---
title: "Does the Privacy Act apply? Small business exemption assessment checklist and advice note (Privacy Act ss 6C to 6EA)"
url: "https://ailawframework.com/precedents/privacy-data-protection-and-cyber/small-business-exemption-assessment-checklist"
type: "precedent"
site: "AI Law Framework"
id: "a25-small-business-exemption-assessment-checklist"
area_id: "A25"
kind: "checklist"
ai_level: "yellow"
version: 1
task_ids: ["A25-Y20261018-5"]
law_stated_as_at: "2026-10-18"
---

# Does the Privacy Act apply? Small business exemption assessment checklist and advice note (Privacy Act ss 6C to 6EA)

> Checklist and advice note on whether a business is a small business operator outside the Privacy Act: the $3 million turnover test, the s 6D(4) exceptions (health services, data trading, Commonwealth contractors,…

Canonical page: https://ailawframework.com/precedents/privacy-data-protection-and-cyber/small-business-exemption-assessment-checklist  
Law stated as at: 2026-10-18

Site index for agents: https://ailawframework.com/llms.txt

Checklist and advice note on whether a business is a small business operator outside the Privacy Act: the $3 million turnover test, the s 6D(4) exceptions (health services, data trading, Commonwealth contractors, credit reporting), s 6E and opting in.

## Key facts

- Kind: Checklist. Steps or checks to work through and tick off.
- Practice area: [Privacy, Data Protection & Cyber](https://ailawframework.com/precedents/privacy-data-protection-and-cyber.md)
- Jurisdictions: Australia
- AI level: Yellow. AI can help in set ways. A lawyer checks specific points before use.
- Law stated as at: 2026-10-18
- Status: Maintained. Checked on 2026-10-18 against the 2 authorities it cites, for Australia.

## When to use it

Use when a small or medium business, a startup or a not-for-profit asks whether it must comply with the Australian Privacy Principles, or before relying on the exemption in a contract or policy. Recheck each financial year and whenever the business changes what it does with personal information.

## Used for these tasks

- [Advise a small business whether the Privacy Act applies to it](https://ailawframework.com/practice/privacy-data-protection-and-cyber.md#A25-Y20261018-5)

## How AI may be used

AI may gather the turnover figures and the client’s answers into the checklist and flag any exception that may apply; the lawyer decides whether the client is a small business operator and writes the advice.

**AI may:**

- Collect annual turnover figures for each business the entity carries on, by financial year, from the client’s accounts
- Map the client’s answers about health services, sale or purchase of personal information and government contracts against the s 6D(4) exceptions
- Flag activities that may bring the business within s 6E, such as AML/CTF reporting entity status

**AI must not:**

- Must not conclude that the business is exempt
- Must not calculate annual turnover where related entities or several businesses are involved without the lawyer’s review
- Must not treat the exemption as covering obligations under other laws (spam, health records, state privacy laws, the Consumer Data Right)

**The lawyer checks:**

- Annual turnover has been worked out under s 6DA for every business the entity carries on, and any year above $3 million since the business started has been checked (s 6D(4)(a))
- None of the s 6D(4) exceptions applies, including any health service with health information held other than in an employee record
- The s 6E deeming provisions and any opt-in under s 6EA have been checked
- The client has been told the exemption must be rechecked if its activities or turnover change

## Authorities

- [Privacy Act 1988 (Cth) s 6D (small business: annual turnover of $3,000,000 or less for the previous financial year, or the current year for a new business; small business operator; entities that are not small business operators)](https://www.legislation.gov.au/C2004A03712/latest/text)
- [Privacy Act 1988 (Cth) s 6DA (annual turnover) and s 6E (small business operators treated as organisations, including AML/CTF reporting entities) and s 6EA (choosing to be treated as an organisation)](https://www.legislation.gov.au/C2004A03712/latest/text)

## Full text and drafting notes

The full text and the drafting notes are not part of this public page. Signed-in firm accounts can read them at https://ailawframework.com/precedents/privacy-data-protection-and-cyber/small-business-exemption-assessment-checklist and through the signed-in MCP connector https://ailawframework.com/mcp/firm.

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*