The short version: Most Australian tradies and sole traders are not covered by the Privacy Act 1988. The small business exemption (annual turnover under $3 million) excludes the majority of single-operator electrical, plumbing, landscaping, cleaning, and similar trades. That includes the new 10 December 2026 automated decision-making transparency rules. But the exemption has carve-outs — and even where it applies, it does not cover the Spam Act, the Do Not Call Register, or contractual obligations you may have inherited from covered customers. This article gives you the plain-English version.
Under the Privacy Act 1988, a business is generally only an "APP entity" — and therefore bound by the Australian Privacy Principles — if it has an annual turnover of more than $3 million. Most Australian sole traders and small trade businesses fall under this threshold and are exempt.
If you are exempt, the new Privacy Act 2026 changes — including the APP 1.7 automated decision-making transparency requirements commencing 10 December 2026 — do not apply to you directly. Our main Privacy Act 2026 article covers what those rules mean for covered businesses; this article is the version for everyone else.
The small business exemption is not absolute. A business under $3 million in turnover is still covered by the Privacy Act if it falls into one of these categories:
Any business that provides a health service or holds health information about an individual is covered regardless of turnover. This includes obvious cases (allied health practitioners) and some less obvious ones — for example, a tradie subcontracted to do specialised renovations for a medical practice who holds patient access details, or an NDIS support worker.
If you have an Australian Government contract — federal, not state — that requires you to handle personal information, the small business exemption is lost in respect of that contract. Tradies on Defence contracts, federal building works, or government IT projects are common examples.
Buying, selling, or providing personal information for benefit, service, or advantage removes the exemption. This typically catches lead-generation businesses, list brokers, and marketers — not most tradies — but the threshold is lower than it sounds. A business that sells its customer database to a competitor on exit, for example, may have crossed this line.
If you offer credit terms or report credit defaults, parts of the Privacy Act (Part IIIA — credit reporting provisions) apply regardless of turnover. Most tradies do not fall into this, but those running formal payment plans with credit defaults reporting may.
A small business that is a related body corporate of a larger covered business loses the exemption. Common in franchise structures and group entities.
Any small business can voluntarily opt into Privacy Act coverage by notifying the OAIC. Most do not, but some do for reputational or competitive reasons.
Even if the Privacy Act does not apply to your trade business, three other regulatory frameworks do, and the small business exemption does not protect you from them.
If you send marketing emails or SMS, you must have consent (express or inferred), identify yourself, and provide an unsubscribe option. There is no turnover threshold. Penalties from ACMA can be substantial. For tradies sending booking reminders or "haven't heard from you in a while" follow-ups, this matters.
Outbound marketing phone calls must respect the Do Not Call Register, with calling-hour restrictions, accurate caller ID, and proper identification. Inbound calls are not affected. For tradies doing cold outreach (canvassing for new work, follow-up sales calls), this is the regulation to know.
The ACL applies to all businesses regardless of size. Misleading or deceptive conduct, false representations, and unfair terms in standard form consumer contracts are all enforceable by the ACCC. Privacy policies that overstate your practices are caught by the ACL even if the Privacy Act does not catch you.
The most common way exempt tradies still end up with privacy obligations is through their contracts. When you do work for a covered business — a medical practice, a law firm, a large corporate, a government agency — that customer's own Privacy Act obligations will often extend down to you through the supply contract.
If a medical practice engages you to do facilities maintenance and you receive any patient names, addresses, or appointment details in the course of the work, you become bound by the practice's privacy obligations in respect of that information. The fact that you are independently exempt does not help. Same applies to NDIS providers, aged care providers, government contractors, and many enterprise customers.
The practical implication: read the privacy clauses in any contract with a covered customer. Some will impose ongoing obligations on you that look similar to the Privacy Act.
Even where you are clearly exempt, there are three reasons to behave as if covered:
For most tradies using an AI receptionist, the compliance picture is straightforward:
We build AI receptionist systems for Australian tradies, sole traders, and service businesses. If you are under $3M turnover and not serving regulated customers, the compliance burden is genuinely light. If you are, we can help you scope a system that respects the obligations you have inherited.
Get in touchWhat this looks like for a solo Perth physio or chiro
The most common question I get from sole trader clinic owners in Perth is: "I'm a one-person practice — does this really apply to me?" The answer is yes, specifically because health information triggers the Privacy Act regardless of business size. The practical reality is that the compliance work for a solo clinic is much lighter than for a multi-practitioner centre. The three things a sole trader clinic genuinely needs before 10 December: an updated privacy policy that discloses any AI tools used in the practice, a call opening script that identifies AI use before collecting patient information, and a simple data retention policy that documents how long patient records and call data are kept. For most solo practitioners I work with, this is a half-day of setup — not a months-long compliance project.