Do sole traders need a privacy policy in Australia?

Short answer: most sole traders are still covered by the Privacy Act's small-business exemption (annual turnover under $3 million) today, but the exemption already has exceptions that catch some trade businesses, and it narrows further for specific business types from 1 July 2026 — so "I'm too small" is worth double-checking rather than assuming.

Who's already excluded from the exemption, regardless of size

• Health service providers — including anyone holding health-related records, which can catch businesses that don't think of themselves as health providers.
• Businesses that trade in personal information — buying or selling contact lists or data as part of the business.
• Businesses that collect or hold tax file numbers.

What changes from 1 July 2026

Businesses that become "reporting entities" under AML/CTF tranche-two reforms — a group that includes many accountants, lawyers, real estate agents, and some trust or company service providers — lose the small-business exemption from that date, regardless of turnover. If that doesn't describe your trade, this specific change doesn't catch you, but it's a sign the exemption is narrowing rather than staying fixed.

Should you have a privacy policy anyway, even if exempt?

Practically, yes, for reasons beyond strict legal obligation. If you're storing customer names, addresses, phone numbers, and job photos in ServiceM8 or a spreadsheet, having a plain-English one-pager on what you do with that information is the kind of thing that costs an afternoon and heads off an awkward conversation later — with a client, a platform you're selling through, or an insurer asking about your data practices.

It's also simply good practice regardless of the legal threshold — the businesses that treat customer data carelessly before they're legally required to are usually the same ones scrambling when the requirement does eventually catch them.