Skip to content

How do you calculate annual turnover for the A$3m Privacy Act threshold?

Annual turnover is your total operating income earned in the course of the business over a financial year, not your profit and not the money that passes through your trust account for someone else. Section 6DA of the Privacy Act 1988 (Cth) lists seven categories that make it up, including commission income and rent, leasing and hiring income. You test the previous financial year, and the test has no way back: once any completed financial year has exceeded A$3 million, the business stops being a small business operator permanently.

By Jon Oates, Founder of Privaproof · Last updated · Start the free 2-min audit →

General information, not legal advice. Your obligations depend on your circumstances.

Want the answer for your own agency rather than the general position? The Am I Covered? check walks you through the questions that decide it, in about two minutes.

Almost every article about the small-business exemption states the A$3 million figure and stops there. The figure is the easy part. What agencies actually get stuck on is which number goes into the test, which year it comes from, and whether the rent moving through the trust account belongs in it. This page answers those, with the provisions quoted.

Not sure it's you?

Does this apply to you?

Tap what's true for your agency. Nothing is saved.

Tap what's true above to see where you stand.
Check the Kit against your setupA$539 / year incl GST · founding price

Orientation only, not a compliance assessment. General information and tools, not legal advice.

What counts as annual turnover under the Privacy Act?

Short answer: seven categories of operating income, added together, for one financial year.

Section 6DA(1) of the Privacy Act 1988 (Cth) defines it:

The annual turnover of a business for a financial year is the total of the following that is earned in the year in the course of the business:
(a) the proceeds of sales of goods and/or services;
(b) commission income;
(c) repair and service income;
(d) rent, leasing and hiring income;
(e) government bounties and subsidies;
(f) interest, royalties and dividends;
(g) other operating income.

Two things follow that catch people out. It is income, not profit: your costs, wages and commissions paid out to salespeople do not come off it. And the section has only two subsections, (1) and (2). There is no further list of inclusions or exclusions anywhere in it.

What it means for an agency. Your sales commission sits in (b). Your management fees sit in (b) or (g). Interest the agency earns on its own accounts sits in (f). If the agency owns property and rents it out, that rental income sits in (d).

Source: Privacy Act 1988 (Cth) s 6DA(1), Compilation No. 104 (compilation date 4 June 2026), authorised version C2026C00227.

Is there a shortcut to working out annual turnover?

Short answer: yes, and it is written into the section itself, which almost nobody quotes.

Section 6DA(1) carries a Note:

The annual turnover for a financial year of a business carried on by an entity that does not carry on another business will often be similar to the total of the instalment income the entity notifies to the Commissioner of Taxation for the 4 quarters in the year (or for the year, if the entity pays tax in annual instalments).

So the Act itself points you at a number your business already reports to the ATO through PAYG instalments, rather than asking you to build the figure from scratch.

Read the words carefully, because they are doing real work. It says "will often be similar to", not "is". It is a cross-check, not a definition, and it is expressed to apply to an entity that does not carry on another business. If your entity runs a rent roll and a sales business and something else besides, the shortcut is weaker and the s 6DA(1) categories are what govern.

Source: Privacy Act 1988 (Cth) s 6DA(1), Note.

Which financial year does the A$3m turnover test use?

Short answer: the previous one, unless the business is new.

Section 6D(1):

A business is a small business at a time (the test time) in a financial year (the current year) if its annual turnover for the previous financial year is $3,000,000 or less.

Section 6D(2) covers a business that did not exist then:

However, if there was no time in the previous financial year when the business was carried on, the business is a small business at the test time only if its annual turnover for the current year is $3,000,000 or less.

And if the business ran for only part of a year, s 6DA(2) grosses the part-year figure up to a full-year equivalent, by multiplying it by the number of days in the whole financial year over the number of days in the part. A strong six months does not get counted as six months.

Source: Privacy Act 1988 (Cth) ss 6D(1), 6D(2), 6DA(2).

If you go over A$3m once, can you go back under?

Short answer: no. The test runs one way only.

This is the single most consequential mechanic on this page, and it is the one most often described incorrectly. Section 6D(4)(a):

However, an individual, body corporate, partnership, unincorporated association or trust is not a small business operator if he, she or it:
(a) carries on a business that has had an annual turnover of more than $3,000,000 for a financial year that has ended after the later of the following:
(i) the time he, she or it started to carry on the business;
(ii) the commencement of this section;

The words to notice are "has had" and "a financial year that has ended". That is historical, not current. A quiet year afterwards does not restore the exemption, because s 6D(4) sits above the year-by-year test in s 6D(1) and overrides it.

What it means for an agency. One strong year, a single large commercial settlement, or a year with an unusual one-off is enough to put the agency permanently outside the small-business exemption. So the question is not "what did we turn over last year", it is "has this business ever finished a financial year above A$3 million". The one boundary in your favour is textual: the clock starts at the later of the section's commencement or the time you started carrying on the business, so a genuinely new entity starts clean.

Source: Privacy Act 1988 (Cth) s 6D(4)(a).

Does rent collected on behalf of landlords count towards turnover?

Short answer: the Act does not say, and this is the honest position rather than a hedge.

Here is the difficulty, stated plainly. Section 6DA(1) is an inclusive list and paragraph (d) expressly names "rent, leasing and hiring income". There is no trust-account carve-out anywhere in the section, and no provision excluding money received or held on behalf of another person. So the argument for leaving a landlord's gross rent out of the figure rests on a single phrase in the opening words: turnover is what is "earned in the year in the course of the business". The agency earns its management fee and its commission. The gross rent belongs to the landlord and passes through the trust account.

That is a reasonable reading. It is not an express statutory exclusion, there is no case law settling it, and paragraph (d) means an agency's own rental income does count.

What it means for an agency. If your rent roll is large enough that the answer decides whether you are over A$3 million, this is a question for your accountant on your actual figures, not a question a web page should answer for you. If the answer does not change your side of the line either way, it does not need resolving.

⚠️ One warning worth carrying away: several AI assistants, asked this question, will tell you s 6DA excludes "money received on behalf of another person" or "proceeds of supplies". Those words are not in the Privacy Act. The second phrase is GST legislation language. Check the section itself before relying on an answer of that kind, including this one.

Source: Privacy Act 1988 (Cth) s 6DA(1), read in full.

Is the A$3m figure GST inclusive or exclusive?

Short answer: the Privacy Act does not address GST at all.

Section 6DA contains no GST rule in either direction, and there is no definition elsewhere in the Act that supplies one. What the section does give you is the Note above, which points at the instalment income your entity reports to the ATO. That is a defined tax figure, so the practical route is to start from the number your accountant already prepares and ask them which basis it is on, rather than trying to derive a GST position out of a statute that is silent.

If your turnover sits far enough from A$3 million that GST could not move it across the line, the question is academic for you.

Source: Privacy Act 1988 (Cth) s 6DA, read in full.

Short answer: no. There is no aggregation rule, and this is widely misunderstood.

Section 6D(9) does not add anything up:

Despite subsection (3), a body corporate is not a small business operator if it is related to a body corporate that carries on a business that is not a small business.

Read what that actually tests. It does not combine the turnover of related companies and compare the total to A$3 million. It asks whether one of your related bodies corporate is, on its own figures, not a small business. If one is, the exemption goes for the related company too. If every company in the group is independently under, s 6D(9) does not bite.

Whether two companies are related is answered outside the Privacy Act. Section 6(8):

For the purposes of this Act, the question whether bodies corporate are related to each other is determined in the manner in which that question is determined under the Corporations Act 2001.

Under that Act the relationship is broadly a holding company, a subsidiary, or two subsidiaries of the same holding company. Two companies that merely share an individual owner are not related bodies corporate on that test.

Source: Privacy Act 1988 (Cth) ss 6D(9), 6(8); Corporations Act 2001 (Cth).

What if one entity runs several businesses and only one is over A$3m?

Short answer: one business over the line takes the whole operator over.

Section 6D(3) defines the operator, not the business:

A small business operator is an individual, body corporate, partnership, unincorporated association or trust that:
(a) carries on one or more small businesses; and
(b) does not carry on a business that is not a small business.

Paragraph (b) is the one that matters for a multi-stream agency. The status attaches to the operator as a whole, so if one entity runs a rent roll, a sales business and a property-management arm, and any one of them is not a small business, the operator is not a small business operator. There is no partial exemption for the streams that are individually under.

Source: Privacy Act 1988 (Cth) s 6D(3).

How do you check whether your agency is under the A$3m threshold?

Four questions decide it, in this order:

1. Has this business ever finished a financial year above A$3 million? If yes, the turnover test is settled and nothing below matters. 2. What was the previous financial year's total across the s 6DA(1) categories, starting from the instalment income the Note points to? 3. Is any related body corporate over on its own figures? 4. Does this operator carry on any business that is not a small business?

And a point worth holding on to: turnover is only one of the routes into the Privacy Act. Sections 6D(4)(b) to (f) bring in health services, trading in personal information and Commonwealth contracted service providers regardless of size, and since 31 March 2026 agencies providing designated services around property sales are reporting entities, which reaches their AML data whatever their turnover. Being under A$3 million answers one question, not the question. See Does the Privacy Act apply to real estate agents? for the full set of triggers.

All passages on this page are quoted from the Privacy Act 1988 (Cth), Compilation No. 104, compilation date 4 June 2026, authorised version C2026C00227, read from the Federal Register of Legislation.