Checklist · Privacy, Data Protection & Cyber
Does the Privacy Act apply? Small business exemption assessment checklist and advice note (Privacy Act ss 6C to 6EA)
Checklist and advice note on whether a business is a small business operator outside the Privacy Act: the $3 million turnover test, the s 6D(4) exceptions (health services, data trading, Commonwealth contractors, credit reporting), s 6E and opting in.
- Kind
- Checklist. Steps or checks to work through and tick off.
- Where it applies
- Australia
- AI use
- Yellow AI can help in set ways. A lawyer checks specific points before use.
- Law stated as at
- 18 October 2026
- Status
- Maintained. Checked on 18 October 2026 against the 2 authorities it cites, for Australia.
- Version
- 1
- Source
- Written for this library
When to use it
Use when a small or medium business, a startup or a not-for-profit asks whether it must comply with the Australian Privacy Principles, or before relying on the exemption in a contract or policy. Recheck each financial year and whenever the business changes what it does with personal information.
Used for these tasks
Each task page says how far AI may help with the task and what the lawyer must review.
How AI may be used
AI may gather the turnover figures and the client’s answers into the checklist and flag any exception that may apply; the lawyer decides whether the client is a small business operator and writes the advice.
AI may
- Collect annual turnover figures for each business the entity carries on, by financial year, from the client’s accounts
- Map the client’s answers about health services, sale or purchase of personal information and government contracts against the s 6D(4) exceptions
- Flag activities that may bring the business within s 6E, such as AML/CTF reporting entity status
AI must not
- Must not conclude that the business is exempt
- Must not calculate annual turnover where related entities or several businesses are involved without the lawyer’s review
- Must not treat the exemption as covering obligations under other laws (spam, health records, state privacy laws, the Consumer Data Right)
The lawyer checks
- Annual turnover has been worked out under s 6DA for every business the entity carries on, and any year above $3 million since the business started has been checked (s 6D(4)(a))
- None of the s 6D(4) exceptions applies, including any health service with health information held other than in an employee record
- The s 6E deeming provisions and any opt-in under s 6EA have been checked
- The client has been told the exemption must be rechecked if its activities or turnover change
Method: how the Green, Yellow and Red levels are decided. This is guidance for planning, not legal advice.
Read the full text
The full text is for signed-in accounts. It is free. When you sign in you can:
- read the whole precedent, with its drafting notes beside it;
- copy it, or download it as a Word file or Markdown;
- add it to your firm’s knowledge base, so colleagues can find it;
- let the AI tools you connect read it from that knowledge base.
The summary, the law it rests on and the AI-use guidance above stay public. Privacy.
More in Privacy, Data Protection & Cyber
- Response to a request for access to personal information (APP 12), with refusal notice and correction options (APP 13)
- Data breach response plan (Notifiable Data Breaches scheme, with cyber reporting clocks)
- Response to a direct marketing opt-out or source request (APP 7.6 and 7.7)
- Notification of an eligible data breach to affected individuals (Privacy Act s 26WL), with the public-notice option
- Notifiable data breach statement to the OAIC: completion guide for the online form
- Employee records exemption: assessment checklist for a planned use of staff information (Privacy Act s 7B(3))
- APP privacy policy with AI and automated-decision disclosures (APP 1.4 and APP 1.7 to 1.9)
- Letter of demand for a serious invasion of privacy (statutory tort, Privacy Act Sch 2): take-down, undertakings and remedies
- Collection notice (APP 5) for forms, websites, apps and call scripts
- De-identification assessment record before a dataset is shared or released (Privacy Act s 6 definitions)
- Serious invasion of privacy (statutory tort, Privacy Act Sch 2): claim assessment checklist
- Data protection clause for service providers, including AI vendors (no training, retention, offshore disclosure)
- AI and automated decisions clause for privacy policies and collection notices
- Privacy impact assessment checklist for an AI tool (supplement to the OAIC PIA tool)
All precedents for Privacy, Data Protection & Cyber · Tasks and AI use in this area