Is the Privacy Act Small-Business Exemption Gone? Not Yet

The December Privacy Act deadline you're being sold is mostly wrong

If your business turns over less than $3 million, you've probably had the email: comply with the full Privacy Act by 10 December 2026, or face penalties. It's landing in inboxes from IT providers and legal-marketing sites across the country. Most of it conflates two separate things — and the change that would actually pull 2.3 million small businesses into the Act hasn't happened. The small-business exemption is still law.

What's actually changing on 10 December — and what isn't

The 10 December 2026 date is real, but it's the automated-decision disclosure duty from the first tranche of reforms — the Privacy and Other Legislation Amendment Act 2024. It requires APP entities — organisations already covered by the Privacy Act — to disclose in their privacy policy where they use personal information to make significant automated decisions about people. If you're already inside the Act, that's a genuine deadline. If you're a sub-$3m business relying on the small-business exemption, it isn't yours yet.

The thing being marketed as a December deadline — removing the exemption so every small business is covered — is a proposal, not law. The Attorney-General's Department confirmed the government agrees in principle to remove the exemption, but only after further consultation and support for small businesses to help them comply. There's no Bill and no commencement date. As one legal analysis of the second tranche put it plainly: any specific date circulating online should be treated as commentary, not law.

One real erosion has happened. From 1 July 2026, roughly 100,000 professional-services firms — accountants, lawyers, conveyancers and real estate agents — lost the exemption for the personal information they handle under the AML/CTF Tranche 2 reforms. If that's you, you're already an APP entity and December's disclosure duty applies to you. For everyone else under $3 million, the blanket exemption stands.

What it means for your customer data and your AI tools

The exemption is about who the Privacy Act binds. It was never a licence to be careless with customer data — and it says nothing about the tool most likely to get you in trouble. Every time a staff member pastes a client's name, address, job history or health note into a public AI chatbot to draft a quote or a letter, that data leaves your control. Two in three Australian businesses already have unauthorised AI use running quietly in the background.

Two things bite regardless of the exemption. The Australian Consumer Law's ban on misleading conduct has no turnover threshold — overstate your "bank-grade AI security" or how you handle client data and you're exposed whatever your revenue. And when the exemption does go — the government's direction of travel is not in doubt — it will apply to the data practices you already have, not the ones you tidy up the week before it commences. This is fundamentally a customer intelligence problem: the same data that makes your AI tools useful is the data that carries the obligation.

If you want to know which of your current AI and data flows would be a problem the day the exemption lifts, a short call will map it — or see where your business is exposed.

What to do about it

Don't buy compliance theatre off the back of a deadline that doesn't apply to you yet. But don't wait for the law to force your hand either. Do the cheap version now: write down what customer data you hold and where it flows, set one clear rule about what can and can't go into a public AI tool, and choose vendors that keep your data inside your control. It's about a week of work, and it turns a future compliance scramble into a trust signal you can put in front of clients today — while making every AI tool you adopt next safer to use. Consent alone won't cover you when the rules tighten; a clear, written data practice will.