Owners corporations, strata managers and the $3 million small-business exemption
The Privacy Act's $3 million small-business exemption is still in force in 2026, so most owners corporations, and many smaller independent managers, remain outside the Australian Privacy Principles. Its removal has been proposed as a future reform, but there is no Bill and no legislated date, so it is not a deadline. Your managing-agent business is caught mainly where it turns over more than A$3 million or belongs to a larger covered group, with a few rarer limbs in s 6D(4) that are fact-specific.
By Jon Oates, Founder of Privaproof · Last updated
General information, document templates and tools you tailor, not legal advice. Privaproof is not a law practice.
The exemption is real, and it is still in force
Under section 6D of the Privacy Act 1988 (Cth), a business with annual turnover of A$3 million or less is generally a "small business operator" and is exempt from the Act and the thirteen Australian Privacy Principles (APPs). That exemption has not been repealed. As at July 2026 it is live law, and a great many owners corporations and smaller strata managers sit inside it.
We say this plainly because the honest position for strata is different from the fear-driven version you may have read. There is no anti-money-laundering trigger for strata management, no designated service and no 1 July 2026 deadline. So the starting question is not "how fast must I comply" but "does the federal Privacy Act reach my business at all". For a lot of strata operators, the answer is genuinely no.
Who the exemption usually still covers
The owners corporation itself. An owners corporation (also called a body corporate or strata company depending on your state) is almost always a small-business operator on turnover. Its levies and reserves rarely approach A$3 million, so as a rule the APPs largely do not bind the scheme itself. That does not make the roll or the resident data any less sensitive, and it does not switch off state strata law, but it does mean the federal Privacy Act is usually not the owners corporation's problem to carry.
A smaller independent managing agent. If your management business turns over A$3 million or less and is not part of a larger corporate group, you may genuinely fall outside the APPs across your business. We will say so rather than sell you coverage you do not have. Many good, careful, small strata offices are simply not APP entities, and pretending otherwise would be dishonest.
Who the exemption does not cover
The exemption is turnover-and-structure driven, so it has two clear exits. Your managing-agent business is an APP entity, and the exemption does not help you, if either of these is true:
- Your turnover exceeds A$3 million. This is the obvious limb. Once your business crosses the threshold on annual turnover, the small-business exemption stops applying and the full APP regime reaches your business.
- You are a related body corporate of a larger covered entity. This is the limb that catches people by surprise. If your brand sits inside a larger corporate group that is itself subject to the Privacy Act, you are pulled in through the related-body-corporate rule regardless of your own local turnover. This is the honest reason many branded and national strata managers are already covered even where a single corner office assumes it is exempt. PICA Group, for example, is Australia's largest strata manager (220,000-plus lots across roughly fifteen brands in NSW, Victoria and Queensland), and firms under groups like that are APP entities through this limb no matter what one office turns over.
A note of precision here: the strata "body corporate" or owners corporation is not the same thing as the Corporations Act "related body corporate" test. They are different legal concepts that happen to share a word. Being a strata body corporate does not make you a related body corporate of anyone. The related-body-corporate limb bites when your management firm sits inside a larger corporate ownership structure, not because it manages a body corporate. Read: strata manager vs owners corporation, who is actually covered?
The proposed removal is not law, and not a deadline
You will see commentary that the small-business exemption is "being scrapped" or "gone from 2026". Treat it with caution. A general removal of the s 6D exemption has been proposed as part of the next tranche of privacy reform, and the Attorney-General described it as "progressing" in Senate estimates in February 2026 . But there is no Bill before Parliament and no legislated commencement date. Proposed is not passed. A reform that is progressing is not a rule you must meet.
So the honest framing is a horizon item, not a countdown. If the exemption is eventually removed, the ground under many small managers would shift, and a kept-current kit is exactly how you would keep pace with that. But as things stand today, you should not act on a deadline that does not exist, and you should not let anyone manufacture urgency out of a reform that is not law. Building compliance panic on this proposal is precisely the mistake we refuse to make.
What binds you regardless of the exemption
This is the part the exemption debate distracts from. Even if the Privacy Act does not reach your business at all, three things still apply, and they apply to the same sensitive data pool:
- State strata legislation. Your state's strata law requires the owners roll and records to be kept and made available for inspection by owners and other entitled people. In NSW, for example, the Strata Schemes Management Act 2015 sets the roll's content (s 178), a record-retention floor of about seven years (s 180), and inspection access on request and payment of the prescribed fee (s 182). Victoria and Queensland impose equivalent register and access duties under the Owners Corporations Act 2006 (Vic) and the Body Corporate and Community Management Act 1997 (Qld), though the exact current section numbers vary with amendments . If you operate elsewhere, check your own state's Act. None of this turns on the Privacy Act.
- Your management agreement. Your contract with the owners corporation imposes its own confidentiality and data-handling obligations, exemption or not.
- State surveillance-devices law. CCTV, video intercoms and audio recording on common property are governed by your state's surveillance-devices legislation, which applies independently of the Privacy Act and binds you even if you are squarely inside the small-business exemption. Recording private conversation is generally a criminal offence, and camera placement, signage and footage access are all regulated. Queensland is a notable outlier here, with no general optical-surveillance offence and only audio regulated . Read: CCTV and surveillance privacy laws for strata
And beyond any statute, a breach of the roll, arrears files or CCTV harms residents whether or not a law compelled you to prevent it. The data is just as sensitive, and the reputational and tribunal exposure just as real, on either side of the A$3 million line.
So, does the exemption cover you?
If you are the owners corporation, or a genuinely small independent manager under A$3 million and not part of a larger group, the s 6D exemption very likely still covers your business under the federal Privacy Act, today. If you turn over more than A$3 million, or your brand sits inside a larger covered group, it does not, and the APPs reach your business. Either way, state strata law, your management agreement and state surveillance law still apply, and you are still sitting on a whole community's most sensitive information. The exemption changes which rulebook you answer to, not whether the data matters. Read the cornerstone: privacy compliance for Australian strata and owners-corporation managers.
Common questions
Has the $3 million small-business exemption been removed?
No. As at July 2026 the section 6D small-business exemption is still in force. A general removal has been proposed as a future privacy reform, and the Attorney-General has described it as progressing , but there is no Bill and no legislated commencement date. It is a horizon item to watch, not a deadline to meet.
Is our owners corporation exempt from the Privacy Act?
Usually, yes. An owners corporation is almost always a small-business operator on turnover, so the small-business exemption generally applies to the scheme itself. That does not remove your obligations under state strata law, your management arrangements, or state surveillance-devices law, which apply regardless.
We are a small manager under $3 million. Are we outside the Privacy Act?
You may genuinely be, if your business turns over A$3 million or less and is not a related body corporate of a larger covered group. We will not tell you that you are "caught" when you are not. But state strata law, your management agreement and state surveillance law still bind you, and the resident data you hold is just as sensitive, so responsible handling still matters.
Why are some branded strata managers covered even though their office is small?
Because of the related-body-corporate limb. If your firm sits inside a larger corporate group that is itself subject to the Privacy Act, you are an APP entity regardless of your own local turnover. This is a different concept from being a strata "body corporate"; the two just share a word. It is the honest reason many national and branded managers are already covered.
If we are exempt, do we still have to worry about CCTV and the owners roll?
Yes. State surveillance-devices law governs common-property cameras and audio independently of the Privacy Act, and applies even inside the exemption. State strata law compels you to keep the owners roll and make it available for inspection. Both bind you whether or not the federal Privacy Act reaches your business.
This is general information and document templates you tailor to your own business, not legal advice. Privaproof is not a law practice and does not provide legal advice. Privaproof's strata documents are self-authored and are not independently reviewed by a solicitor. Whether the Privacy Act 1988 (Cth) applies to your business depends on your turnover and structure; state strata legislation and state surveillance-devices law apply separately and vary by jurisdiction. The Privacy Act, the small-business exemption and proposed reforms change over time, so check you are working from a current version and confirm your own state's requirements. For advice on your specific circumstances, consult a qualified Australian legal practitioner.