Most founders in Australia are told early on that they need a privacy policy, usually by a website builder, an app store or a template pack. Under the Privacy Act, many early-stage businesses do not need one. Some businesses that assume they are exempt are wrong, though, and other laws can apply even where the Privacy Act does not.

A business with annual turnover of $3 million or less is generally exempt from the Privacy Act, so most startups have no duty under that Act to publish a privacy policy. The exemption has exceptions, and many startups are better off with a policy even when they are exempt.

What this covers

  • How the $3 million small business exemption works for a new startup, and how it is lost
  • The situations where a small business must comply with the Privacy Act regardless of turnover
  • What a privacy policy must contain, and why many exempt startups should have one anyway

Does a startup need a privacy policy in Australia?

The duty to have a privacy policy comes from the Australian Privacy Principles in the Privacy Act. They require every "APP entity" to have a clearly expressed and up-to-date policy about how it manages personal information. APP entities are government agencies and organisations, and the definition of organisation excludes small business operators.

If your business is a small business operator and none of the exceptions below apply, the Privacy Act does not require you to publish a privacy policy, and most startups fall into this group.

How the $3 million small business exemption works

A business is a small business if its annual turnover for the previous financial year was $3 million or less. Turnover is measured broadly, taking in sales of goods and services, commission, repair and service income, rent and leasing income, government grants and subsidies, interest, royalties, dividends and other operating income. The threshold has not been indexed since it was introduced.

A new business with no previous financial year is tested on its turnover for the current year, with its income scaled up to a full year if it has only traded for part of one.

Once a business has had a financial year with turnover above $3 million, it stops being a small business operator, and the exemption does not return if turnover later falls below the threshold. For a startup planning to scale, the year it crosses $3 million is the year privacy compliance becomes a legal requirement, so it makes sense to have the policy and the practices behind it in place before then.

When a small business must comply anyway

Whatever its turnover, a business loses the exemption if it:

  • provides a health service and holds health information, as a telehealth platform or a wellness app collecting health data would (holding employees' medical certificates does not trigger this)
  • trades in personal information, meaning it discloses personal information about someone to another party for a benefit, service or advantage, or provides a benefit, service or advantage to collect personal information from someone else. An advertising-supported platform that passes user data to advertisers for revenue could fall into this category, as could a lead generation service that rewards people for contact details. Disclosing or collecting with the person's consent, or where the law requires or authorises it, does not count
  • is a contracted service provider for a Commonwealth contract, even if it is not a party to that contract, which can catch a software startup supplying a government department through a larger contractor
  • is related to a larger company that is covered by the Privacy Act, which can bring in a small subsidiary of a bigger group even when its own turnover is tiny
  • is a credit reporting body
  • has chosen in writing to be treated as an organisation under the Act, which puts it on a public register kept by the Information Commissioner

Some small businesses that are reporting entities under the anti-money laundering and counter-terrorism financing regime must also follow the Privacy Act for the information they handle for those purposes, which can affect payments and fintech startups. Small businesses that run residential tenancy databases are covered too, and tax file numbers have their own separate rules regardless of business size.

Covered businesses also have to report eligible data breaches, which we explain in our guide to the Notifiable Data Breaches scheme.

Websites, email lists and tracking pixels

Running a website, keeping a newsletter list or using standard analytics does not, by itself, amount to trading in personal information. The question is whether you get something in return for passing personal information to someone else, or give something in return for collecting it.

Pixel data can be personal information where it allows a business to single out an individual, even if the business does not know who that person is. In 2026 the OAIC found that two health businesses had collected sensitive health information through tracking pixels on their websites and passed it to the pixel providers for advertising and retargeting. It also found that the general references to cookies and analytics in their privacy policies did not tell people enough about what was happening.

For startups outside health, it is not settled whether sending visitor data to an advertising platform counts as disclosing personal information for a benefit. If your marketing relies heavily on pixels and audience matching, get advice before assuming the Act does not apply to you.

What a privacy policy must contain

If the Privacy Act applies to you, your policy must cover:

  • the kinds of personal information you collect and hold
  • how you collect and hold it
  • the purposes for which you collect, hold, use and disclose it
  • how a person can access their information and ask for it to be corrected
  • how a person can complain, and how you will handle the complaint
  • whether you are likely to disclose personal information overseas
  • if practicable, the countries where those overseas recipients are likely to be

The policy has to be available free of charge and in an appropriate form, which usually means a link on your website. OAIC guidance recommends plain language, content written for your business rather than generic legal wording, and a layered format with a short summary that links to the detail.

Covered businesses may also need collection notices, which give specific information at or before the point of collection, such as on a sign-up form or survey, whereas a privacy policy describes in general terms how you handle personal information. The OAIC has said that publishing a privacy policy does not meet the notice requirement.

OAIC determinations and guidance highlight several common mistakes:

  • using generic wording, which has led to findings of breach where a retailer's policy left out the facial recognition technology it used and where a business failed to describe how it compiled and used leads lists
  • collecting information through pixels without saying so specifically or naming the third-party providers involved
  • sending personal information overseas without managing the risk, usually through an enforceable contract with the recipient, given that a business generally remains accountable for what an overseas recipient does with the information
  • using generative AI with customer information without explaining the AI-related purposes and disclosures in collection notices

Why many exempt startups should have a privacy policy anyway

The Privacy Act is not the only source of privacy risk for a small business. Other laws and commercial expectations also push towards having a policy:

  • The Australian Consumer Law prohibits misleading or deceptive conduct in trade or commerce. A business that publishes a privacy policy and does not follow it can face liability under that law even if the Privacy Act does not apply to it, and the class actions after the Medibank and Optus breaches included claims of this kind. A copied policy describing practices you do not follow carries the same risk.
  • Since 10 June 2025, individuals have been able to sue for serious invasions of privacy under a statutory tort, and the tort applies to small businesses outside the Privacy Act.
  • The EU GDPR can apply to an Australian business that offers goods or services to people in the EU or monitors their behaviour, and the UK GDPR can apply if you sell into the UK or target people there.
  • The Spam Act applies to every business that sends commercial emails, whatever its size, and requires consent, accurate sender details and a working unsubscribe option. It does not require a privacy policy, but a policy is a sensible place to explain how you handle your mailing list.
  • Buyers review privacy compliance as part of due diligence, and the OAIC recommends that startups planning for growth or acquisition build privacy into their products from the start. Our guide to seed funding in Australia covers what else investors tend to check.
  • App stores, advertising platforms and larger customers often require a link to a privacy policy before they will work with you.

What is changing

Several changes are due soon or under consideration:

  • From 10 December 2026, covered businesses must disclose in their privacy policies when they use computer programs to make, or help make, decisions that significantly affect a person's rights or interests. Products that score, rank or approve people using their data will need to account for this.
  • A Children's Online Privacy Code is due to be registered by 10 December 2026 and is expected to apply to social media, relevant electronic services and designated internet services likely to be accessed by children.
  • For covered businesses, the maximum penalty for a serious interference with privacy is the greater of $50 million, three times the benefit obtained, or 30 per cent of turnover during the breach period. A middle tier of up to $3.3 million applies to companies for less serious interferences, and the OAIC can now issue infringement and compliance notices.
  • The 2023 review of the Privacy Act recommended removing the small business exemption, and the government agreed in principle, subject to further analysis and support for small businesses. This has not been legislated, and there is no confirmed timetable.

Common questions

Do I legally need a privacy policy in Australia?

Not if your turnover is $3 million or less and none of the exceptions apply. You do need one if you provide a health service and hold health information, trade in personal information, are a Commonwealth contractor or a credit reporting body, are related to a covered company, or have opted in.

Can I copy another business's privacy policy?

Copying is a bad idea, as a privacy policy has to be clear, current and accurate about how your business handles personal information. Another business's policy will rarely match your practices, and publishing commitments you do not keep can expose you to consumer law claims.

Do I need one if I only collect email addresses?

Collecting email addresses for a newsletter does not, on its own, remove the small business exemption. If you are exempt, the Privacy Act does not require a policy, although the Spam Act still applies to the emails you send and a short policy is good practice.

Do I need a privacy policy for Google Analytics or a Meta Pixel?

Using standard analytics tools does not automatically bring a small business under the Privacy Act. Pixel data can still be personal information, and for a health service it will be sensitive information. Whether or not you are legally required to have a policy, tell people clearly if you collect information through pixels.

Key takeaways

  • The Privacy Act requires a privacy policy only from covered businesses, and most startups with turnover of $3 million or less are exempt.
  • The exemption does not apply to health service providers, businesses that trade in personal information, Commonwealth contractors, credit reporting bodies, related companies of covered businesses, or businesses that opt in.
  • Once turnover passes $3 million in any financial year, the exemption is generally lost for good.
  • Publishing a policy you do not follow can breach consumer law even if you are exempt, so any policy should match your real practices.
  • Automated decision disclosures and a children's privacy code are due from December 2026, and removal of the small business exemption is still being considered.

Not sure whether the Privacy Act covers your startup, or need a privacy policy written for how your business handles data? Talk to Plumlaw about a fixed-fee privacy review.