Privacy Act, SMB1001 and cyber insurance

Why it matters

Cybercrime is a real cost for Australian businesses. In its Annual Cyber Threat Report 2025-26, the Australian Signals Directorate (ASD) reports:

• over 82,000 cybercrime reports, one every 6 minutes
• an average self-reported cybercrime cost of $93,500 per business report, up 16%.

Beyond the direct cost, a breach can bring legal obligations, lost customers and damage to your reputation. Compliance is about knowing which rules apply to you, and being able to show what you do to protect your systems and data.

Does the Privacy Act apply to your business?

The Privacy Act and its 13 Australian Privacy Principles (APPs) generally apply to businesses with annual turnover of more than $3 million. According to the OAIC (Office of the Australian Information Commissioner), it doesn’t apply to most small businesses, but it may apply to some.

It may apply to you if your turnover has been over $3 million in any financial year since 2002. Turnover includes all income from all sources.

It may also apply to some businesses regardless of turnover. The OAIC’s list includes:

• health service providers
• businesses that trade in personal information
• contractors providing services under a Commonwealth contract
• operators of residential tenancy databases
• credit reporting bodies
• reporting entities under the Anti-Money Laundering and Counter-Terrorism Financing (AML/CTF) Act
• businesses accredited under the Consumer Data Right
• businesses related to a business the Privacy Act applies to
• businesses that have chosen to opt in.

The OAIC has a privacy checklist for small business to help you work it out. If you’re unsure, get advice.

What changed on 1 July 2026

AUSTRAC says that from 1 July 2026, AML/CTF laws apply to designated services commonly provided by:

• legal professionals
• accountants
• conveyancers
• real estate professionals
• dealers in precious metals, stones and products.

Businesses that provide these designated services need to enrol with AUSTRAC and meet AML/CTF obligations, including an AML/CTF program and customer due diligence. AUSTRAC has program starter kits for typical small businesses in these sectors.

Because AML/CTF reporting entities are on the OAIC’s list of businesses the Privacy Act may apply to regardless of turnover, many small firms in these sectors may now have Privacy Act obligations too, including for the identity documents and client information they collect. Ask your professional body or adviser how far the obligations extend for your business.

What the Privacy Act requires on security

If the Privacy Act applies to your business:

• Protect personal information. You must take reasonable steps to protect the personal information you hold from misuse, interference, loss and unauthorised access.
• Notify eligible data breaches. Under the Notifiable Data Breaches (NDB) scheme, the OAIC explains that an eligible data breach happens when there’s unauthorised access to, disclosure of, or loss of personal information that is likely to result in serious harm, and you haven’t been able to prevent that harm. You must quickly assess a suspected breach, and notify the OAIC and affected individuals if it’s eligible.
• Keep your privacy policy current. From 10 December 2026, the OAIC says businesses the Privacy Act applies to must include information in their privacy policy where they’ve arranged for a computer program to make or inform decisions that significantly affect individuals’ rights or interests.

Privacy law continues to be reformed. Check the OAIC website for changes.

Even if the Privacy Act doesn’t apply to you, protecting customer data is good practice, and customers expect it.

The frameworks: Essential Eight and SMB1001

You don’t need to invent your own security standard. Two are commonly used by Australian small businesses.

The Essential Eight

The Essential Eight is ASD’s framework of eight mitigation strategies that work together to protect organisations against cyber threats. It has maturity levels, and ASD’s small business guidance recommends that small businesses work towards Maturity Level One. The Small business cyber security handbook is a practical starting point.

SMB1001

SMB1001 is a cyber security certification standard designed for small and medium businesses, published by Dynamic Standards International (DSI). DSI describes it as:

• multi-tiered, with five levels of increasing maturity, so you can start at the level that suits your business
• covering five areas: technology management, access management, backup and recovery, policies and processes, and education and training
• updated regularly, with the 2026 edition now current.

CyberCert is the official certifier for SMB1001. Levels differ in how they’re checked, so ask whether a level is self-assessed or independently verified, and whether that meets the needs of the customer, tender or insurer asking.

ISO/IEC 27001 is the international information security management standard. It’s widely recognised but usually more demanding and costly for a small business.

Customers, tenders and insurers

Even where no law requires it, others may ask about your security:

• Larger customers and government tenders increasingly ask suppliers to show their cyber security, sometimes with a certification.
• Cyber insurers usually ask about your security controls, such as multi-factor authentication, backups, updates and staff training, before offering cover. This guide doesn’t recommend insurance products. Talk to an insurance broker about whether cover suits your business.

Keep a simple record of what you’ve put in place, so you can answer these questions quickly.

A practical compliance checklist

• Work out whether the Privacy Act applies to you, using the OAIC’s checklist
• If you’re in a newly regulated AML/CTF sector, enrol with AUSTRAC and get advice on your obligations
• List the personal information you collect, where it’s stored, and who can access it
• Turn on multi-factor authentication for email and all key accounts
• Keep devices and software updated
• Back up important data, and test that you can restore it
• Give staff only the access they need, and remove access when they leave
• Train staff to spot scams and suspicious emails
• Write a short data breach response plan: who does what, and when
• Review your privacy policy
• Consider a framework such as the Essential Eight or SMB1001 to guide and show your progress

See Cyber security and backups.

If something goes wrong

• Report cybercrime and cyber incidents to ASD at cyber.gov.au/report, or call the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371).
• Assess whether personal information was affected, and whether it’s an eligible data breach you must notify.
• Contain the problem: change passwords, disconnect affected devices and get expert help.
• Keep records of what happened and what you did.

Getting help

• Your IT provider or a managed service provider (MSP) can help you put controls in place and prepare for certification.
• Your accountant, lawyer or professional body can help with privacy and AML/CTF obligations.
• Review your compliance yourself. SafeSMB is designed specifically for Australian small businesses. It helps them review their own cyber security and compliance through a guided self-review, and protect their business email from hackers so it can be recovered when things go wrong.