The December privacy deadline you are being sold is not the one that exists

Vendors are telling small businesses the A$3 million exemption dies on 10 December. It does not. Something else does, and it is narrower than the marketing.

If your business turns over less than A$3 million, you have probably had the email. Comply with the full Privacy Act by 10 December, it says, or face penalties. Some versions put a number on it: 2.5 million businesses about to be captured for the first time. The emails come from information technology providers, compliance software vendors and managed service firms, and they are selling a readiness package.

The small business exemption has not been removed. Section 6D of the Privacy Act 1988, which exempts most businesses with annual turnover of A$3 million or less, remains in force. Removing it was recommended by the Privacy Act Review and agreed to in principle by the government, and it is expected to form part of a second tranche of reforms. The exposure draft released on 31 August 2026 did not contain it. There is no commenced legislation repealing it and no fixed date.

The 10 December date is real, and it belongs to something else. It is the commencement of the automated decision-making transparency obligation enacted in the Privacy and Other Legislation Amendment Act 2024, which requires an organisation to disclose in its privacy policy where it uses automated systems, including artificial intelligence tools, to make decisions that significantly affect a person. Screening job applicants, scoring customers, setting prices automatically: if a machine makes the call, the policy has to say so. That duty applies to organisations already covered by the Act. A business relying on the small business exemption is not covered, so it does not apply.

The complication is that fewer small businesses are exempt than assume they are. The exemption has never applied to businesses that handle health information, trade in personal information or provide services under a Commonwealth contract. From 1 July 2026, firms in the sectors captured by the second tranche of anti-money laundering rules, including real estate agents, lawyers, accountants, conveyancers and trust and company service providers, lost the exemption for personal information handled in that part of their work. Those businesses are covered now, which means the December automated decision duty is theirs to meet.

The opposite error is just as expensive. Dismissing December because a vendor oversold it ignores a duty that may well apply to you, and the exemption's removal remains government policy with bipartisan support in principle. A business that builds a data inventory now is not wasting the work.

Answer one question before you spend a cent: are you actually exempt? Check turnover, then check the four carve-outs, and if you are an agent, conveyancer or accountant, assume you are covered for part of your work and act accordingly. If you are exempt, you have no December obligation and you should say so to the next vendor who emails you. If you are covered and you use any automated tool to make decisions about people, your privacy policy needs updating in the next seven weeks. Either way, write down what personal information you hold, where it lives and who can reach it, because that single document is what every version of this reform will eventually ask you for. The exemption goes in the end. It will not go on 10 December.