Owners corporations, strata managers and the $3 million small-business exemption
The Privacy Act's $3 million small-business exemption is still in force in September 2026, so an owners corporation, or a smaller independent manager, may sit outside the Australian Privacy Principles. Its removal has been proposed as a future reform, and the exposure draft released for consultation on 31 August 2026 keeps the exemption, so no Bill removing it is before Parliament and no date is legislated. A managing-agent business is most often caught where a completed financial year has exceeded A$3 million (s 6D(1) and s 6D(4)(a)), or where it is a body corporate related to a body corporate that carries on a business that is not a small business (s 6D(9)). The other limbs in s 6D(4) are fact-specific.
By Jon Oates, Founder of Privaproof · Last updated
General information, document templates and tools you tailor, not legal advice. Privaproof is not a law practice.
The exemption is real, and it is still in force
Under section 6D of the Privacy Act 1988 (Cth), a business whose annual turnover for the previous financial year was A$3 million or less is a small business, and an entity that carries on only small businesses is a "small business operator" (s 6D(1) and s 6D(3)). A small business operator is not an "organisation" (s 6C(1)), so the thirteen Australian Privacy Principles do not apply to it. That is an exemption from the APPs, not from the whole Act: the statutory tort in Schedule 2, in force since 10 June 2025, reaches entities that are not APP entities, and anyone holding tax file number information is bound by the Privacy (Tax File Number) Rule 2015 whatever their turnover. That exemption has not been repealed. As at September 2026 it is live law. How many owners corporations and strata managers sit inside it is not something anyone publishes, so the only way to know is to test your own turnover and structure against s 6D.
We say this plainly because the honest position for strata is different from the fear-driven version you may have read. Strata management is not one of the real-estate designated services. Table 5 of the AML/CTF Act covers brokering or selling real estate, and Table 6 items 1 and 2 cover assisting a person to sell, buy or transfer real estate or a body corporate, none of which is what a strata office is engaged to do, so the 1 July 2026 AML obligations date is not a strata date. Item 3, which covers receiving, holding or disbursing a person's money as part of assisting in a transaction, is expressly subject to the exclusions in s 6(5C) and turns on how money actually moves through the accounts, so that one is a question for your own advisers rather than something a web page can settle. So the starting question is not "how fast must I comply" but "does the federal Privacy Act reach my business at all".
Who the exemption usually still covers
The owners corporation itself. An owners corporation (also called a body corporate or strata company depending on your state) is a body corporate, so s 6D applies to it like any other entity: the question is whether its annual turnover for the previous financial year was A$3 million or less (s 6D(1)), and whether it carries on one or more small businesses (s 6D(3)). A scheme whose levies and reserves stay under that figure is generally outside the APPs. Two qualifications are worth stating plainly: a very large scheme can pass the threshold on its own levies, and whether an owners corporation carries on a business at all, which s 6D(3) requires, is not settled by any source we can cite. Check the scheme's own annual income rather than assuming. That does not make the roll or the resident data any less sensitive, and it does not switch off state strata law, but it does mean the federal Privacy Act is usually not the owners corporation's problem to carry.
A smaller independent managing agent. If your management business turns over A$3 million or less and is not part of a larger corporate group, you may genuinely fall outside the APPs across your business. We will say so rather than sell you coverage you do not have. Many good, careful, small strata offices are simply not APP entities, and pretending otherwise would be dishonest.
Who the exemption does not cover
Turnover and group structure are the two limbs that decide most strata cases, but they are not the only ones. Section 6D(4) lists six, and s 6D(9), s 6E and the s 6EA opt-in add others. Your managing-agent business is an APP entity, and the exemption does not help you, if either of these is true:
- Turnover above A$3 million. The test in s 6D(1) looks at the previous financial year, and s 6D(4)(a) is written historically: once a completed financial year has exceeded A$3 million, the business is outside the definition of small business operator, and a later fall in turnover does not bring it back. Section 6DA lists what counts, including commission income and rent, leasing and hiring income.
- The management company is related to a body corporate that is not small. Section 6D(9) says a body corporate is not a small business operator if it is related to a body corporate that carries on a business that is not a small business, and s 6(8) sends the question of what "related" means to the Corporations Act 2001. So a management company inside a larger group can be an APP entity on the group's turnover rather than its own. The limb reaches only a body corporate, so a sole trader or a partnership is not caught by it. This is the honest reason many branded and national strata managers are already covered even where a single corner office assumes it is exempt.
A note of precision here: the strata "body corporate" or owners corporation is not the same thing as the Corporations Act "related body corporate" test. They are different legal concepts that happen to share a word. Being a strata body corporate does not make you a related body corporate of anyone. The related-body-corporate limb bites when your management firm sits inside a larger corporate ownership structure, not because it manages a body corporate. Read: strata manager vs owners corporation, who is actually covered?
The proposed removal is not law, and not a deadline
You will see commentary that the small-business exemption is "being scrapped" or "gone from 2026". Treat it with caution. A general removal of the s 6D exemption has been proposed as part of the next tranche of privacy reform, and it is not in the current draft. The Attorney-General's Department released an exposure draft, the Privacy Amendment (Personal Data Protection) Bill 2026, for consultation on 31 August 2026, with submissions closing on 18 September 2026. That draft rewrites the s 6D(4) trading limbs and keeps the small-business exemption itself. No Bill removing the exemption is before Parliament and no commencement date is legislated. Proposed is not passed. Proposed is not passed. A reform that is progressing is not a rule you must meet.
So the honest framing is a horizon item, not a countdown. If the exemption is eventually removed, the ground under many small managers would shift, and a kept-current kit is exactly how you would keep pace with that. But as things stand today, you should not act on a deadline that does not exist, and you should not let anyone manufacture urgency out of a reform that is not law. Building compliance panic on this proposal is precisely the mistake we refuse to make.
What binds you regardless of the exemption
This is the part the exemption debate distracts from. Even if the Australian Privacy Principles do not reach your business, three things still apply, and they apply to the same sensitive data pool:
- State strata legislation. Your state's strata law requires the owners roll and records to be kept and made available for inspection by owners and other entitled people. In NSW the Strata Schemes Management Act 2015 sets what the strata roll must contain (s 178), requires the owners corporation to retain records for seven years unless the regulations prescribe another period (s 180), and lets an owner, mortgagee or covenant chargee of a lot, or a person they authorise, inspect the records on written request accompanied by the prescribed fee (s 182). Victoria and Queensland run their own register and access regimes, and the detail differs. In Queensland the body corporate must, within 7 days of a written request accompanied by the prescribed fee, let an interested person inspect its records or give copies (Body Corporate and Community Management Act 1997 s 205, with "interested person" defined at s 205(13)); the roll and retention rules sit in the regulation module for the scheme, not in the Act. In Victoria the Owners Corporations Act 2006 covers records (ss 144 and 145) and the owners corporation register (ss 148 and 150), and Consumer Affairs Victoria states that inspecting the register is free, with a fee only for copies. Confirm the current provision for your own state before relying on it. If you operate elsewhere, check your own state's Act. None of this turns on the Privacy Act.
- Your management agreement. Your contract with the owners corporation imposes its own confidentiality and data-handling obligations, exemption or not.
- State surveillance-devices law. CCTV, video intercoms and audio recording on common property are governed by your state's surveillance-devices legislation, which applies independently of the Privacy Act and binds you even if you are squarely inside the small-business exemption. Recording a private conversation is an offence in NSW even where the person recording is a party to it (Surveillance Devices Act 2007 (NSW) s 7(1)(b), subject to the exceptions in that section), while Queensland expressly exempts a party to the conversation (Invasion of Privacy Act 1971 (Qld) s 43(2)(a)). The rule genuinely differs by state, so check your own. Queensland is a notable outlier here, with no general optical-surveillance offence and only audio regulated . Read: CCTV and surveillance privacy laws for strata
And beyond any statute, a breach of the roll, arrears files or CCTV harms residents whether or not a law compelled you to prevent it. The data is just as sensitive on either side of the A$3 million line. The exemption changes which rulebook you answer to, not whether the information matters.
So, does the exemption cover you?
If you are the owners corporation, or a genuinely small independent manager under A$3 million and not part of a larger group, the s 6D exemption very likely still covers your business under the federal Privacy Act, today. If you turn over more than A$3 million, or your brand sits inside a larger covered group, it does not, and the APPs reach your business. Either way, state strata law, your management agreement and state surveillance law still apply, and you are still sitting on a whole community's most sensitive information. The exemption changes which rulebook you answer to, not whether the data matters. Read the cornerstone: privacy compliance for Australian strata and owners-corporation managers.
Common questions
Has the $3 million small-business exemption been removed?
No. As at July 2026 the section 6D small-business exemption is still in force. A general removal has been proposed as a future privacy reform, and the Attorney-General has described it as progressing , but there is no Bill and no legislated commencement date. It is a horizon item to watch, not a deadline to meet.
Is our owners corporation exempt from the Privacy Act?
Often, but check rather than assume. The test in s 6D(1) is whether the scheme's annual turnover for the previous financial year was A$3 million or less, and s 6D(3) also asks whether it carries on a business at all, which is not settled for an owners corporation. A large scheme can pass the threshold on its own levies. Either way, state strata law, your management arrangements and state surveillance-devices law apply regardless.
We are a small manager under $3 million. Are we outside the Privacy Act?
You may genuinely be, if your business turns over A$3 million or less and is not a related body corporate of a larger covered group. We will not tell you that you are "caught" when you are not. But state strata law, your management agreement and state surveillance law still bind you, and the resident data you hold is just as sensitive, so responsible handling still matters.
Why are some branded strata managers covered even though their office is small?
Because of the related-body-corporate limb. If your firm sits inside a larger corporate group that is itself subject to the Privacy Act, you are an APP entity regardless of your own local turnover. This is a different concept from being a strata "body corporate"; the two just share a word. It is the honest reason many national and branded managers are already covered.
If we are exempt, do we still have to worry about CCTV and the owners roll?
Yes. State surveillance-devices law governs common-property cameras and audio independently of the Privacy Act, and applies even inside the exemption. State strata law compels you to keep the owners roll and make it available for inspection. Both bind you whether or not the federal Privacy Act reaches your business.
This is general information and document templates you tailor to your own business, not legal advice. Privaproof is not a law practice and does not provide legal advice. Whether the Privacy Act 1988 (Cth) applies to your business depends on your turnover and structure; state strata legislation and state surveillance-devices law apply separately and vary by jurisdiction. The Privacy Act, the small-business exemption and proposed reforms change over time, so check you are working from a current version and confirm your own state's requirements. For advice on your specific circumstances, consult a qualified Australian legal practitioner.