If you run outbound into Australia and your business turns over less than $3M, you've been operating under an exemption that is almost certainly going away. The government has agreed in principle to remove it. The timeline is the problem: the first tranche of Privacy Act reforms in late 2024 didn't touch it, and the change now sits in a later, messier reform round with no firm date.
Translation: you have warning, not a deadline. Use it.
What the exemption actually covers right now
Under the Privacy Act 1988, small businesses with annual turnover under $3M are broadly exempt from the Act's obligations. That means no Australian Privacy Principles, no requirement to handle personal information a particular way, no notification regime for breaches.
For outbound, this has been the quiet reason a lot of Australian prospecting has felt frictionless. You buy a list, you enrich it, you send. Nobody's asking whether the recipient consented to being in your CRM.
That's the gap. The government's response to the Privacy Act Review agreed in principle that the exemption should go. Not "under consideration." Agreed in principle. The only open question is when and with what transition rules.
Why the timeline keeps slipping
The first tranche of reforms passed in late 2024 dealt with things like the statutory tort for serious invasions of privacy and some automated decision-making transparency. The small business exemption wasn't in scope. It's been pushed to a second round that also has to handle consent, fairness, and the harder question of what "personal information" even means in an AI-enriched world.
That second round is where the fight is. Small business groups will push back on cost. Privacy advocates will push for a short transition. Regulators will want something enforceable.
We've seen this pattern before. The EU's GDPR reform has been stalled until 2031 in parts, and the UK's ICO AI code took years to become enforceable. Australia is moving faster than both, but "faster" in privacy legislation still means years, not quarters.
If you're building a pipeline that depends on the exemption holding, you're making a bet on political timing you can't control.
What changes for your outbound when it lands
Once the exemption is gone, small businesses will be subject to the Australian Privacy Principles. For outbound, the practical implications are:
- You'll need a lawful basis for holding and processing prospect data, and "we bought a list" won't be one.
- You'll need to tell people what you're doing with their data, which means your first email has to do more work than a pitch.
- You'll need a process for access and correction requests, even if you're a two-person team.
- You'll need breach notification procedures, which means knowing where your prospect data actually lives.
- You'll need to be able to delete someone's data on request, across every tool in your stack.
None of that is exotic. It's the same shape as GDPR, which we've written about at length in the context of SME exemptions landing and what changes for outbound email setup. The difference is that Australia has been a soft target for exactly this reason, and that's about to close.
The uncomfortable part: your data stack probably isn't ready
Most small outbound operations we see run data through four or five tools. A scraper or enrichment provider. A CRM. A sequencing tool. Maybe a separate verification service. Maybe a spreadsheet someone forgot about.
Ask yourself a simple question: if a prospect emailed you tomorrow and asked you to delete everything you hold on them, could you do it in under an hour and prove it?
For most teams under $3M turnover, the honest answer is no. Not because they're careless, but because nobody's ever asked.
That's the real cost of the exemption ending. It's not the fine. It's the operational retrofit you'll have to do under time pressure once a transition period is announced.
We've seen the same pattern with US state privacy laws, where 20 states with no federal floor means your cold email has to pass California's test even if you're in Texas. The teams that handled that well were the ones who built the process before it was mandatory.
What we'd do now, before the legislation lands
You don't need to panic. You need to spend a few hours making your pipeline defensible.
First, map where prospect data lives. Every tool, every export, every shared drive. If you can't draw it on a whiteboard in five minutes, you have a problem.
Second, write down your lawful basis for processing. For most B2B outbound, it's legitimate interest, and that's fine. But you have to be able to articulate it, and your first email should make it obvious why you're contacting them.
Third, build a deletion path. One person, one process, one place to log requests. It doesn't need to be sophisticated. It needs to exist.
Fourth, stop buying lists you can't trace. If you can't say where a contact came from and when, you can't defend holding it.
None of this is glamorous. It's the unsexy work that separates teams that survive a compliance shift from teams that scramble.
We built MiraReach around the assumption that the human presses send, and that the human can see exactly where every contact came from. That's not a compliance feature. It's just how outbound should work. If you want to see how MiraReach handles prospect sourcing and data provenance, give MiraReach a try.
The exemption is going. The only question is whether you'll be ready when it does.
— Mira