Are small businesses covered by Australia's Privacy Act?

Many are not. The Privacy Act generally applies to organisations with at least 3 million Australian dollars in annual turnover, plus certain others, so a number of small businesses are currently exempt.

What are the maximum penalties in Australia?

After reforms following major breaches, penalties for serious or repeated breaches rose to up to 50 million Australian dollars or 30 percent of adjusted turnover, whichever is higher.

Asia-Pacific

Cookie consent in Australia

Consent and privacy law in Australia

Australia's Privacy Act 1988 is built around 13 Australian Privacy Principles and enforced by the OAIC. It applies to organisations with at least 3 million Australian dollars in turnover plus certain others, so many small businesses are exempt, a notable difference from the GDPR. Consent is required mainly for sensitive information, while much processing relies on notice and reasonable expectation. After major breaches, penalties were sharply increased to up to 50 million Australian dollars or 30 percent of adjusted turnover. A multi-stage reform is underway to modernise the law, including a fair and reasonable test and stronger individual rights. Cookies that identify users are personal information.

Authority

Office of the Australian Information Commissioner (OAIC)

Status

Privacy Act 1988 with the Australian Privacy Principles, under active reform

Primary law

Privacy Act

Languages

English

Who must comply

The Privacy Act applies to Australian Government agencies and many private-sector organizations that handle personal information.

Penalties

Up to 50 million Australian dollars or 30 percent of adjusted turnover for serious breaches

Key obligations

Open and transparent privacy management
Privacy policies
Collection notices
Purpose limitation
Data minimization
Sensitive information
Consent where required
Direct marketing
Third-party disclosures
Overseas disclosures
Data security
Data quality
Access and correction
Eligible data breach response
Privacy complaints
Data retention and destruction
Automated decision-making transparency
Privacy governance and accountability

Local guidance

Apply the 13 Australian Privacy Principles
Obtain consent mainly for sensitive information
Check whether the small business exemption applies
Track the ongoing Privacy Act reform

How ConsentX helps

Consent Management: Configure consent experiences for processing activities where consent is required.
Collection Notice: Use configurable consent interfaces to provide relevant information about website data collection and processing.
Direct-Marketing Preferences: Maintain user choices and opt-out preferences relevant to marketing activities.
DSAR Workflow: Support workflows for access, correction, deletion, and other privacy requests where applicable.

Get started free

yoursite.com

Australia

We value your privacy

We ask for your consent before any non-essential cookie, with the rules that apply in your region.

Allow allReject non-essentialManage preferences

Consent recorded

sha256 · chain ok

This page is a plain-English summary for general information and is not legal advice. Confirm your obligations with qualified local counsel.

Get Australia ready with ConsentX

Geo-aware banners, prior-script blocking, DSAR and tamper-evident evidence.

Get started free Book a demo

How to comply with Australia using ConsentX

1
Scan your website
Run a free scan to find every cookie and tracker on your site, so you know exactly what needs consent under Australia.
2
Show a geo-aware consent banner
Add the ConsentX banner. It detects each visitor region and shows the consent experience that Australia requires, automatically.
3
Block trackers until consent
Keep non-essential cookies and trackers blocked until the visitor agrees, so nothing fires before consent.
4
Record tamper-evident proof
Every choice is stored as a tamper-evident consent receipt you can produce in a Australia audit.
5
Handle data requests on time
Use the built-in DSAR workflow with SLA timers to answer access, deletion and opt-out requests within the legal deadline.