Under $3 million turnover? Your firm is now in the Privacy Act anyway

For years a lot of small law firms, accounting practices and conveyancers have run on a simple assumption: “we turn over less than $3 million, so the Privacy Act doesn’t apply to us.” That was broadly true. As of this month, it isn’t.

From 1 July 2026, the anti-money laundering reforms (the ones everyone’s been calling “tranche 2”) pulled roughly 80,000 new businesses into Australia’s AML/CTF regime. If your firm provides certain legal, accounting, conveyancing or real estate services, you’re now a “reporting entity.” You have to verify who your clients are, keep records, and report suspicious activity to AUSTRAC.

Here’s the part that’s easy to miss. Becoming a reporting entity also changes where you stand under the Privacy Act.

The small business exemption doesn’t cover you here

The Privacy Act has long exempted most businesses turning over $3 million or less a year. But that exemption always came with exceptions, and one of them is being a reporting entity under the AML/CTF Act.

The OAIC has now published guidance spelling it out. In its words, “small businesses that are ‘reporting entities’ under the AML/CTF Act … are required to comply with the Privacy Act in relation to the activities for the purposes of, or in connection with their obligations under the AML/CTF Act and the AML/CTF Rules.”

The scope matters, so read it carefully. This isn’t your whole firm suddenly being regulated for everything it does. It’s the personal information you collect and hold to meet your AML obligations, the customer due diligence side, that now sits under the Australian Privacy Principles. Turnover doesn’t get you out of it.

Why this is a security problem, not just paperwork

To do customer due diligence, you now have to collect and store more identity documents than you used to: passports, driver licences, proof of address, details of who really owns and controls a client. That’s a concentrated pile of exactly the information identity thieves and fraudsters want most.

So two things just happened at the same time:

• You’re now required to gather and keep more sensitive personal data.
• You’re now legally on the hook for protecting it, and for reporting it if it leaks.

Because the Privacy Act applies, so does the Notifiable Data Breaches scheme. If that identity data is exposed and the breach is likely to cause serious harm, you have to notify the affected people and the OAIC. A folder of client passport scans sitting in an inbox stops being a convenience and becomes a reportable incident waiting to happen.

What to actually do about it

You don’t need to panic, but you do need to treat this data like it matters. Practically:

• Work out if you’re captured. If you provide the designated services, assume you are, and get advice on your specific AML obligations.
• Find the data. Map where identity documents and verification records actually live right now. Usually it’s scattered: email, a shared drive, someone’s desktop, the practice management system.
• Lock it down. Multi-factor sign-in, access limited to the people who genuinely need it, encryption, and no more emailing passport scans around the office.
• Stop over-collecting and over-keeping. The guidance expects you to destroy or de-identify personal information you no longer need. Holding everything forever is now a liability, not caution.
• Get the basics in place. An APP-compliant privacy policy, a way to handle access and correction requests, and a clear plan for the first hour of a breach.

Most of this is the same cyber security hygiene we’d recommend anyway. The reforms just turned “good idea” into “legal expectation” for a whole set of firms that used to sit outside the tent.

If you want those scattered fixes to add up to something you can stand behind, work to a recognised security standard instead of a random pile of tools. It gives you a structured way to cover the basics and, just as importantly, to prove you did, which is exactly what the Privacy Act’s “reasonable steps to secure” test, and increasingly your own clients, will ask for.

The bottom line

The $3 million exemption was never really protecting your clients’ data. It just meant the law wasn’t looking. For the firms caught by the AML reforms, it’s now looking, and the data you’re required to collect is precisely the data you can least afford to lose.

This isn’t legal advice on your particular obligations, so pair it with proper advice on the AML side. On the security side, working out where your client identity data lives and how well it’s protected is a good place to start, and it’s exactly what we do.