Small agencies lost their privacy exemption on 1 July, and most did not notice

The Privacy Act's small business exemption stopped applying to designated services on 1 July 2026, when agencies became AML reporting entities. A separate reform package now out for consultation would narrow the exemption further.

Real estate agencies turning over less than $3 million a year have operated for decades outside the Privacy Act, relying on the small business exemption that covers most Australian businesses of that size.

For the parts of the business providing designated services, that exemption ended on 1 July 2026.

The change did not come from privacy reform. It came from the anti-money laundering package. Section 6E(1A) of the Privacy Act operates so that a small business operator which is a reporting entity under the AML/CTF Act is treated as an organisation for the purposes of the Act, and from 1 July 2026 the exemption does not apply to the parts of a business providing designated services under that legislation. Real estate agents sit alongside lawyers and accountants in the tranche 2 cohort captured on that date.

The practical result is that a great many small agencies which spent the first half of the year preparing customer due diligence processes acquired a second set of obligations at the same moment, governing what they do with the information those processes collect.

Agencies hold some of the more sensitive data sets in commercial life. Tenancy applications alone can carry identity documents, income evidence, employment details, rental history and referee contact details for people who have no commercial relationship with the agency at all and no realistic ability to refuse to hand the material over. Add vendor and buyer records, appraisal databases and the identity documents now being collected for AML purposes, and the exposure is substantial.

What has not happened

The $3 million turnover exemption itself has not been repealed.

That distinction matters, because it has been blurred in a good deal of the compliance commentary circulating this year. The exemption in section 6D of the Privacy Act remains in place, and the exposure draft released for the second tranche of privacy reform does not propose to remove it. Businesses below the threshold which provide no designated services and do not otherwise fall outside the exemption remain exempt for now.

What has happened is narrower and, for agencies, more targeted.

The exposure draft, and the referral problem

The Attorney-General's Department has released an exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026 for the second tranche of reform. Submissions close on 18 September 2026. The commencement table in the draft is blank, so no start date has been published for any part of it.

The draft leaves the turnover threshold alone but amends section 6D to tighten what counts as trading in personal information. Trading has always cost a small business its exemption. Under the draft, an organisation discloses personal information as a trade where it does so for money or other consideration, or for the purposes of direct marketing.

For real estate, that is not an abstract test. Referral arrangements are ordinary industry practice. Utility connection services, mortgage broking, conveyancing, insurance and moving services are routinely offered to buyers and tenants, and those arrangements frequently carry a fee or commission back to the agency. A disclosure of personal information that attracts consideration is a disclosure for consideration, whatever it is called internally. Passing a database to a marketing partner is captured on the second limb regardless of whether money changes hands.

An agency under the turnover threshold that has assumed the exemption covers its referral book should read that provision closely.

What else is in the draft

The centrepiece is a fair and reasonable test applying to the collection, use and disclosure of personal information, assessed against factors including a reasonable person's expectations, data minimisation, genuine choice, and the proportionality of any privacy impact. Where a child is involved, their best interests are a primary consideration. The significance of the test is structural: consent stops being a complete answer and becomes one element of whether the handling was justified.

Consent itself is defined for the first time, and must be voluntary, informed, current, specific and unambiguous. Bundled consents and consents relied on for years would not meet that standard.

Data breach notification tightens considerably. The current 30 day assessment window is replaced by an obligation to notify the Information Commissioner within 72 hours of having reasonable grounds to believe an eligible breach has occurred, with affected individuals notified at the same time or as soon as practicable.

The categories of sensitive information expand to include genomic information, biometric templates, and precise geolocation tracking data, defined as location within a radius of 500 metres tracked over time rather than a single point in time capture. Agencies running location-enabled inspection, check in or agent tracking tools are the ones to think about that.

A controller and processor split is introduced. A processor acting on documented written instructions would avoid breaching the Australian Privacy Principles, other than APP 1 and APP 11, with liability shifting to the controller. For agencies, that means the CRM, trust accounting platform or outsourced administration provider is not where responsibility lands. The agency is.

Direct marketing is dealt with separately. Disclosure of personal information for direct marketing would require consent, and unsubscribe mechanisms must be simple, with clear instructions on every communication.

A right to erasure is included but confined to large digital platforms, defined by group revenue above $500 million or an average of 2.5 million Australian users. Agencies are well outside it. The employee records exemption is not amended.

The exposure that exists regardless

Separately from all of this, the statutory tort for serious invasions of privacy commenced on 10 June 2025. It reaches individuals and entities that are not Australian Privacy Principle entities, which means a business exempt from the Privacy Act can still be a defendant.

A plaintiff must show either an intrusion upon seclusion or a misuse of information, a reasonable expectation of privacy in the circumstances, and that the public interest in privacy outweighs any competing public interest. Courts can award damages, grant an injunction or order an apology.

That is the point most often missed in discussion of the small business exemption. The exemption governs whether the regulator can act. It has never governed whether an individual can sue.

---

Sources

Reporting for this article draws on the exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026, published by the Attorney-General's Department, and the department's accompanying consultation material. Guidance on the statutory tort for serious invasions of privacy is taken from the Office of the Australian Information Commissioner. The operation of section 6E(1A) of the Privacy Act and the position of real estate agents in the tranche 2 cohort is drawn from the Law Society of New South Wales journal. Analysis of the exposure draft published by Johnson Winter Slattery, Colin Biggers & Paisley and Maddocks was also consulted.

Consultation on the exposure draft closes on 18 September 2026. No commencement date has been published for any provision of the draft bill. This article reports on the state of the law and of the reform process at the date of publication and is not legal advice.