Correction, 8 October 2026. When this was first published in August it said the small business exemption was being phased out with implementation targeted for December 2026. That was wrong, and we've rewritten the article. The blanket removal is still only agreed in principle, with no bill and no commencement date. The December 2026 date belongs to a separate change about automated decision-making disclosure, which applies to organisations already covered by the Act. The real narrowing of the exemption happened through the AML/CTF reforms on 1 July 2026, and we've covered that in a follow-up piece.
What's actually changed
The Privacy Act 1988 exempts most businesses with an annual turnover under $3 million from its core obligations, and that exemption is still law. The federal government has agreed in principle to remove it, following a recommendation from the Attorney-General's review of the Act, but agreement in principle is not legislation. There's no bill before Parliament and no date to work back from.
What did happen is narrower and already in force. From 1 July 2026, the AML/CTF Tranche 2 reforms made lawyers, accountants, conveyancers, real estate agents and trust and company service providers reporting entities, roughly 100,000 businesses. Section 6E(1A) of the Privacy Act treats a reporting entity as covered by the Act for the personal information it handles in that work, whatever its turnover. A two-partner conveyancing practice doing $600,000 a year is now subject to the Australian Privacy Principles for its client onboarding, and the $3 million test does nothing for it.
Why the turnover test was always a poor fit
The assumption behind the original threshold no longer holds up well. A small clinic books appointments and stores health records. A local accounting firm holds tax file numbers and bank details. A boutique law firm manages sensitive case files. A community group running a booking system might process far more personal, and in some cases sensitive, information than its size suggests. None of that has much to do with revenue.
Separately, the Notifiable Data Breaches scheme, which already applies regardless of size once serious harm is likely, has been recording its highest breach numbers since it began in 2018. Regulators have been fairly explicit that they expect organisations to have a breach response plan in place before an incident happens, not worked out afterwards under pressure.
What this means for a business like yours
If you're a law firm or an accounting practice, you're already in, and the question is whether your systems match the obligation. If you're a clinic, you were never exempt in the first place, because health service providers are covered regardless of turnover. If you're neither, you're probably still outside the Act, and the sensible read is that this gets tightened eventually rather than never.
The core requirements aren't exotic: a written privacy policy that's accurate about what you collect and why, a collection notice clients actually see, a clear process for what happens if something goes wrong, and the everyday technical controls that make all of it meaningful. Multi-factor authentication on every mailbox. Access permissions that match what someone's job needs. Device encryption. Backups you've restored from at least once.
Most of that overlaps with ordinary good IT practice, so a business that already takes security seriously has a head start. We're not lawyers, and what your practice needs to comply is worth a conversation with one. What we can do is make sure the technical side holds up when someone asks where the data is and who can reach it.
We have since written a fuller piece on what actually commences on 10 December 2026, and why the exemption question misses most clinics and firms entirely.