Does the Privacy Act apply to you?
The Privacy Act 1988 generally applies to businesses with an annual turnover of more than $3 million. Many smaller businesses are covered anyway, including:
- Health service providers, which includes many allied health and wellness businesses
- Businesses that trade in personal information, such as buying or selling customer lists
- Contracted service providers to the Australian Government
- Businesses that have chosen to opt in
The rules are being reformed, and changes passed in 2024 added new obligations and a right to take action over serious invasions of privacy. Check the OAIC’s small business guidance for the current position.
The principles in plain English
Covered businesses must follow the 13 Australian Privacy Principles. For a CRM, the most relevant are:
- Be open. Have a clear privacy policy explaining what you collect and why.
- Collect only what you need, by fair means, and tell people you’re collecting it.
- Use it for the reason you collected it, or a related reason they would expect.
- Keep it accurate and up to date.
- Keep it secure, and delete or de-identify it when you no longer need it.
- Let people see and correct the information you hold about them.
- Take care with overseas disclosure, including cloud services that process data offshore.
Data breaches
Businesses covered by the Act must notify affected people and the OAIC when a data breach is likely to cause serious harm, under the Notifiable Data Breaches scheme. Even if you aren’t covered, have a plan: who to call, how to lock down access and how to tell customers.
Good habits for every business
- Only store fields you actually use. Don’t collect birth dates or ID numbers “just in case”.
- Give staff access to the records they need, not the whole database. See CRM permissions.
- Turn on two-factor authentication for everyone.
- Remove access the day someone leaves.
- Delete records you no longer have a reason to keep.
- Know where your CRM stores data and which providers it uses.
A simple privacy checklist for your CRM
| Check | Why |
|---|---|
| We only collect fields we use | Less data, less risk. |
| Staff see only what they need | Limits the damage from mistakes or misuse. |
| Everyone uses two-factor sign-in | Protects against stolen passwords. |
| Leavers lose access on their last day | Former staff are a common source of breaches. |
| We delete records we no longer need | Old data is still your responsibility. |
| We know where our data is stored | Needed to answer customer questions and meet obligations. |
| We have a breach plan | Speed matters when something goes wrong. |
Handling a customer’s access request
If someone asks what information you hold about them, confirm who they are first, then find their records and provide the information within a reasonable time. Correct anything that is wrong. Keep a short note of the request and what you did. If you are covered by the Privacy Act, the OAIC’s guidance sets out the expected response times.
Health information and other sensitive data
Some information, such as health details, racial or ethnic origin and criminal records, is treated as sensitive and carries stricter rules. Most small businesses shouldn’t store it in a general CRM at all. If you are a health service provider, use systems designed for clinical records and keep the CRM for business relationships.
How NovaSoft One helps
NovaSoft One stores customer records in Sydney, supports two-factor authentication, limits each person to the areas their role allows, records communication preferences on each contact, and lets workspace administrators export their data. Business plans add per-area permission controls and a workspace audit log. These tools support your privacy practices; they don’t replace them.
Common questions
Is a business with under $3 million turnover exempt from privacy law?
Often, but not always. Health service providers and businesses that trade in personal information are covered regardless of turnover, and other laws such as the Spam Act still apply.
Do we need a privacy policy?
If the Privacy Act applies to you, yes. Even if it doesn’t, a short, honest policy builds trust and is expected by many customers.
This guide is general information for Australian businesses, not legal, tax or financial advice. Check anything specific to your situation with a qualified adviser or the relevant government agency.