Privacy Law Changes In Australia: What Small Businesses Need To Know

Recent changes to Australia’s privacy and data protection laws are the most significant we’ve seen in years. While some parts of the legislation are still evolving, others are already in force. They could affect how your business handles personal information, even if you’re a small operator. 

Here’s what’s changed, what’s coming, and what you need to do to stay compliant. 

What’s changing? 

1. Stronger data protection obligations.

Businesses must now take ‘reasonable steps’ to secure the personal information they collect. This includes not just having good tech (like antivirus software), but also strong policies, team training, and clear data-handling procedures. 

2. More power to the privacy regulator.

The Office of the Australian Information Commissioner (OAIC) now has greater powers to investigate, fine, and take action against businesses that mishandle data especially in cases of serious or repeated breaches. 

3. A new right to sue for privacy breaches.

From mid-2025, individuals will be able to sue businesses for serious invasions of privacy (e.g. leaking sensitive data or doxxing someone online). Even if it was unintentional, your business could be held liable if adequate safeguards weren’t in place. 

4. Consent must be clear and genuine.

Consent to collect or use someone’s data must now be: 

• Specific.
• Informed.
• Current.
• Voluntary. 
• Unambiguous.

That means no more vague or bundled consent forms, clients need to know exactly what they’re agreeing to. 

5. Transparency around Artifical Intelligence (AI) and overseas data.

If your business uses automated decision-making (like AI tools) or shares data with overseas providers (like cloud storage), you’ll need to disclose this clearly in your Privacy Policy. 

6. Doxxing is now a criminal offence.

Deliberately sharing someone’s personal information online to harm, harass, or intimidate them is now a criminal offence.

Make sure your team is across this as accidental or careless sharing could land your business in hot water. 

7. Specific rules around online privacy for children.

If your services are directed at children you will have to provide age appropriate privacy notices, consent mechanisms and enhanced data protection measure. 

What should small businesses do? 

Even if you’re currently exempt from some parts of the Privacy Act (like many businesses with under $3 million turnover), these changes signal a strong shift in expectations. 

Here’s a practical checklist to help your business keep up: 

Review your data security.

• Is your IT system protected with strong passwords and antivirus? 
• Do you restrict access to personal information only to those who need it? 
• Do you have a plan for what to do if a data breach occurs? 

Update your privacy policy.

• Include any use of AI, automated decision-making, or offshore providers. 
• Make your policy easy to find, read, and understand. 

Be prepared for a breach. 

• Under the Notifiable Data Breach Scheme, you must notify affected individuals and the OAIC if a breach is likely to cause serious harm. 
• Create a response plan now, so you’re not scrambling if something goes wrong. 

Train your team.

• Make sure your team know the basics: what personal data is, how to handle it securely, and what not to do. 
• Include doxxing and data breach procedures in your internal training. 

Know when to conduct a Privacy Impact Assessment.

• If you’re launching a new system or tool that handles personal info or makes automated decisions, assess the risks and document your approach.

We’ve created an extensive checklist to help business owners stay on top of their obligations under Australia’s evolving privacy laws. You can use this checklist to review your current approach and identify any gaps.

Please complete the form below to download your free copy:

What’s next? 

The government has flagged further changes to privacy laws, including potentially removing the small business exemption altogether. That means all businesses, regardless of size, could soon be expected to meet the full privacy obligations under the Act. 

In short: get your house in order now. Not only will it help you avoid fines or legal issues, it shows your clients that you take their trust seriously. 

Need help? 

If you’d like support reviewing your Privacy Policy, training your team, or preparing for these changes, our team can help.

Please reach out any time. We’re happy to guide you through the next steps to ensure your business is compliant with the privacy laws and confident moving forward. 

This is general advice only and has not been prepared with your situation and needs in mind. For individual and personalised advice, we highly recommend that you seek out proper professional advice from your business adviser.