Does Your Small Business Need a Privacy Policy? The $3 Million Rule, the Exceptions and the 10 December 2026 Change

Most Australian small businesses with a turnover of $3 million or less are not covered by the Privacy Act, so the law does not force them to publish a privacy policy. Plenty are covered anyway, whatever their size: a physio, a gym, a childcare centre, a business that sells its customer list. And from 10 December 2026, any covered business that lets software make decisions about people has to say so in its privacy policy. If you sell online, you need website terms of sale as well, and those terms cannot take away your customers’ consumer guarantees.

Claim Done’s Website Terms and Privacy Policy Pack writes your terms of use, terms of sale and privacy policy from what your business actually does. You answer the questions, review the documents, and publish them on your site. Below is what the law asks for, so you know what goes in them and why.

The $3 million line, and the exceptions that catch small operators

The Office of the Australian Information Commissioner (OAIC) puts the rule plainly on its small business page: “Most small businesses are not covered by the Privacy Act 1988, but some are.” A small business, for this purpose, is one with an annual turnover of $3 million or less, counting income from all sources but not assets, capital gains or the proceeds of capital sales.

Turnover is only the first question. The OAIC lists businesses that are covered regardless of turnover, including:

• a health service provider (the OAIC’s rights and responsibilities page spells out that this includes allied health professionals, naturopaths, chiropractors, gyms and weight loss clinics, childcare centres and private schools)
• a business that trades in personal information, such as selling a customer list or swapping it for another list
• a contractor providing services under a Commonwealth contract
• an operator of a residential tenancy database
• a reporting entity under the anti-money laundering laws (for those activities)
• a business related to a larger company that is covered
• a business that has chosen to opt in

So a sole-trader naturopath turning over $90,000 is inside the Act, while an online homewares store turning over $2.5 million may sit outside it. Size is not the test people assume it is.

The detail that trips up growing businesses

The OAIC’s checklist asks whether your business has had an annual turnover of more than $3 million “in any financial year since 2002”. Read that again. It is not “last year”. A business that crossed $3 million once, in a good year, and has since shrunk, is still answering yes to that question. If you have ever had a big year, assume you are covered until you have worked through the OAIC’s full checklist.

A new business that has not traded a full financial year has to project its full-year turnover from what it has earned so far. If your first six months annualise to more than $3 million, you are in.

What a privacy policy has to contain

If the Act covers you, Australian Privacy Principle 1 requires a “clearly expressed and up-to-date” privacy policy, available free of charge and in an appropriate form, which in practice means on your website. The OAIC’s APP 1 guidelines (version 2.0, updated 30 September 2026) set out what it must cover:

• the kinds of personal information you collect and hold
• how you collect and hold it
• why you collect, hold, use and disclose it
• how a person can access their information and ask for it to be corrected
• how a person can complain, and how you will handle the complaint
• whether you are likely to send information overseas and, if practicable, to which countries

That last point is where small businesses most often get it wrong. If your booking system, email marketing platform or cloud accounting stores data on servers outside Australia, that is a likely overseas disclosure, and your policy should say so. Most owners have never checked.

The OAIC also has plain advice in its guide to developing a privacy policy: don’t just repeat the words of the principles, make it specific to your business, and keep it readable. A policy copied from a competitor fails that test the moment your tools or your data flows differ from theirs.

The 10 December 2026 change: decisions made by software

This is the deadline worth putting in your diary. From 10 December 2026, APP 1.7 requires a covered business to add information to its privacy policy if all three of these are true:

1. it has arranged for a computer program to make a decision, or to do something substantially and directly related to making one;
2. the decision could reasonably be expected to significantly affect someone’s rights or interests; and
3. personal information about that person is used by the program to make or help make the decision.

Where those conditions are met, APP 1.8 says the policy must describe the kinds of personal information the programs use, the kinds of decisions made solely by the program, and the kinds of decisions the program substantially and directly helps a person make. The OAIC’s guidelines say chatbots and other types of AI fall within “computer program” for this purpose, and that refusing or failing to make a decision counts as a decision.

For a small business, think about where software says yes or no to a person. An online store that automatically declines orders flagged by a fraud filter. A clinic booking system that refuses appointments to people with an unpaid account. A rental or finance-adjacent business that screens applicants with an automated score. A recruitment form that knocks out candidates before a human reads them. If any of that happens in your business and you are covered by the Act, your privacy policy needs updating before 10 December. That is 28 days from the date of this article.

Website terms of sale: what they can and cannot do

Privacy is half the job. If customers buy from your website, your terms of sale are the contract they accept, and the ACCC’s page on contracts and unfair contract terms notes that clicking “I agree” or simply paying is enough to accept one.

Three rules shape what you can write:

You cannot contract out of the consumer guarantees. The ACCC states that certain consumer rights always exist and the terms of a contract “can’t take away these rights”. A “no refunds” line, or a refund policy that says faulty goods are only repaired at your discretion, misstates the law. You can have a change-of-mind policy that is less generous than the guarantees; you cannot have a fault policy that cuts them down.

Unfair terms in standard form contracts are banned. Since 9 November 2023, proposing, using or relying on an unfair term in a standard form contract has been prohibited, with penalties. Website terms are almost always standard form: the customer takes them or leaves them. The ACCC notes the law presumes a contract is standard form, and the business that wrote it has to prove otherwise. Terms that let you change the price after ordering, cancel at will while the customer cannot, or cap your liability at nothing are the usual suspects. Our explainers on limitation of liability clauses and unfair terms in supplier contracts go through the common ones.

Your terms must match what you actually do. Delivery times, how subscriptions renew, what happens to an account when someone stops paying, who owns reviews customers post: if the terms promise one thing and your checkout does another, the terms are not protecting you.

Do you need a privacy policy if the Act doesn’t cover you?

Legally, often not. Commercially, it is still worth having. Some of the platforms you sell or advertise through ask for a published privacy policy as a condition of using them, whatever your turnover, so check their terms before you assume you can skip it. And businesses grow: the day you take on a health-related service, sign a Commonwealth subcontract or cross $3 million, the obligation arrives in full.

If you publish a policy voluntarily, make it accurate. A policy that promises you never share data, when your marketing platform shares it with an overseas processor, can be a misleading statement about your own business. Writing a modest, true policy is better than borrowing an ambitious one.

How Claim Done’s website pack works

The Website Terms and Privacy Policy Pack produces three documents for a small Australian business: Website Terms of Use, Terms of Sale and a Privacy Policy. Each is written from your answers about how customers pay, how you deliver, your refund approach (drafted to respect the consumer guarantees), whether you run customer accounts or take reviews, what personal information you collect, the tools you use, cookies, overseas storage, marketing, whether the Privacy Act applies to you, and whether software makes decisions about customers. That last question exists because of the 10 December change.

There is no retainer and no subscription: it is a fixed fee, listed on the pricing page. You review the drafts, confirm them and download them to publish on your own website. Nothing is sent to anyone, because these are documents you publish, not letters. Claim Done is not a law firm; the documents are generated from the information you provide, so the more precisely you describe your business, the closer the result fits.

If you already have terms from a template and want to know whether they hold up, the Contract & Agreement Reviewer will go through an existing document clause by clause.

Get it done before 10 December

Pull up your current privacy policy (or note that you don’t have one), list the tools that hold customer data, and check whether any of them make yes-or-no decisions about people. Then start your Website Terms and Privacy Policy Pack on Claim Done. Choose the website pack, answer the questions about your business, review the three documents, and download them ready to publish on your site.

Frequently asked questions

Is a privacy policy a legal requirement for a small business in Australia?

Only if the Privacy Act covers your business. Most businesses with an annual turnover of $3 million or less are exempt, but health service providers, businesses that trade in personal information, Commonwealth contractors, tenancy database operators and some others are covered at any size. If you are covered, you must have a clearly expressed, up-to-date privacy policy that is available free of charge.

Does a gym or allied health clinic need a privacy policy?

Yes, if it is covered as a health service provider, and the OAIC lists gyms, weight loss clinics, allied health professionals, chiropractors and naturopaths as examples. For these businesses the $3 million turnover exemption does not apply, so a small clinic or studio has the same privacy policy obligations as a large one.

What changes on 10 December 2026?

From 10 December 2026, a business covered by the Privacy Act that uses a computer program to make, or substantially help make, decisions that could significantly affect people, using their personal information, must say so in its privacy policy. It must describe the kinds of personal information used and the kinds of decisions involved. The OAIC treats chatbots and other AI as computer programs for this rule.

Can my website terms say no refunds?

Not for faulty goods or services. The ACCC says the terms of a contract cannot take away the consumer guarantees, so a blanket no-refunds line misstates the law. You can limit change-of-mind refunds, but your terms must leave the guarantees intact.

What does Claim Done's website pack include?

Three documents written from your answers: Website Terms of Use, Terms of Sale and a Privacy Policy. You review and confirm them, then download them to publish on your own website. The fee is fixed and shown on the pricing page. Claim Done is not a law firm.