that exemption, bringing many small businesses under the Act for the first time.
When does the small business exemption end?
The removal of the small-business exemption is being phased in, commencing in late 2026. That gives businesses a finite window to prepare a compliant privacy framework. As the reforms are still developing, confirm the current dates with official sources.
What will the Privacy Act require my business to do?
Broadly, to have a compliant privacy policy, collect only the personal information you genuinely need, keep it secure, use it only for the purposes you collected it, and be able to respond appropriately to access requests and data breaches. It’s about handling information fairly and securely.
Does the Privacy Act apply to trades and construction businesses?
Once the exemption is removed, it will likely apply to any business holding personal information — which includes trades and construction businesses that keep customer names, contact details, payment information or staff records. The practical compliance steps are manageable with some preparation.
Getting ready for a change like this is core ACS Consulting work. The Operations & Process Improvement service builds privacy-aware data handling into your everyday processes, while the SME Data Analysis & Power BI service helps you audit, secure and manage the data you hold, and the Strategy & Business Planning service treats privacy compliance as part of managing business risk. The free Perth SME Operational Audit Checklist helps you find where your data practices need work. For authoritative guidance, the Office of the Australian Information Commissioner, the Australian Government’s cyber security and privacy resources, and the Australian Cyber Security Centre are the references to use. The reforms are still developing, so confirm the current requirements and dates and seek advice for your situation.
CONCLUSION
The Privacy Act for small business is shifting from something most owners could ignore to something almost every business must address. The exemption will be removed from late 2026. Do a data audit, get a compliant privacy policy, tighten your security, collect and keep less, and start early.
Be proactive about compliance. The removal of the exemption means that you must adapt your practices sooner rather than later.
Treat the Privacy Act for small business as good, consistent data practice rather than a paperwork hurdle, and you’ll be ready for the change while genuinely reducing your risk. As the reforms are still developing, confirm the current rules and get advice for your circumstances.
Need expert guidance for your business? ACS Consulting can help navigate the changes and ensure compliance with the Privacy Act for small business.
ACS Consulting
Website: acsconsulting.com.au
Email: zoey@acsconsulting.com.au
Phone: 0452 665 021
Contact ACS Consulting today to discuss your business goals and discover practical solutions that drive measurable results.