Do sole traders need a privacy policy in Australia?

Short answer: most sole traders are still covered by the Privacy Act's small-business exemption (annual turnover under $3 million) today, but the exemption already has exceptions that catch some trade businesses, and it narrows further for specific business types from 1 July 2026, so "I'm too small" is worth double-checking rather than assuming.

Who's already excluded from the exemption, regardless of size

• Health service providers, including anyone holding health-related records, which can catch businesses that don't think of themselves as health providers.
• Businesses that trade in personal information, buying or selling contact lists or data as part of the business.
• Businesses that collect or hold tax file numbers.

What changes from 1 July 2026

Businesses that become "reporting entities" under AML/CTF tranche-two reforms (a group that includes many accountants, lawyers, real estate agents, and some trust or company service providers) lose the small-business exemption from that date, regardless of turnover. If that doesn't describe your trade, this specific change doesn't catch you, but it's a sign the exemption is narrowing rather than staying fixed.

Should you have a privacy policy anyway, even if exempt?

Practically, yes, for reasons beyond strict legal obligation. If you're storing customer names, addresses, phone numbers, and job photos in ServiceM8 or a spreadsheet, having a plain-English one-pager on what you do with that information is the kind of thing that costs an afternoon and heads off an awkward conversation later, with a client, a platform you're selling through, or an insurer asking about your data practices.

It's also simply good practice regardless of the legal threshold. The businesses that treat customer data carelessly before they're legally required to are usually the same ones scrambling when the requirement does eventually catch them.