The Small Business Privacy Exemption Has Not Ended. Here Is What Actually Changed.
If you have seen a headline this month telling you the small business privacy exemption has ended, you can relax. It has not. The exemption is still in the Privacy Act, and for most of what your agency does day to day, it still applies to you.
What changed on 1 July 2026 is narrower, and more specific, than the headlines suggest. Real estate agencies became reporting entities under the anti money laundering regime, and reporting entities have never sat inside that exemption.
That distinction is not pedantry. It decides whether you need to overhaul privacy across your whole business, or whether you need to get one part of it right. The answer is the second one, and the difference is months of work.
What The Small Business Exemption Actually is
The Privacy Act does not apply to most businesses with an annual turnover of $3 million or less. That is the small business exemption, and it has been in the Act for more than two decades. It is why a great many agencies have never had an APP privacy policy and have never had to think about the Australian Privacy Principles at all.
The exemption has always had holes in it. A small business is pulled into the Act if it provides a health service, trades in personal information, is a credit reporting body, is a contracted service provider to the Commonwealth, or is a reporting entity under the anti-money laundering legislation.
That last one is the whole story. It is not new. What is new is that real estate agencies are now on the list of reporting entities.
What Actually Changed On 1 July 2026
The second tranche of Australia's anti money laundering and counter-terrorism financing regime commenced for real estate on 1 July 2026. AUSTRAC enrolment opened on 31 March 2026. From that point, agencies providing certain services are reporting entities with customer due diligence, monitoring, reporting and record keeping obligations.
Because you are now a reporting entity, the Privacy Act reaches you. The mechanism sits in section 6E (1A) of the Privacy Act 1988, which treats a small business operator that is a reporting entity as an organisation for the purposes of the Act, in relation to the activities it carries on for the purposes of, or in connection with, its obligations under the anti-money laundering legislation and rules.
Read that last clause again, because it is the part the headlines skip.
The Part Almost Nobody Is Reporting
You are covered for your anti-money laundering work. You are not covered for your whole business (unless your turnover is more than $3 million annually).
The regulator has said this in plain terms. Its guidance for reporting entities states that small businesses "are not covered by the Privacy Act in relation to the non AML/CTF business activities they undertake, unless the small business is covered by the Privacy Act for a different reason."
So if your agency turns over less than $3 million, the Australian Privacy Principles now apply to the personal information you collect and hold to meet your customer due diligence, monitoring, reporting and record keeping obligations in relation to AML . They do not automatically apply to your rent roll, your appraisal database, your marketing list or your tenancy application files.
That is a very different project to the one the alarmist version of this story describes. It is scoped, it is finite, and it is achievable before your first audit rather than after it.
One caution. Covered for a different reason is doing real work in that sentence. If your turnover is above $3 million, or you fall into another exception, the Act applies to your whole business regardless. Check which side of the line you are actually on before you scope anything.
Where The Confusion Came From
There are two different tranche twos in circulation, and they are being collapsed into one story.
Anti-money laundering Tranche 2 is real, it has commenced, and it is what brought real estate into the reporting entity net on 1 July 2026.
The privacy reforms are a separate program. They include a proposal to remove the small business exemption altogether. That proposal is real too, and it has broad support, but it has not been legislated. As at August 2026 it remains an expected future reform without a confirmed commencement date.
Put those two side by side at speed, and "tranche 2 has commenced" becomes "the small business exemption is gone". It is an easy mistake to make and an expensive one to act on.
What is Happening on 10 December 2026?
There is one change with a date on it already. From 10 December 2026, a new Australian Privacy Principle, APP 1.7, requires an APP entity's privacy policy to disclose its use of automated decision making. It applies where a computer program makes a decision, or does something substantially and directly related to making one, that could reasonably be expected to significantly affect a person's rights or interests, and the policy has to set out the kinds of personal information used and the types of decisions involved. Civil penalties apply if it does not. The condition is the same one running through this whole article: it only reaches you if the Act reaches you. If the Act applies to your agency only because you are a reporting entity, it applies to your anti money laundering handling, so something like automated tenancy application screening sits outside it. If your turnover is above the threshold, it applies across the business, and December is closer than it looks.
Key Takeaways
The small business privacy exemption has not ended. It is still in the Privacy Act and it still covers most agencies for most of what they do.
What changed is that real estate became a reporting entity sector under anti-money laundering Tranche 2 on 1 July 2026, and reporting entities have never been inside the exemption.
Section 6E(1A) of the Privacy Act treats a small business reporting entity as an organisation only in relation to its anti money laundering activities.
The regulator has said small businesses are not covered for their non-AML activities unless covered for another reason. Your rent roll, marketing list and tenancy files are not automatically in scope.
The confusion comes from two different tranche twos. Anti money laundering Tranche 2 has commenced. The privacy reform that would remove the exemption entirely has not been legislated.
Designated services are built around the sale, purchase or transfer of real property, including buyer's agents. Property management, residential leasing and holiday letting are not designated services.
For the captured part you need a privacy policy, collection notices, proportionate collection, security, destruction and data breach readiness.
From 31 March 2026 you do not need to keep scanned copies of identity documents for anti-money laundering record keeping. Keep the details, not the images. Tipping off rules override the usual privacy steps. If they might apply, get advice before you respond to the person asking.
From 10 December 2026 you need to disclose the use (or non use) of automated decision making in your privacy policy (you must update your policy)
Next Steps
If your agency's privacy compliance has not been dealt with since 1 July, that is the one to pick up now. It is a smaller job than the headlines suggest, and the first useful step is working out which parts of your business are actually captured.
Not sure where your agency stands? Book a free 10 min call with a member of our team.
Frequently Asked Questions (FAQ)
-
No. The small business exemption is still in the Privacy Act. A proposal to remove it forms part of the privacy reform program, but as at August 2026 it has not been legislated and has no confirmed commencement date.
-
Because two separate reforms are being confused. Anti money laundering Tranche 2 commenced for real estate on 1 July 2026 and made agencies reporting entities. The privacy reform that would abolish the small business exemption is a different program and has not passed as at the date this was written in August 2026.
-
If your agency is a reporting entity, the Act applies to the personal information you handle for the purposes of, or in connection with, your anti-money laundering obligations. If your turnover is $3 million or less and nothing else brings you in, it does not automatically apply to the rest of your business.
-
Designated services are built around the sale, purchase or transfer of real property. Activities that do not involve a transfer of ownership, including property management, residential leasing and holiday letting, are not designated services. Most agencies do both, so one side may be captured and the other not.
-
No, and this is where a lot of the confusion comes from. From 10 December 2026 a new Australian Privacy Principle, APP 1.7, requires an APP entity's privacy policy to explain its use of automated decision making, where a computer program makes a decision, or does something substantially and directly related to making one, that could reasonably be expected to significantly affect a person's rights or interests. That is a separate reform on a separate timetable, and it does not touch the small business exemption. Whether it reaches you depends on whether you are an APP entity at all. If you are covered only because you are a reporting entity, you are covered for your anti-money laundering activities, and something like automated tenancy screening sits outside that.
-
For the captured part of the business: a clearly expressed privacy policy, a collection notice, collection limited to what is reasonably necessary, reasonable security, destruction of what you no longer need, and a plan for responding to a data breach. For a small business the regulator has said its expectations are scaled to the size and complexity of the business.
Luke Shumack – Principal, Realgate Legal
Luke Shumack is one of the Principals at Realgate Legal with a Bachelor of Laws and a sharp focus on helping agencies and business owners stay compliant while scaling with confidence. Since starting his legal career in 2021, Luke has worked closely with real estate agencies, startups, and established businesses on privacy compliance, employment law, contractor agreements, mergers and acquisitions, and corporate governance. Known for his tech-savvy approach and love of efficiency, Luke blends legal precision with practical business strategy—making the complex simple for clients who want to move fast without risk.
Boring legal stuff: This article is general information only and cannot be regarded as legal, financial or accounting advice as it does not take into account your personal circumstances. For tailored advice, please contact us. PS - congratulations if you have read this far, you must love legal disclaimers or are a sucker for punishment.