You've run a small practice for years on a sensible assumption. The Privacy Act is for the big end of town. Under $3 million turnover, it doesn't apply to you.
That assumption wasn't lazy. For most of the time you've held it, it was correct.
It's also the reason a lot of small accounting and legal practices are about to find out, slightly late, that part of their business now sits inside the Privacy Act. Not because the exemption was abolished. Because something else switched it off for one slice of what they do.
The small business exemption in the Privacy Act hasn't gone anywhere
It is still in the Act, and for most small businesses it still means exactly what it has always meant.
What changed is a rule that has been sitting in the Act for years, on the back burner as far as professional services were concerned. Section 6E(1A) says a small business that's a reporting entity under the anti-money laundering laws is treated as covered by the Privacy Act for that AML/CTF work.
Until this year, reporting entities were mostly banks, casinos and remitters. From 1 July 2026, the "tranche 2" reforms brought in accountants, lawyers, conveyancers, real estate professionals and trust and company service providers who provide designated services. The OAIC's guidance for reporting entities says it plainly: the Privacy Act now applies to those entities for their AML/CTF handling of personal information.
I think of it like a council permit threshold. A garden shed under a certain size doesn't need a building permit. Put a bathroom in it and it's a dwelling, whatever its size. Your practice didn't get bigger on 1 July. What it does with client information changed, and the rules follow the use, not the floor area.
Here are the four beliefs I'd expect to hear in a practice like yours, and what's actually true about each.
"We're under $3 million, so it doesn't apply to us"
The kernel of truth: for most of your work, that's still right. The OAIC is clear that a small business isn't covered for its non-AML activities unless something else brings it in.
The correction: if you provide designated services, you're covered for that work. Not as a technicality. The full Australian Privacy Principles, for the personal information you collect and handle to meet your AML/CTF obligations.
And plenty of practices haven't caught up with the AML side yet, let alone the privacy side. Clyde & Co's analysis of enrolment data estimated that by the 29 July enrolment deadline, about half of active accounting practices had enrolled with AUSTRAC. Some of the other half genuinely don't provide designated services. Some haven't worked it out yet.
"It only covers the AML paperwork, so it's contained"
The kernel of truth: the coverage is limited to AML/CTF-related handling.
The correction: look at what that handling actually is, item by item. Customer due diligence. Copies of passports and driver's licences. Beneficial ownership details. Source-of-funds information. Risk ratings on your clients. That is the most sensitive information your practice holds, gathered in one place, for every new client since 1 July. Calling it paperwork undersells it badly.
Where does it live? In a lot of small practices, the answer is a mix. The practice management system, an email inbox, a scanner's shared folder, and somebody's desktop. I've written before about how ordinary cloud misconfiguration turns into a breach, and a shared folder full of ID scans is the textbook case.
Beware: ID documents collected for AML/CTF purposes are now covered by the Privacy Act for your practice, including the obligation to keep them secure and not keep them longer than you need. A folder of passport scans that nobody's tidied since July is exactly what a breach investigation looks for first.
"The new automated decision rules are for banks"
The kernel of truth: the automated decision-making rules commencing on 10 December 2026 sit in APP 1, and they apply to organisations covered by the Privacy Act. For a small practice, that coverage only extends to the AML/CTF work.
The correction, or at least the question worth asking: what does your AML/CTF software do? Plenty of onboarding tools now risk-rate clients automatically, run screening against sanctions and politically exposed persons lists, and flag or hold onboarding when something matches. Whether any of that amounts to a decision that significantly affects a client, in the sense the new rules mean, is a legal question I will not answer for you. It's one worth putting to your lawyer before 10 December rather than after.
"The exemption will be around forever"
The kernel of truth: the small business exemption in the Privacy Act stands today. The government's second tranche of privacy reform hasn't removed it.
The correction: whether it survives the next round is genuinely unsettled at the time of writing. Some commentators, MinterEllison among them, expect it to be repealed. Others do not. I would not plan a practice on either guess. I'd plan on the reasonable middle: assume privacy obligations are heading your way eventually, and get the habits in place while it's still only a slice of the business.
Tip: Start with one list. Every place this client information is collected, stored or sent: the onboarding form, the ID verification tool, the inbox it arrives in, the folder it's saved to, and who can open each. That list is most of the work.
The inbox is usually the surprise. Documents get emailed in, the email gets actioned, and nobody goes back to delete the attachment.
What getting this right actually looks like
Losing part of your Privacy Act small business exemption calls for a small set of habits rather than a project. The good news is that all four are things a practice manager can own.
A privacy policy and a collection notice that describe your AML/CTF handling. The OAIC has published a template collection notice for reporting entities, which is a good place to start with your adviser.
ID documents and due diligence records stored in one place, with access limited to the people who need it.
A retention rule that someone actually follows, so you are not holding a decade of passport scans because deleting them was always a project for tomorrow.
And an offboarding routine that takes access away when staff leave. Our checklist for when an employee leaves applies here unchanged, and it matters more now that a departed staff member's old login might still open a folder of client IDs.
If something does go wrong, you're now a business with Privacy Act obligations for that information, including the notifiable data breach scheme. The first decisions after a breach are hard enough without discovering you'd assumed the Act didn't apply.
Back to the shed
Nobody reads the Privacy Act for fun, and nobody sent a letter saying the AML reforms had a privacy rider attached. The shed is the thing to hold on to here. Nothing about your practice got bigger on 1 July, and the plumbing you added was a compliance obligation somebody else wrote. Section 6E(1A) was never going to announce itself. It sat in the Act for years doing almost nothing, and then one set of reforms switched it on for an entire profession.
If it'd help, we'll sit down with you for an hour and map where your AML/CTF client information actually lives, which systems touch it and who can open it. You'll get it back in writing, ready for whoever advises you on the legal side.
Where these numbers come from
- Privacy guidance for reporting entities under the AML/CTF Act, OAIC
- AUSTRAC takes compliance action in relation to Tranche 2 entities, Clyde & Co, 31 August 2026
- AML/CTF reforms: don't forget the privacy policy, MinterEllison
Yener
