The short answer: If your business has annual turnover of $3 million or less, the federal privacy legislation probably doesn’t require you to have a privacy policy but there are a lot of exceptions.
The emphasis here is on the word probably.
There are exceptions that catch a surprising number of online businesses. Even where the federal legislation doesn’t apply, overseas privacy laws, app-store rules or commercial requirements may still mean you need one.
For most founders I speak to, the practical answer is: you may not legally have to, but you should probably have one anyway.
Here’s how to work out which camp you’re in.
01: The $3 million rule, and the catches
The Privacy Act 1988 (Cth) (Privacy Act) applies to “APP entities”. For private businesses, that generally includes organisations with annual turnover of more than $3 million.
If the Privacy Act applies to your business, Australian Privacy Principle 1 (APP 1) requires you to have a clearly expressed and up-to-date privacy policy and to make it freely available.
If your annual turnover is $3 million or less, the small-business exemption in section 6D will usually take you outside the Privacy Act. That exemption remains in force as at November 2026.
The problem is that turnover isn’t the only test. A business may be covered regardless of its size if it provides a health service and holds health information, trades in personal information, is a Commonwealth contracted service provider, is related to a larger organisation covered by the Privacy Act or has opted into the Privacy Act.
Some credit-reporting and residential-tenancy database activities are also covered.
The “trading in personal information” exception is particularly relevant to technology businesses. Broadly, it can apply where a business discloses someone’s personal information for a benefit, service or advantage, or provides a benefit, service or advantage to collect it.
That doesn’t mean every use of an external software provider amounts to trading in personal information. There are also exceptions, including where the person has consented to the relevant collection or disclosure. The commercial arrangement and actual data flow need to be considered.
From 1 July 2026, certain legal, accounting, conveyancing, real estate and precious-metals services also became subject to the expanded Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (AML/CTF Act). A small business that is an AML/CTF reporting entity can be treated as an organisation under the Privacy Act for activities connected with its AML/CTF obligations. That doesn’t necessarily bring every part of the business within the Privacy Act.
If you’re a small business with ordinary customers, no health information and no commercial data-sharing model, you may be exempt from the Privacy Act itself.
That still isn’t necessarily the end of the story.
02: Why you probably need one anyway
Most founders who ask me this question end up with a privacy policy, not because the Privacy Act clearly requires one, but because something else does.
Overseas customers:
Simply having an overseas visitor doesn’t make every overseas privacy law apply. However, the European Union’s General Data Protection Regulation (EU GDPR) may apply if you offer goods or services to people in the European Economic Area or monitor their behaviour there. Similar rules apply under the United Kingdom’s privacy regime. If those laws apply, the Australian $3 million threshold won’t assist you.
The platforms you rely on:
Apple and Google require typically app developers to provide privacy policies and information about their data practices. Other advertising, payment and technology providers may impose their own privacy requirements. The precise obligation depends on the platform and product you use.
The new privacy tort:
The Privacy and Other Legislation Amendment Act 2024 (Cth) (Privacy Amendment Act) introduced a statutory cause of action for serious invasions of privacy, commencing on 10 June 2025. It operates separately from the APP regime, so being exempt from the Privacy Act doesn’t automatically prevent a claim.
The threshold for a successful claim is reasonably high. Among other things, the invasion must be serious, the conduct must be intentional or reckless and the person must have had a reasonable expectation of privacy. A privacy policy isn’t a defence by itself, but accurate disclosures and sensible data practices can form part of good privacy governance.
Your credibility: B2B customers, investors, insurers and enterprise procurement teams routinely ask for privacy information. Turning up without a policy, or with a copied policy that names another company, creates an avoidable problem.
There’s also the Competition and Consumer Act 2010 (Cth), Schedule 2 (Australian Consumer Law). Statements you make about privacy must be accurate. A policy that says you don’t share information while your website is sending customer data to advertising or analytics providers may be misleading.
03: What’s changing, and what isn’t
You may have seen claims that the $3 million exemption disappears on 10 December 2026.
That isn’t what the current legislation says.
What happens on 10 December 2026 is that a new automated-decision transparency requirement commences for businesses already covered by the Privacy Act.
If an APP entity arranges for a computer program to use personal information to make, or substantially assist with, a decision that could significantly affect someone’s rights or interests, its privacy policy will need additional information.
Broadly, the policy must describe the kinds of personal information used and the kinds of decisions made or materially supported by the program. This may be relevant to automated recruitment, credit, eligibility, pricing, insurance or account-access processes. It isn’t limited to software marketed as artificial intelligence.
The removal of the small-business exemption is a separate reform proposal. The Government agreed in principle that the exemption should be removed, subject to consultation and appropriate support for small businesses. However, the exemption remains law and its removal wasn’t included in the 2026 exposure draft.
If you want one sentence to remember, it’s this:
The $3 million threshold still exists, the exceptions still matter, and the December 2026 change is about automated decisions made by businesses already covered by the Privacy Act.
04: What a decent privacy policy actually covers
A privacy policy should describe what your business genuinely does with personal information. It isn’t a legal shield and it isn’t the place for optimistic statements about practices you haven’t implemented.
If the Privacy Act applies, APP 1 requires the policy to explain the kinds of personal information you collect and hold, how and why you collect it, how it is used and disclosed, and how someone can access or correct their information.
It must also explain how someone can make a complaint and whether personal information is likely to be disclosed overseas. Where practicable, it should identify the countries in which overseas recipients are likely to be located.
A useful policy should also reflect how information is collected through your website, including forms, cookies, analytics, advertising tools and third-party sign-in. It should identify the types of service providers that receive information, such as your CRM, payment processor, email platform and hosting provider.
The mistakes I see most often are copied policies that name the wrong company, policies that promise “we never share your data” while the website is running advertising pixels, and policies that say nothing about overseas data handling despite the business using overseas cloud software.
Each is worse than a carefully drafted, straightforward policy because each makes a public statement that may not be true.
A privacy policy also isn’t the same thing as a cookie notice, a privacy collection notice or your website terms. Depending on how your website operates, you may need some combination of those documents.
05: What to do next
Start by working out whether the Privacy Act applies to your business, including whether any of the small-business exceptions catch you.
Then look at what actually happens when someone uses your website. What do you collect? Which cookies, pixels and analytics tools are running? Who receives the information? Is it stored overseas? Is it used by software to make significant decisions?
Your privacy policy should be based on those answers, not on a template’s idea of how your business operates.
I draft and review privacy policies, collection notices, cookie notices and website terms for founders and businesses across Australia. If you already have a policy and want to know whether it matches what your website actually does, send it through and I’ll tell you straight.
This article contains general information for Australian businesses as at 9 November 2026. It isn’t legal advice for your circumstances. Privacy law is changing, so check the publication date before relying on it.