The Morning After: What You Owe Your Customers

Most small business owners assume there is a law that tells them. There is, and it probably does not apply to you, and that turns out to be the harder answer.

The threshold, and why it misleads

The Privacy Act 1988 applies to Australian Government agencies and to organisations with an annual turnover of more than $3 million (Office of the Australian Information Commissioner, 2026). Under it sits the Notifiable Data Breaches scheme, which requires any organisation the Act covers to notify both the affected individuals and the OAIC when a breach is likely to result in serious harm.

If your turnover is $3 million or less, the default is that neither obligation reaches you. No notification. No regulator. Nothing you are legally required to say to the people whose details just walked.

But read the exceptions before you file that away, because they catch a great many ordinary small businesses. Under the $3 million line the Act still covers a number of them, most commonly:

• Private sector health service providers, a category the OAIC draws broadly enough to include a traditional health service provider such as a GP or a pharmacist, a complementary therapist such as a naturopath or chiropractor, and a gym or weight loss clinic.
• Childcare centres, private schools and private tertiary providers.
• Any business that buys or sells personal information, which is worth sitting with if you have ever purchased a marketing list.
• Anyone who has opted in, or who holds a Commonwealth contract, or who is a credit reporting body.

And separately from whole-business coverage, some activities are covered whoever performs them. Since 1 July 2026 that includes the anti-money-laundering obligations picked up by conveyancers, accountants and real estate professionals: their AML-related handling of personal information sits under the Act regardless of turnover, even where the rest of the business does not.

That is the common ground, not the complete list. The OAIC publishes the full one, and it takes five minutes to read.

If you land inside the Act, the duty is more specific than "tell someone". You have to assess a suspected breach reasonably and expeditiously, taking all reasonable steps to finish within 30 days of becoming aware of it, and then, if serious harm is likely, prepare a statement, give it to the Commissioner and notify the people at risk (OAIC, 2026). Thirty days is a ceiling, not a plan.

The common mistake is not "I thought I was exempt and I was". It is "I never checked". A physiotherapist turning over $700,000 is covered. A pet groomer turning over $2.9 million is not. Neither of them knows, and the day they find out is the worst possible day to be reading legislation.

Whether the general exemption survives is its own open question. Removing it has been proposed as part of a second tranche of privacy reform, but at the time of writing no such bill has passed and no commencement date is fixed. Plan for the law as it is, not as it might be, and do not build anything on the assumption that the exemption is permanent.

What the regulator's numbers show

The scheme itself gives a useful read on how these things actually go wrong. In the first half of 2025 - the most recent period published when I wrote this - the OAIC received 532 breach notifications. Malicious or criminal attacks were the largest source at 59 per cent, but human error accounted for 37 per cent of all breaches, up from 29 per cent in the previous six months (OAIC, 2025).

Sit with that second figure. More than a third of reported breaches were human error: the wrong attachment, the list emailed to the wrong address, the setting left on the wrong side of public. Those are not exotic failures. Those are Tuesday, and the smaller the business, the fewer the hands between the mistake and the customer.

The law is the floor, not the standard

The threshold answers a legal question. It does not answer the question your customer is asking, which is "did you know, and did you tell me?" There is no turnover figure at which people stop minding. And the arithmetic of small business is unforgiving: your reputation is local, your customers talk to each other, and you have no communications department to absorb the damage. What a large organisation survives as a news cycle, you experience as a conversation at the shops.

I have watched both versions play out. The organisation that gets in front of it, says plainly what happened, and takes the criticism, comes out bruised. The one that says nothing and gets found out later loses permanently, because by then the story is not the breach. It is the concealment.

In thirty years I have never seen an organisation regret telling people too early. I have watched several regret the fortnight they spent deciding.

Decide it now, while it costs you nothing

You cannot draft this on the day. On the day you will be tired, defensive, and getting advice from three directions. So make four decisions in advance and write them into your run book, where the rest of your bad-day instructions already live.

Who decides. One named person who makes the call on whether to notify. In most small businesses that is you, and the point of writing it down is so that it is still true when you are the one on a plane.

What triggers telling people. Pick your own line and say it out loud: if information that could be used to impersonate, defraud or embarrass someone has left our control, we tell them. That standard is stricter than the law's serious-harm test, which is the idea.

What the message says. Four things and no more: what happened, what information was involved, what you are doing about it, and what they should do. No legal throat-clearing, no passive voice, no paragraph about how seriously you take security. People can smell that from the subject line.

Who else gets told. ReportCyber for the cybercrime report. IDCARE if identity information is exposed. Your bank if payment details are in scope. Your insurer early, because many cyber policies carry notification conditions that bite if you sit on it - check what your policy requires before you need to know. And whichever supplier was holding the data, if it was not you, which is far easier to answer if you already keep a list of who has the keys.

Then run the whole thing as one of the scenarios in your thirty-minute drill. You will discover, for example, that you cannot produce a list of affected customers without the very system that just went down, which is the sort of thing better found on a quiet Thursday.

None of this is technical. It is deciding, in the cold light of an ordinary week, what sort of business you intend to be on the worst day. The law will tell you the minimum, and for a lot of you the minimum is nothing at all.

So the question is not what you are required to say. It is what you would want to be told, if it were your details on somebody else's laptop.

One caveat, and I mean it. This is general information about how the scheme works, not legal advice about your business. Whether the Act reaches you turns on facts I do not have, and if you are close to the line or in one of the covered categories, the OAIC's own guidance is the place to start and a lawyer is the place to finish.

---

Sources

• Office of the Australian Information Commissioner, Rights and responsibilities under the Privacy Act - retrieved 5 August 2026, https://www.oaic.gov.au/privacy/privacy-legislation/the-privacy-act/rights-and-responsibilities
• Office of the Australian Information Commissioner, About the Notifiable Data Breaches scheme - retrieved 5 August 2026, https://www.oaic.gov.au/privacy/notifiable-data-breaches/about-the-notifiable-data-breaches-scheme
• Office of the Australian Information Commissioner, Data breach preparation and response, Part 4: Notifiable Data Breach scheme - retrieved 5 August 2026, https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/preventing-preparing-for-and-responding-to-data-breaches/data-breach-preparation-and-response/part-4-notifiable-data-breach-ndb-scheme
• Office of the Australian Information Commissioner, Latest Notifiable Data Breach statistics for January to June 2025 - retrieved 5 August 2026, https://www.oaic.gov.au/news/blog/latest-notifiable-data-breach-statistics-for-january-to-june-2025
• Red Bridge Cyber, perspective: Write the Run Book Before You Need It
• Red Bridge Cyber, perspective: The Thirty-Minute Fire Drill
• Red Bridge Cyber, guide: Do I need cyber insurance?
• Red Bridge Cyber, perspective: Who Still Has the Keys?