Australian Small Businesses Must Be Careful With Customer Data Amid More Strict Privacy Laws: Report

By Kekeletso Nkele, small.news Assistant

(small.news) — Australian small business owners are being urged to take more responsibility for how they collect and handle customer data, even during face-to-face conversations, said Bitdefender.

While information is gathered in person, it is often entered into digital systems, platforms, or cloud-based tools shortly afterward.

OAIC to Review In-Person Data Collection

Starting in early 2026, the Office of the Australian Information Commissioner (OAIC) will review the privacy policies of businesses that collect personal information in person.

The review will focus on everyday situations, including:

– Rental inspections
– Pharmacy counters
– Vehicle test drives

In these scenarios, customers are often asked for personal details quickly, with little opportunity to question why or refuse. This move follows growing concern about excessive data collection.

Although policies are in place, the Australian Competition and Consumer Commission (ACCC) estimates that the average Australian would spend 46 hours per month reading each policy they sign.

What’s Changing and Why It Matters

Under Australia’s Privacy Act, businesses already must explain what data they collect, why they need it, and how it will be used.

Reforms passed in 2024 raise the bar. From December 2026, privacy policies must clearly disclose whether automated systems are used to make decisions about individuals, such as rejecting a rental application.

The reforms also give the OAIC new enforcement powers, including the ability to issue fines without going to court, and expand individuals’ rights to seek compensation when their data is misused.

Businesses that do not have a complaint privacy policy or that do not have a privacy policy at all are subject to a fine of $66,000.

Sectors Affected By The Privacy Policy

These sectors were flagged by the OAIC due to power imbalances that leave customers feeling they have no choice but to comply with the collection of their personal information.

60 businesses are set to be reviewed in the following sectors:

– Rental and property
– Chemists and pharmacists 
– Licensed venues
– Car rental companies
– Car dealerships
– Pawnbrokers and second-hand dealers