Privacy Obligations for SMEs: What You Hold, Why You Hold It, How You'd Lose It

For decades, the standard SME position on privacy law was comfortable: most businesses under the small-business turnover threshold sat largely outside the Privacy Act, so the topic belonged to corporates. That comfort has been eroding from three directions at once — reform momentum has been steadily tightening the regime (with the long-flagged removal of the small business exemption moving from discussion toward drafting), penalties for serious interference with privacy have grown real teeth, and customers stopped caring about thresholds entirely: in the era of weekly breach headlines, data handling is a trust question asked of every business that holds a phone number. The practical SME position, whatever your current legal exposure: know what you hold, hold less of it, protect what remains, and be able to explain all three. Here's each in turn.

Know what you hold (the answer will surprise you)

Run the 30-minute inventory: what personal information lives where? The usual map: customer contact and payment details in the POS/CRM/accounting stack; quote and job histories with addresses and sometimes property/security details; employee files — the densest holdings in most SMEs, with TFNs, bank accounts, medical certificates, emergency contacts; marketing lists; CCTV; and the shadow layer — the spreadsheet exports, the photos on phones, the old database from the previous system that nobody migrated or deleted. For each cluster: where is it, who can access it, and — the question that does the real work — why do we still have it? Most SMEs discover they're indefinitely retaining everything they've ever collected, on the default setting of never deciding otherwise.

Hold less of it

Data is liability wearing an asset costume: every record you hold is something you must protect, could breach, and may one day have to explain. Three reduction habits beat any policy document. Collect minimally — every form field is a decision; the date-of-birth you don't collect is the date-of-birth you can never leak. Retain deliberately — set simple retention rules (customer records X years post-relationship, unsuccessful job applications months not years, CCTV weeks not forever), aligned with the records you genuinely must keep (tax records have their own multi-year obligations — retention isn't deletion-mania, it's decided timeframes). And purge the legacy — the old system's export, the departed-staff files from 2015, the USB drives in the drawer. The breach that hurts most is the one involving data you'd forgotten you had and never needed.

Protect what remains

Privacy in practice is mostly the security fundamentals we've covered elsewhere, aimed at personal information: access on a need-to-know basis (the whole team doesn't need the full customer database; payroll files locked to payroll people), MFA on every system holding personal data, the BYOD lines that keep customer lists out of personal cloud accounts, vendor diligence on the platforms you entrust data to (where is it stored, what's their breach history, what happens when you leave), and the tested backups that make ransomware a bad week rather than a data-loss event. Add the two privacy-specific muscles: a breach response sketch — who assesses, who you'd call (your IT provider, insurer, lawyer), and awareness that a notifiable data breaches regime exists with assessment and notification expectations for entities it covers (and as the regime's reach extends, "we didn't know we had to tell anyone" ages badly) — and marketing consent hygiene: the Spam Act applies to businesses of every size already, so consent-based lists, working unsubscribes honoured promptly, and identification on every commercial message are current obligations, not future ones.

Be able to explain it

The final position is a one-page privacy statement in plain English: what you collect, why, where it's stored, who it's shared with (the payment processor, the booking platform, the marketing tool — name the categories), how long you keep it, and how someone can ask about or correct their information. Publish it on the website, reference it at collection points. Beyond hygiene, this document is increasingly commercial: enterprise customers' procurement questionnaires, insurer proposals and tender responses all now ask privacy questions, and "here's our statement and our practices" beats improvisation every time. The businesses treating privacy as a trust asset rather than a compliance grudge are building exactly the position the tightening law — and the nervous customer — will reward.

FAQ

Are we actually covered by the Privacy Act right now?

It depends on turnover, sector and activities — health service providers, businesses trading in personal information, and several other categories are covered regardless of size, and the small-business exemption itself is on the reform chopping block. Get a current answer for your specifics — and note that everything above is worth doing at any coverage level.

What about employee records?

Employee records have historically had their own partial exemption for private employers — another area under reform pressure. Treat staff data as your most sensitive holding regardless: the obligations may be evolving, but the trust stakes and the breach consequences are already maximal.

Do we need a privacy officer?

You need an owner — one named person who keeps the inventory current, owns the statement, and would coordinate a breach response. In an SME that's a hat, not a hire.

---

Data holdings, access control and breach readiness are part of our free Business Health Check — five minutes to find the exposures before someone else does.