In two of the four markets most small businesses operate in, there is no small-business exemption at all. In the other two it is narrowing.
Short answer: It depends on where you operate, and the answer is "yes" more often than owners expect. New Zealand and the European Union have no small-business exemption at all, so a sole trader is covered on day one. Australia exempts businesses turning over $3 million or less, but that exemption has more holes each year. The United States has no general federal law, and most state laws use volume thresholds a twenty-person firm sits under, though not all of them.
Key takeaways
It is worth saying plainly, because it reframes the whole question: exempting small businesses from privacy law is unusual. New Zealand does not do it. The European Union does not do it. Australia does, and the OAIC has itself observed that no other comparable international jurisdiction exempts small businesses from privacy legislation.
So if your instinct is "we are too small for this to apply", that instinct comes from one specific national choice that is under active review, not from any general principle about how privacy law works.
Under the Privacy Act 1988, a small business is one with an annual turnover of $3 million or less, and most such businesses are not covered.
Two details matter and are usually skipped. First, turnover here is broader than most owners assume: OAIC defines it as "all income from all sources", excluding assets held, capital gains and proceeds of capital sales. Second, $3 million is not a large number for a professional services firm. A practice of a dozen people billing at professional rates clears it comfortably. If you are in the $1M to $10M range, you are as likely to be above the line as below it, and you should check rather than assume.
Eleven categories are covered regardless of turnover. The ones that catch ordinary firms: health service providers holding health records, businesses trading in personal information, contractors under a Commonwealth contract, credit reporting bodies, residential tenancy database operators, businesses accredited under the Consumer Data Right, and anything related to a covered business.
The change most firms have missed: reporting entities under the Anti-Money Laundering and Counter-Terrorism Financing Act are covered regardless of size, and from 1 July 2026 that scheme expanded to "tranche 2": real estate professionals, dealers in precious stones and metals, and professional service providers including lawyers, conveyancers, accountants, and trust and company service providers. OAIC states the obligation "includes those which are small businesses with an annual turnover of less than $3 million."
Read that against your own client list. A small accounting practice under $3 million turnover, which was exempt in June 2026, is now covered for the personal information it handles in connection with its AML/CTF obligations. The coverage is scoped to that activity rather than the whole business, but it is coverage.
Separately, a statutory tort for serious invasions of privacy commenced on 10 June 2025. It is broader than the Act itself, extending to entities that are not Australian Privacy Principle entities. An exempt small business can still be taken to court over a serious privacy invasion. This is the point that makes "we are exempt" a weaker position than it sounds.
You can also opt in voluntarily: a form to the OAIC, a published privacy policy, and your trading name and ABN go on a public opt-in register. Some firms do it because clients ask.
On reform, be careful what you believe. An exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026 was released on 31 August 2026 with submissions closing 18 September 2026. It proposes a fair-and-reasonable test, a right to erasure and digital identity protections. It does not remove the small business exemption. Blanket removal remains a future tranche that has not been legislated, and anyone telling you it has a start date is ahead of the evidence.
The Privacy Act 2020 applies to every "agency", meaning organisations and businesses, that operates in New Zealand and collects personal information. There is no turnover threshold and no headcount threshold. A sole trader operating on their own account is responsible for compliance.
Given roughly 97% of New Zealand businesses are small, this is not an edge case; it is the normal condition of doing business there.
Two things a small operator should know. There are now fourteen information privacy principles: the Privacy Amendment Act 2025 brought IPP3A into force on 1 May 2026, requiring you to notify people when you collect their personal information indirectly, from a source other than them, unless an exception applies. And breach notification is mandatory: if a privacy breach has caused or is likely to cause anyone serious harm, you must notify the Privacy Commissioner and the affected people as soon as you are practically able.
That second duty is the one with teeth for an AI leak. If client information ends up somewhere it should not be and serious harm is likely, the obligation to report does not scale with your size.
The GDPR has no size-based exemption. It applies based on what you do with personal data, not how many people you employ. A three-person consultancy handling EU residents' data is in scope.
What smaller organisations get is relief from some administrative obligations, not from the rules themselves. Under Article 30(5), organisations with fewer than 250 employees are excused from maintaining records of processing activities, but only if the processing is occasional, poses no risk to rights and freedoms, and does not involve special-category or criminal-offence data. Those exceptions swallow a lot of real cases. Similarly, an SME needs a Data Protection Officer only where processing is its core activity and carries specific risks, particularly at scale.
Change is in progress but not law. The Commission adopted a Digital Omnibus proposal on 19 November 2025 that would lift the Article 30(5) threshold from 250 to 750 employees, except where processing is likely to result in high risk. The EDPB and EDPS issued a joint opinion on 11 February 2026. It remains a proposal working through the legislative process, so do not plan around it yet.
There is no general federal privacy law. What exists is a patchwork: sector rules such as HIPAA for health information, Section 5 of the FTC Act prohibiting unfair or deceptive practices, which carries no size exemption and has been used against companies that failed to secure data appropriately, and a growing set of state laws.
As of August 2026, roughly twenty-four states have enacted comprehensive consumer privacy laws, of which about twenty are in effect. Most apply only above volume thresholds. California's CCPA, for instance, is triggered by any one of: annual gross revenue above $25 million, buying or selling the personal information of 100,000 or more California residents or households, or deriving 50% or more of revenue from selling or sharing personal information. A twenty-person firm serving local clients typically sits under all three.
Two caveats stop that from being a clean answer. Texas took a different route: its Data Privacy and Security Act exempts small businesses as defined by the federal Small Business Administration rather than by consumer volume, and even then, a small business must obtain consent before selling a consumer's sensitive data. And thresholds are trending downward, not upward, as states amend their laws.
So the honest American position is: probably not covered by a comprehensive state law today, plausibly covered by a sector rule, definitely subject to the FTC Act, and worth re-checking annually.
The statutes are the smaller half of the picture. Regardless of which answer above is yours:
Your client agreements. Most professional engagements carry confidentiality terms. Those are contractual and enforceable whether or not a privacy statute binds you.
Your professional body. Accounting, legal and engineering bodies impose their own confidentiality obligations on members.
Your government and enterprise contracts. Tender terms routinely impose handling requirements directly, often stricter than the law.
Your clients' judgement. A client who learns their financial records were pasted into a consumer AI tool will not be reassured that your turnover was under a threshold in a statute they have never read.
If you operate in New Zealand or the EU, you are covered and the question is only how well you are handling it. If you are in Australia between $1M and $10M turnover, check the number and check the eleven categories, because a good share of firms that size are covered and do not know it. If you are in the United States, you are probably below the state thresholds and still under the FTC Act.
In every case the same gap remains, and no legal status closes it. Someone working quickly pastes a client's bank details, a passport number or an API key into a chat window, because the field looks like any other text box. Policies and training address that for about a fortnight.
Prinn works on the moment itself. It runs on each person's computer and checks a prompt before it is sent. When it finds something like a bank account, a passport number or an API key it shows what it found and offers three choices: redact it, stop, or send it as is. The person decides. It never blocks anyone, and prompt content never leaves the machine, including to us. An owner sees the category, the tool, the date, the device and the choice made, without reading anyone's prompts.
It is reliable on credentials, financial details and identity numbers. Names, home addresses and dates of birth written into ordinary prose are harder, and it is still improving at those. Worth knowing before you rely on it.
Prinn is not legal advice and does not make you compliant with anything. It reduces the chance of an accidental disclosure and shows you where one nearly happened.