Every Australian business carries legal obligations from the moment it starts trading. If you operate through a company, a second layer of obligations sits on top: the Corporations Act 2001 (Cth) and the Australian Securities and Investments Commission (ASIC) govern how the company is structured, run and reported on. Alongside that, commercial law duties apply to how you contract, market, handle personal information and employ people.
Getting these obligations wrong is no longer a slap on the wrist. Civil penalties for breaches of the Australian Consumer Law (ACL) can reach $100 million for a body corporate, and serious privacy breaches can attract penalties of up to $50 million. Directors can also be personally liable. This guide sets out which obligations apply to your business, what each duty requires, what happens if you miss it, and where a lawyer earns their fee.
Which obligations apply to your business
Your structure, size and activity decide your compliance load. The main obligations break down like this:
- Company (Pty Ltd): the full corporate law regime applies, including ASIC registration, registers, financial records, an annual review and directors' duties.
- Sole trader: no company governance duties, but consumer law, privacy, employment and tax obligations still apply, and you are personally liable for debts and claims.
- Partnership: partners carry the business jointly and can be jointly liable for partnership debts, alongside the same commercial law duties.
- Trust: a trustee holds and runs the business for beneficiaries, which adds trustee duties and often specialist structuring advice.
Three thresholds decide whether specific regimes bite:
| Obligation | Trigger |
|---|---|
| Companies and ASIC duties | You incorporate a company |
| GST registration | GST turnover of $75,000 or more |
| Privacy Act 1988 (APP entities) | Annual turnover over $3 million, or a small business in an exempt category |
The Australian Consumer Law is the outlier: it applies to almost every business that supplies goods or services, whatever its size or structure. Employment law applies as soon as you hire someone. Industry licences depend on what you do and where you do it.
Company governance duties under the Corporations Act
If you incorporate, the Corporations Act 2001 (Cth) imposes ongoing duties that do not apply to sole traders or partnerships.
Keep proper records
Under s 286 of the Corporations Act 2001 (Cth), your company must keep written financial records that correctly record and explain its transactions, and those records must be retained for seven years after the transactions are completed. Shareholder registers, director registers and meeting minutes should also be current. Failing to keep financial records is itself an offence under the Act.
Complete the ASIC annual review
Each year, around the anniversary of registration, ASIC sends an annual statement. To stay registered you must check that your company details are up to date, pay the annual review fee and pass a solvency resolution. Late fees apply if you miss the deadline, and ASIC can deregister a company that falls out of compliance.
Notify ASIC of changes
Changes to directors, secretaries, registered office, shareholdings and company details must be lodged with ASIC promptly, not filed away for later.
Meet your directors' duties
Under the Corporations Act 2001 (Cth), directors must exercise their powers with the care and diligence a reasonable person would apply, act in good faith in the best interests of the company and for a proper purpose, and avoid improperly using their position or information. These are civil penalty provisions, and reckless or dishonest breaches are criminal offences. A court can make a declaration of contravention, order a pecuniary penalty, order compensation, or disqualify a director from managing companies. This is where personal exposure lives: the duties attach to the individual director, not just the company.
Execute documents correctly
Under s 127 of the Corporations Act 2001 (Cth), a company can execute a document without a common seal if it is signed by two directors, or by a director and the company secretary. A proprietary company with a sole director who is also the sole secretary, or who has no secretary, can execute with that director's signature alone. Getting execution wrong can make a contract or deed ineffective precisely when you need to rely on it, so it is worth checking who is authorised to sign before you finalise a deal.
Contracts and commercial dealings
Commercial law obligations are mostly about the promises you make and keep. When you sell goods or services, supply a customer, or buy from a supplier, you are entering contracts whether or not anything is signed.
Use written contracts
Customer terms, service agreements and supplier agreements set out scope, price, payment terms, warranties, liability limits and termination rights. Written terms manage expectations and give you a defence when a dispute arises about what was agreed.
Negotiate before you sign
Understand the key clauses and push back on anything that does not fit your business, particularly unlimited liability, one-sided termination rights and broad indemnities.
Standardise where possible
If you sell online, publish clear website terms and use consistent order forms or statements of work. Standard documents are cheaper to maintain and easier to keep compliant as your business changes.
Consumer law duties under the ACL
The Australian Consumer Law is Schedule 2 of the Competition and Consumer Act 2010 (Cth), and it applies to nearly every supplier of goods or services to consumers.
Consumer guarantees
Goods supplied to a consumer must be of acceptable quality, which means fit for the purposes goods of that kind are commonly used for, acceptable in appearance and finish, free from defects, safe and durable. Services must be rendered with due care and skill. You cannot contract out of these guarantees, and they apply regardless of any extra warranty you offer.
No misleading conduct
Section 18 of the ACL prohibits engaging in conduct, in trade or commerce, that is misleading or deceptive or likely to mislead or deceive. This covers your website copy, advertisements, headlines, testimonials, fine print and comparisons with competitors. It is one of the most litigated provisions in Australian commercial law, and you do not need to intend to mislead for it to bite.
Warranty documents
If you offer warranties, the documentation must meet the ACL's requirements, including stating that the consumer's rights under the ACL are not limited by the warranty.
Consequences of ACL breaches
Courts can order injunctions, damages and other remedies for ACL breaches. For contraventions of many ACL provisions, including false or misleading representations about goods or services, pecuniary penalties can reach the greater of $100 million for a body corporate, three times the benefit gained, or 30% of adjusted turnover. Individuals face penalties of up to $2.5 million. The Australian Competition and Consumer Commission (ACCC) enforces the ACL and regularly pursues small and mid-sized businesses.
Privacy and data handling
Privacy obligations in Australia come mainly from the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
Do you need to comply?
The Act applies to APP entities. Generally, that means businesses with an annual turnover of more than $3 million. A business is a small business if its annual turnover for the previous financial year was $3 million or less, and small businesses are exempt unless they fall into a category that removes the exemption, such as health service providers, businesses that trade in personal information, and credit reporting bodies.
Your duties if you are an APP entity
Publish a clear privacy policy explaining what you collect and why. Only collect what you actually need, secure it appropriately, and handle requests to access or correct personal information. If you suffer an eligible data breach that is likely to result in serious harm, you must notify affected individuals and the Office of the Australian Information Commissioner (OAIC).
Marketing
Email and SMS marketing must comply with the Spam Act 2003 (Cth), which requires consent, accurate sender identification and a functioning unsubscribe facility.
Consequences for privacy breaches
A serious or repeated interference with privacy is a civil penalty provision. For a body corporate the maximum penalty is the greatest of $50 million, three times the benefit obtained, or 30% of adjusted turnover. Individuals can face penalties of up to $2.5 million.
Not every small business is legally required to have a privacy policy, but many adopt one as best practice and to prepare for the growth that will bring them within the regime.
Employment duties when you hire
The moment you employ someone, the Fair Work Act 2009 (Cth) applies. The National Employment Standards set minimum terms covering maximum working hours, leave entitlements, notice of termination and more, and a modern award may set further minimum pay rates and conditions for your industry. On top of those statutory minimums, keep these items in order:
- Written agreements: give each employee a written contract covering duties, hours, pay, leave, confidentiality and intellectual property.
- Pay obligations: withhold PAYG tax, pay superannuation guarantee contributions for eligible employees, and keep accurate records.
- Contractors vs employees: document contractor relationships carefully. The label matters less than the reality of the working arrangement, and misclassifying an employee as a contractor can expose you to back-pay claims.
- Workplace policies: practical policies on leave, bullying, discrimination and health and safety protect both your staff and your business.
Tax registrations and licences
Beyond the legal regimes above, you will need the right registrations and permissions:
- ABN and business name: get an ABN before you start trading, and if you trade under a name other than your own, register the business name.
- GST: register for GST once your GST turnover is $75,000 or more in a 12-month period, as the ATO explains. You must also register if you start a new business and expect to reach the threshold. Penalties can apply if you fail to register when required.
- Licences and permits: industry and location often dictate extra requirements, from food handling permits and building licences to liquor, transport and childcare approvals. Check state, territory and local council rules early.
- Intellectual property: register your brand name or logo as a trade mark with IP Australia to protect it, and use confidentiality agreements when sharing sensitive information.
A practical compliance checklist
Work through these items at least once a year, and whenever something changes:
- [ ] Confirm your business structure still suits your risk and tax position.
- [ ] If you run a company, check your ASIC annual review date, keep registers and records current, and lodge changes promptly.
- [ ] Review customer, supplier and website terms to make sure they match how you actually do business.
- [ ] Check advertising and marketing materials against the ACL, including guarantees and testimonials.
- [ ] Assess whether you are an APP entity: turnover over $3 million, health services, or trading in personal information.
- [ ] Update your privacy policy and data breach response plan if you collect personal information.
- [ ] Make sure employment contracts, award coverage and pay rates are current for every worker.
- [ ] Confirm GST, PAYG and superannuation registrations and payments are in order.
- [ ] Check that industry licences and permits are current.
Where a lawyer helps
Much of this you can manage yourself, but certain moments justify professional advice:
- Incorporating: a lawyer prepares your constitution, share structure and, with co-founders, a shareholders agreement covering decision-making, equity, vesting and exits.
- Contract review: before you sign a large customer or supplier agreement, or when standard terms have not been updated in years.
- Compliance reviews: a commercial lawyer can audit your contracts, marketing and privacy practices against the ACL and the Privacy Act 1988 (Cth) before a regulator comes knocking.
- Director duties: when a director faces a conflict, a possible insolvent trading issue, or a decision with personal liability risk.
- Buying or selling a business: due diligence on contracts, licences, employees, intellectual property and compliance history, plus drafting warranties and indemnities.
A lawyer's role is to turn your obligations into practical documents and to tell you where the real risk sits, so you spend your money on the problems that matter rather than the ones that sound frightening.
The thresholds that catch growing businesses
Most growing businesses do not trip over the rules they know about. They trip when a threshold quietly switches on a new regime. Hitting $75,000 in GST turnover is obvious enough because it affects pricing. The $3 million privacy threshold is different: it is based on the previous financial year's turnover, so it can switch on APP obligations before you have a privacy policy, a breach response plan or consent processes in place.
The duty most often missed in small companies is not glamorous either. Directors stay on top of trading, sales and customers while registers go stale, the ASIC annual review fee goes unpaid, and financial records fall short of the seven-year retention rule. Those are the failures ASIC and the courts actually act on, and they are the ones that turn a manageable problem into a director-level liability.
This week, do three things. Check your ASIC annual review date and solvency position if you run a company. Work out your turnover for the last financial year and test it against the $3 million privacy threshold and the $75,000 GST threshold. And read your own website terms and privacy policy as if you were a customer. If any of those raise questions you cannot answer confidently, that is the moment to call a commercial lawyer.