Quick answer: Most Australian small businesses with annual turnover of $3 million or less are exempt from the Privacy Act, and using AI tools doesn't change that on its own. The exemption doesn't apply to some businesses regardless of size, including health service providers and businesses that trade in personal information. Customer contracts, other laws and planned reforms can still create privacy obligations.
If you run a small business and your team has started using ChatGPT, Copilot, an AI chatbot or AI features inside your CRM, this article explains whether the Privacy Act covers you, which exceptions catch small businesses out, how AI changes the risk picture, and what sensible steps look like even if you're exempt.
Two things have pushed this question up the list: the new automated decision-making disclosure rule from 10 December 2026, and proposed reform of the small business exemption. The ADM rule only applies to entities already covered by the Act and to qualifying automated decisions. Check official reform updates before relying on any proposed commencement date.
So the short version is: for most small businesses, nothing changes on 10 December. But the direction of travel is clear.
What Does the $3 Million Small Business Exemption Mean?
The small business exemption means most businesses and not-for-profits with annual turnover of $3 million or less are not bound by the Australian Privacy Principles. The OAIC explains that these businesses can also choose to opt in voluntarily, free of charge, by applying to the OAIC with an APP-compliant privacy policy.
Turnover is assessed across the whole business, not one product line. If you're part of a group, related businesses can affect your status.
Which Small Businesses Are Covered Regardless of Turnover?
Several kinds of small business are covered by the Privacy Act regardless of turnover. These are the ones we see most often in practice:
| Category | What to check |
|---|---|
| Health service providers | Providing health services and holding health information can bring a business under the Act. |
| Businesses trading in personal information | Buying or disclosing personal information for a benefit can trigger coverage; consent and statutory exceptions affect this test. |
| Commonwealth contractors | Check personal information handled in providing services under a Commonwealth contract. |
| Residential tenancy database operators and credit reporting bodies | These activities have specific Privacy Act coverage. |
| AML/CTF reporting entities | Coverage applies to personal information handled in connection with AML/CTF obligations. |
The first two catch the most people. A small physio clinic using an AI scribe, or an online business that shares customer lists with partners for a benefit, is likely covered even with turnover well under $3 million.
This table highlights common categories rather than every exception. Check related-business rules and the full OAIC small business guidance.
Does Using AI Change Your Privacy Act Status?
Using AI tools doesn't remove the small business exemption on its own, but some AI uses can push a business into an exception. The test is still about who you are and what you do with personal information, not which software you use.
Where AI can change the picture:
- Health data. If you provide a health service and an AI tool processes patient notes or recordings, you're covered and the tool's handling of that data matters.
- Data monetisation. If an AI or marketing tool involves sharing or selling customer data for a benefit, that can count as trading in personal information.
- Growth. Once annual turnover exceeds $3 million, reassess Privacy Act coverage. Covered businesses must also check whether their AI uses meet the criteria for the December 2026 automated decision disclosures.
What doesn't change your status: staff using ChatGPT to draft emails, an AI chatbot on your website, or AI features inside Xero or HubSpot. Those still matter for good practice, just not for Privacy Act coverage.
What Obligations Can Still Apply If You Are Exempt?
Exempt small businesses still face privacy obligations from contracts, other laws and customer expectations. Being outside the Privacy Act is not the same as having no rules.
- Customer and supplier contracts. Larger clients increasingly require suppliers to follow the APPs and disclose AI use, regardless of your legal status.
- Australian Consumer Law. Misleading claims about how you handle data can be a consumer law issue.
- The Spam Act and Do Not Call Register. These apply to marketing whatever your size.
- AI vendor terms. Free or consumer versions of some AI tools may use your inputs to improve their models unless you change settings. Business plans usually offer stronger controls.
- Notifiable data breaches. These apply to covered entities, but a breach still damages trust for anyone.
What Practical Steps Should a Small Business Take?
Even if you're exempt, a short AI and privacy policy, business-grade AI accounts and a list of tools that touch customer data will put you ahead of most competitors and ready for reform. None of this is expensive.
- Check your status properly. Run through the exceptions table above, and confirm your turnover across related entities.
- List the AI tools in use. Include the ones staff signed up for themselves.
- Move to business plans for tools that handle customer data, and switch off model training on your inputs where the option exists.
- Write a one-page AI usage policy covering what data staff must never paste into AI tools.
- Consider a basic privacy policy even if you're exempt. Customers and enterprise clients increasingly expect one.
- Plan for reform. When the exemption goes, you'll want to have done steps 1 to 5 already.
If you're past $3 million turnover, or in one of the covered categories, read the OAIC automated decision-making guidance to see whether the December 2026 disclosures apply to you. For businesses building AI into their operations, our AI Strategy Report and custom AI services build privacy into the design from day one. Zynex is a Melbourne-based AI and ERP consultancy, and we see this question on almost every first call with small businesses.
Official Sources
Check the OAIC small business guidance for coverage and exceptions, the OAIC automated decision-making guidance for the December 2026 transparency requirement, and the OAIC voluntary opt-in guidance for joining the Privacy Act voluntarily.
Plan your next steps with Zynex Technologies
Check Your AI and Privacy Requirements
If you're using AI with customer data and aren't sure what applies, talk with our Melbourne team. We'll check your status, review the tools you use and give you a short, practical list of next steps.
Book a call