If you run an Australian MSP, your small business clients may be concerned about messaging like “the $3 million Privacy Act exemption ends on 10 December 2026, comply now or face penalties.”
DON’T PANIC. The exemption is still law, and no Bill to remove it has been introduced. But the direction is clear, and parts of the exemption have already been stripped away. For MSPs, there are some things to be aware of, and potentially some opportunities to guide more intractable clients towards better security.
Where Australian Privacy law stands
While the $3 million small business exemption has not been removed, three changes already in place have narrowed it, and a fourth is on the way.
| Change | Status | Date | What it means for small business |
|---|---|---|---|
| Tranche 2 privacy reforms: Privacy Amendment (Personal Data Protection) Bill 2026 | Exposure draft only | Released 31 Aug 2026; consultation closed 18 Sep 2026 | Does not remove the small business exemption. Proposes a “fair and reasonable” test, 72-hour breach notification and a controller/processor framework |
| Automated decision-making transparency | Legislated (tranche 1) | Commences 10 Dec 2026 | Applies only to businesses already covered. This is the date being mis-sold as the end of the exemption |
| AML/CTF tranche 2 | In force | 1 Jul 2026 | Accountants, lawyers, conveyancers, real estate agents and trust and company service providers are now covered by the Privacy Act for their AML/CTF handling, whatever their turnover |
| Statutory tort for serious invasions of privacy | In force | 10 Jun 2025 | Individuals can sue directly. There is no small business exemption |
| Removal of the small business exemption | Agreed in principle (Sep 2023) | No Bill, no date | Would bring roughly 2.3 million more businesses under the Australian Privacy Principles |
Three points to remember when you talk to clients.
- Many “small” businesses are already covered. Health service providers (GPs, physios, allied health, many NDIS providers), businesses that trade in personal information and Commonwealth contractors have always been covered, regardless of turnover. Since 1 July 2026, so are AML/CTF reporting entities, and the OAIC says they should stop keeping full copies of ID documents unless another law requires it.
- The statutory tort is not going to get everyone sued. A claimant must show a serious invasion of privacy that was intentional or reckless: a breach caused by ordinary carelessness is unlikely to qualify on its own. The more realistic small business exposure is insider misuse: a staff member snooping on records, sharing customer details or leaking data.
- Keep an eye on Tranche 2. If the controller/processor framework is enacted as drafted, the businesses that process personal information on behalf of others (which describes most MSPs) would carry obligations of their own. So would a 72-hour deadline to notify the OAIC of an eligible data breach.
The biggest risk isn’t a regulator knocking on your client’s door. It’s that you become part of the problem.
Privacy Act changes - risks for MSPs
The biggest risk isn’t a regulator knocking on your client’s door. It’s that you become part of the problem.
- You are the supply chain. You hold admin access to dozens of client environments through your RMM, PSA and Microsoft 365 partner relationships. One compromised MSP account can become a breach across every client at once, and the client’s customers won’t care whose tool failed.
- Your own obligations are growing. Clients that are covered (health, finance, accounting, real estate, larger businesses) will push privacy and security clauses down to you. If tranche 2’s processor obligations pass, some of that will be direct rather than contractual.
- Backups can work against you. Long or indefinite retention keeps old ID scans, health records and customer files alive long after the client should have destroyed them. Data minimisation is moving from good practice to a stated obligation, and your backup policies need to keep up.
- Breach response will get faster. The proposed 72-hour notification window leaves little room for an MSP that takes two days to work out what happened. Your logging, forensics access and escalation paths will be tested.
Potential opportunities for Australian MSPs
The case for security doesn’t depend on the exemption going. The ASD’s Annual Cyber Threat Report 2025-26, published this week, puts the average self-reported cost of cybercrime for a small business at $55,400 per report. Email compromise and BEC fraud together made up about a third of business reports, and ASD says AI is making attackers faster and more convincing.
- Clients who are already covered. Accountants, bookkeepers, law firms, conveyancers, real estate agencies and health providers have obligations today. They need privacy-ready IT now, not “when the law changes”. Check out our blog post covering this opportunity in more detail.
- A certifiable baseline, priced as a product. Build your minimum tier around SMB1001. For most clients, Silver or Gold is a realistic target, and Gold brings in EDR, email authentication, an incident response plan and an asset register which really should be your basic acceptable standard.
- Data discovery and clean-up. Find and remove what clients shouldn’t keep: old ID scans, spreadsheets of customer details on laptops, years of unmanaged email archives. For AML/CTF reporting entities this links directly to the OAIC’s guidance on not retaining full ID copies.
- Incident readiness. A one-page incident response plan, tested once a year, plus a retainer for breach support. Clients notice when you’ve already thought about their worst day.
- Supplier assurance. Larger customers increasingly send security questionnaires to their suppliers. Help clients answer them with evidence, and they win and keep contracts.
The bottom line
The $3 million exemption hasn’t gone, and nobody knows when or even if it will. What has changed is that more small businesses are already covered, individuals can potentially sue directly, and the cost of cybercrime keeps climbing.
MSPs that act promptly, accurately and calmly, will be the trusted adviser when the exemption does go. Those that wait, or sell fear, might find themselves explaining why the December deadline came and went with nothing changing.
Manage Protect can help you certify your MSP and clients under SMB1001 – get in touch if you’d like some assistance.
