If you run outbound into Australia and your business turns over less than $3M, you've been operating under an exemption from the Privacy Act 1988. That exemption is almost certainly going away. The government has agreed in principle to remove it. The timeline is the only thing still up for debate.
This matters because the exemption has been the quiet reason a lot of small operators never bothered with Australian privacy compliance. That reason is about to disappear.
The exemption was always a temporary gift, not a right
Australia's Privacy Act has carved out small businesses since 2001. Under $3M annual turnover, and you were largely outside the Act's reach. No privacy policy requirements. No notification obligations. No real exposure for how you handled prospect data.
That carve-out was designed for a different era. A local cafe with a loyalty card list. A tradesperson with a customer database. Not a two-person SaaS team running cold email into 4,000 Australian inboxes a month.
The government's response to the Privacy Act Review in 2023 made the direction clear. The exemption should go. The first tranche of reforms, passed in late 2024, deliberately left it alone. That wasn't a reprieve. It was a scheduling decision. The small business exemption sits in the second, more complex reform round because removing it requires rethinking what compliance looks like for millions of small entities.
So the question isn't whether. It's when, and what you do between now and then.
What actually changes when the exemption lifts
Once you're inside the Act, the obligations are not exotic. They're the same ones your UK and EU prospects have been living under for years.
- You need a privacy policy that says what you collect, why, and who you share it with.
- You need a lawful basis for handling personal information. For cold outreach, that's usually legitimate interest, and you have to be able to articulate it.
- You need to honour access and correction requests from individuals.
- You need to notify affected individuals and the OAIC if there's a data breach that creates serious harm.
- You need to stop treating scraped prospect lists as a free-for-all.
None of that is hard. What's hard is retrofitting it onto a pipeline that was built assuming none of it applied.
We've watched this exact pattern play out with GDPR. The businesses that got caught weren't the ones who read the legislation late. They were the ones who'd built enrichment workflows, list-building habits, and auto-send sequences that assumed consent was optional. Retrofitting compliance onto a running outbound machine costs ten times what building it in from the start costs.
If you want the longer version of that lesson, the €5.88B in GDPR fines and what changed when SME exemptions landed is worth twenty minutes.
The timeline is genuinely unclear, and that's the point
Here's what we know. The first tranche passed in late 2024. It did not touch the small business exemption. The second tranche is where it lives, and the second tranche is harder because it has to reconcile the exemption's removal with the reality that most Australian small businesses have never had to think about privacy law.
Consultation is ongoing. Draft legislation hasn't landed. If you're waiting for a firm date before you act, you'll be acting under pressure.
The practical read: assume 12 to 24 months. That's enough time to fix things properly. It's not enough time to keep kicking the can.
And note the pattern from the UK. The ICO's AI code became enforceable law before most teams had even read it. One misconfigured scoring model could cost you £20k under that regime. Australia is watching the same playbook.
What to do now, before the legislation lands
You don't need to hire a privacy lawyer. You need to stop building habits you'll have to unwind.
Audit where your prospect data comes from. If you're scraping LinkedIn, buying lists, or enriching from sources you can't name, write down the source. If you can't write it down, that's the problem.
Write a privacy policy that actually describes your outbound. Most small business privacy policies are copy-pasted templates that describe a website contact form. They don't mention cold email, enrichment tools, or CRM storage. Fix that now while nobody's checking.
Document your legitimate interest basis. One paragraph per ICP segment. Why is it reasonable to email this person about this thing? If you can't answer that in two sentences, your targeting is the issue, not your compliance.
Make opt-out one click and honour it fast. This is the single cheapest compliance investment you can make. It also happens to improve deliverability, which is the part nobody talks about.
Stop auto-sending. We've said this before and we'll keep saying it. The moment you're inside a privacy regime, an auto-send sequence is a liability with a send button. Human review before send isn't a feature. It's the floor.
If you're running outbound into the US as well, the state-level patchwork is already a live problem. Twenty states, no federal floor, and California's test applies even if you're in Texas. Australia joining the club just means you can't treat it as the easy market anymore.
What we'd do next
If you're under $3M turnover and running outbound into Australia, spend an afternoon this month on the five items above. Not because the legislation is imminent. Because the cost of doing it later is higher, and the cost of doing it now is roughly zero.
If you want to see how MiraReach handles the human-review-before-send workflow that keeps you on the right side of this, give MiraReach a try. Nothing sends without you pressing the button. That's the whole point.
— Mira